July 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201607-4] thunderbird: arbitrary code execution
by Remi Gacogne 10 Jul '16

10 Jul '16

Arch Linux Security Advisory ASA-201607-4 ========================================= Severity: Critical Date : 2016-07-10 CVE-ID : CVE-2016-2815 CVE-2016-2818 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.2.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 45.2.0-1. # pacman -Syu "thunderbird>=45.2.0-1" The problems have been fixed upstream in version 45.2.0. Workaround ========== None. Description =========== - CVE-2016-2815 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-2818 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://access.redhat.com/security/cve/CVE-2016-2815 https://access.redhat.com/security/cve/CVE-2016-2818

1 0

[arch-security] [ASA-201607-3] libreoffice-fresh: arbitrary code execution
by Levente Polyak 05 Jul '16

05 Jul '16

Arch Linux Security Advisory ASA-201607-3 ========================================= Severity: Critical Date : 2016-07-05 CVE-ID : CVE-2016-4324 Package : libreoffice-fresh Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libreoffice-fresh before version 5.1.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.1.4-1. # pacman -Syu "libreoffice-fresh>=5.1.4-1" The problem has been fixed upstream in version 5.1.4. Workaround ========== None. Description =========== A use after free vulnerability was found in the RTF parser of LibreOffice. The vulnerability lies in the parsing of documents containing both stylesheet and superscript tokens. A specially crafted RTF document containing both a stylesheet and superscript element causes LibreOffice to access an invalid pointer referencing previously used memory on the heap. By carefully manipulating the contents of the heap, this vulnerability can be used to execute arbitrary code. Impact ====== An attacker is able to use a specially crafted RTF document that, when opened locally, is leading to arbitrary code execution. References ========== https://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/ http://www.talosintelligence.com/reports/TALOS-2016-0126/ https://access.redhat.com/security/cve/CVE-2016-4324

1 0

[arch-security] [ASA-201607-2] xerces-c: denial of service
by Levente Polyak 05 Jul '16

05 Jul '16

Arch Linux Security Advisory ASA-201607-2 ========================================= Severity: Medium Date : 2016-07-05 CVE-ID : CVE-2016-4463 Package : xerces-c Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package xerces-c before version 3.1.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.1.4-1. # pacman -Syu "xerces-c>=3.1.4-1" The problem has been fixed upstream in version 3.1.4. Workaround ========== None. Description =========== The Xerces-C XML parser fails to successfully parse a DTD that is deeply nested, and this causes a stack overflow, which makes a denial of service attack against many applications possible by an unauthenticated attacker. Impact ====== A remote attacker is able to use a specially crafted XML document that, when processed, is leading to application crash resulting in denial of service. References ========== https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt http://seclists.org/bugtraq/2016/Jun/115 https://access.redhat.com/security/cve/CVE-2016-4463

1 0

[arch-security] [ASA-201607-1] libarchive: arbitrary code execution
by Levente Polyak 05 Jul '16

05 Jul '16

Arch Linux Security Advisory ASA-201607-1 ========================================= Severity: Critical Date : 2016-07-05 CVE-ID : CVE-2016-1541 Package : libarchive Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libarchive before version 3.2.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.2.0-1. # pacman -Syu "libarchive>=3.2.0-1" The problem has been fixed upstream in version 3.2.0. Workaround ========== None. Description =========== A vulnerability was found in libarchive. A specially crafted zip file can provide an incorrect compressed size, which may allow an attacker to place arbitrary code on the heap and execute it in the context of the application. Impact ====== A remote attacker is able to use a specially crafted zip file that, when processed, is leading to arbitrary code execution. References ========== https://github.com/libarchive/libarchive/commit/d0331e8e https://www.kb.cert.org/vuls/id/862384 https://access.redhat.com/security/cve/CVE-2016-1541

1 0