August 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201608-22] mupdf: arbitrary code execution
by Levente Polyak 31 Aug '16

31 Aug '16

Arch Linux Security Advisory ASA-201608-22 ========================================== Severity: Critical Date : 2016-08-30 CVE-ID : CVE-2016-6525 Package : mupdf Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mupdf before version 1.9a-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.9a-5 # pacman -Syu "mupdf>=1.9a-5" The fix has been backported from an upstream patch. Workaround ========== None. Description =========== Yu Hong and Zheng Jihong discovered a heap overflow vulnerability within the pdf_load_mesh_params function, allowing an attacker to cause an application crash (denial-of-service), or potentially to execute arbitrary code with the privileges of the user running MuPDF, if a specially crafted PDF file is processed. Impact ====== A remote attacker can execute arbitrary code or crash MuPDF by tricking a user into opening a crafted pdf file. References ========== http://bugs.ghostscript.com/show_bug.cgi?id=696954 https://security-tracker.debian.org/tracker/CVE-2016-6525 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=39b0f07dd960f34e7e6b…

1 0

[arch-security] [ASA-201608-21] mupdf: arbitrary code execution
by Levente Polyak 30 Aug '16

30 Aug '16

Arch Linux Security Advisory ASA-201608-21 ========================================== Severity: Critical Date : 2016-08-30 CVE-ID : CVE-2016-6265 Package : mupdf Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mupdf before version 1.9a-4 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.9a-4 # pacman -Syu "mupdf>=1.9a-4" The fix has been backported from an upstream patch. Workaround ========== None. Description =========== Marco Grassi discovered a use-after-free vulnerability in MuPDF. An attacker can take advantage of this flaw to cause an application crash (denial-of-service), or potentially to execute arbitrary code with the privileges of the user running MuPDF, if a specially crafted PDF file is processed. Impact ====== A remote attacker can execute arbitrary code or crash MuPDF by tricking a user into opening a crafted pdf file. References ========== http://bugs.ghostscript.com/show_bug.cgi?id=696941 https://security-tracker.debian.org/tracker/CVE-2016-6265

1 0

[arch-security] [ASA-201608-20] wireshark-cli: denial of service
by Christian Rebischke 27 Aug '16

27 Aug '16

Arch Linux Security Advisory ASA-201608-20 ========================================== Severity: Low Date : 2016-08-27 CVE-ID : CVE-2016-6505 CVE-2016-6506 CVE-2016-6508 CVE-2016-6509 CVE-2016-6510 CVE-2016-6511 CVE-2016-6512 CVE-2016-6513 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-cli before version 2.0.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.5-1. # pacman -Syu "wireshark-cli>=2.0.5-1" The problem has been fixed upstream in version 2.0.5. Workaround ========== None. Description =========== - CVE-2016-6505 (denial of service) It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2016-6506 (denial of service) It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2016-6508 (denial of service) It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2016-6509 (denial of service) It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2016-6510 (denial of service) It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2016-6511 (denial of service) It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2016-6512 (denial of service) It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2016-6513 (denial of service) It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able to crash or make wireshark consume excessive CPU resources by injecting a malformed packet or convincing someone to read a malformed packet trace. References ========== https://access.redhat.com/security/cve/CVE-2016-6505 https://access.redhat.com/security/cve/CVE-2016-6506 https://access.redhat.com/security/cve/CVE-2016-6508 https://access.redhat.com/security/cve/CVE-2016-6509 https://access.redhat.com/security/cve/CVE-2016-6510 https://access.redhat.com/security/cve/CVE-2016-6511 https://access.redhat.com/security/cve/CVE-2016-6512 https://access.redhat.com/security/cve/CVE-2016-6513 http://www.wireshark.org/security/wnpa-sec-2016-41.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12577 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=94e97e4… http://www.wireshark.org/security/wnpa-sec-2016-42.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12594 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=a9d5256… http://www.wireshark.org/security/wnpa-sec-2016-44.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12660 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=6cf9616… http://www.wireshark.org/security/wnpa-sec-2016-45.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12662 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=5a469dd… http://www.wireshark.org/security/wnpa-sec-2016-46.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12664 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=47a5fa8… http://www.wireshark.org/security/wnpa-sec-2016-47.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12659 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=5670642… http://www.wireshark.org/security/wnpa-sec-2016-48.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12661 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=2193bea… http://www.wireshark.org/security/wnpa-sec-2016-49.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12663 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=347f071…

1 0

[arch-security] [ASA-201608-19] mediawiki: multiple issues
by Christian Rebischke 26 Aug '16

26 Aug '16

Arch Linux Security Advisory ASA-201608-19 ========================================== Severity: Medium Date : 2016-08-26 CVE-ID : CVE-2016-6331 CVE-2016-6332 CVE-2016-6333 CVE-2016-6334 CVE-2016-6335 CVE-2016-6336 CVE-2016-6337 Package : mediawiki Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mediawiki before version 1.27.1-1 is vulnerable to multiple issues including cross-site scripting, information disclosure and permission bypass. Resolution ========== Upgrade to 1.27.1-1. # pacman -Syu "mediawiki>=1.27.1-1" The problems have been fixed upstream in version 1.27.1. Workaround ========== None. Description =========== - CVE-2016-6331 (permission bypass) Check read permission when loading page content in ApiParse. Prevents leaking page contents for extensions that deny read rights to certain pages via a userCan hook, but still allow the user to have read rights in general. - CVE-2016-6332 (permission bypass) Make $wgBlockDisablesLogin also restrict logged in permissions. Does both Title and user related methods, so it catches things that only call $wgUser->isAllowed( 'read' ), as well as giving a nicer error message for things that use $title->userCan(). Otherwise, the user can still do stuff and read pages if they have an ongoing session. - CVE-2016-6333 (cross-site scripting) Escape '<' and ']]>' in inline <style> blocks. This is to prevent people from closing the <style> tag, and then doing arbitrary js-y things. In particular, this is needed for when previewing user css pages. This does not escape '>' since its used as the child selector in css, and generally speaking, '>' is safe inside the contents of elements. - CVE-2016-6334 (cross-site scripting) rawurldecode was being run on unclosed internal links which could allow an attacker to insert arbitrary html into the page. - CVE-2016-6335 (information disclosure) API: Generate head items in the context of the given title. $context->getOutput() returns an OutputPage tied to the main RequestContext at the root of the chain, not to the modified context we're actually using. - CVE-2016-6336 (permission bypass) Do not allow undeleting a revision deleted file if it is the top file. This prevents admins being able to view suppressed files, by simply deleting them, and then undeleting only the file revision that they want to view. - CVE-2016-6337 (permission bypass) Move 'UserGetRights' call before application of Session::getAllowedUserRights(). This prevents hook functions from accidentally adding rights that should be denied based on the session grants. If some extension really needs to be able to override session grants, add a new hook where the old call was, with documentation explicitly warning about the security implications. Impact ====== A remote attacker is able to execute arbitrary javascript code in the victim's browser, bypass permissions or get information he/she isn't supposed to see. References ========== https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6331 https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6332 https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6333 https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6334 https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6335 https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6336 https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6337 https://lists.wikimedia.org/pipermail/mediawiki-announce/2016-August/000195…

1 0

[arch-security] [ASA-201608-18] libgcrypt: information disclosure
by Remi Gacogne 22 Aug '16

22 Aug '16

Arch Linux Security Advisory ASA-201608-18 ========================================== Severity: Low Date : 2016-08-21 CVE-ID : CVE-2016-6313 Package : libgcrypt Type : information disclosure Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libgcrypt before version 1.7.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.7.3-1. # pacman -Syu "libgcrypt>=1.7.3-1" The problem has been fixed upstream in version 1.7.3. Workaround ========== None. Description =========== Felix Dörre and Vladimir Klebanov from the Karlsruhe Institute of Technology found a bug in the mixing functions of Libgcrypt's random number generator: An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. This bug exists since 1998 in all GnuPG and Libgcrypt versions. Impact ====== A remote attacker, given access to enough entropy previously generated from the RNG, can predict its output. Such access to enough entropy has been found to be very unlikely in most situations, even for a local attacker. References ========== https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html https://access.redhat.com/security/cve/CVE-2016-6313

1 0

[arch-security] [ASA-201608-17] linux-lts: information disclosure
by Remi Gacogne 21 Aug '16

21 Aug '16

Arch Linux Security Advisory ASA-201608-17 ========================================== Severity: High Date : 2016-08-21 CVE-ID : CVE-2016-5696 Package : linux-lts Type : information disclosure Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-lts before version 4.4.19-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.4.19-1. # pacman -Syu "linux-lts>=4.4.19-1" The problem has been fixed upstream in version 4.4.19. Workaround ========== The challenge ACK rate limiting can be entirely disabled by setting net.ipv4.tcp_challenge_ack_limit to a very high value. This can be done by creating a new file in the /etc/sysctl.d/ directory containing the following line: net.ipv4.tcp_challenge_ack_limit = 999999999 then issuing the following command so that the new file is taken into account: # sysctl --system Please be aware that this workaround should be removed as soon as a patched kernel has been installed, as ACK rate limiting is a useful security feature. Description =========== A security issue has been found in the Linux kernel's implementation of challenge ACKs as specified in RFC 5961. An attacker which knows a connection's client IP, server IP and server port can abuse the challenge ACK mechanism to determine the accuracy of a normally 'blind' attack on the client or server. Successful exploitation of this flaw could allow a remote attacker to inject or control a TCP stream contents in a connection between a Linux device and its connected client/server. Impact ====== A remote attacker can detect, control and inject content into a TCP stream. References ========== http://seclists.org/oss-sec/2016/q3/44 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-5696

1 0

[arch-security] [ASA-201608-16] chromium: multiple issues
by Remi Gacogne 17 Aug '16

17 Aug '16

Arch Linux Security Advisory ASA-201608-16 ========================================== Severity: Critical Date : 2016-08-17 CVE-ID : CVE-2016-5139 CVE-2016-5140 CVE-2016-5141 CVE-2016-5142 CVE-2016-5143 CVE-2016-5144 CVE-2016-5145 CVE-2016-5146 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 52.0.2743.116-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 52.0.2743.116-1. # pacman -Syu "chromium>=52.0.2743.116-1" The problems have been fixed upstream in version 52.0.2743.116. Workaround ========== None. Description =========== - CVE-2016-5139 (arbitrary code execution) Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have other unspecified impact via crafted JPEG 2000 data. - CVE-2016-5140 (arbitrary code execution) Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium, allows remote attackers to cause a denial of service or possibly have other unspecified impact via crafted JPEG 2000 data. - CVE-2016-5141 (address bar spoofing) Blink allows remote attackers to spoof the address bar via vectors involving a provisional URL for an initially empty document, related to FrameLoader.cpp and ScopedPageLoadDeferrer.cpp. - CVE-2016-5142 (arbitrary code execution) The Web Cryptography API (aka WebCrypto) implementation in Blink does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have other unspecified impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp. - CVE-2016-5143, CVE-2016-5144 (access restriction bypass) The Developer Tools (aka DevTools) subsystem in Blink mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL. - CVE-2016-5145 (same-origin policy bypass) Blink does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code. - CVE-2016-5146 (arbitrary code execution) Multiple unspecified vulnerabilities allow attackers to cause a denial of service or possibly have other unspecified impact via unknown vectors. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://googlechromereleases.blogspot.fr/2016/08/stable-channel-update-for-… https://access.redhat.com/security/cve/CVE-2016-5139 https://access.redhat.com/security/cve/CVE-2016-5140 https://access.redhat.com/security/cve/CVE-2016-5141 https://access.redhat.com/security/cve/CVE-2016-5142 https://access.redhat.com/security/cve/CVE-2016-5143 https://access.redhat.com/security/cve/CVE-2016-5144 https://access.redhat.com/security/cve/CVE-2016-5145 https://access.redhat.com/security/cve/CVE-2016-5146

1 0

[arch-security] [ASA-201608-15] linux-zen: information disclosure
by Remi Gacogne 17 Aug '16

17 Aug '16

Arch Linux Security Advisory ASA-201608-15 ========================================== Severity: High Date : 2016-08-17 CVE-ID : CVE-2016-5696 Package : linux-zen Type : information disclosure Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-zen before version 4.7-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.7-1. # pacman -Syu "linux-zen>=4.7-1" The problem has been fixed upstream in version 4.7. Workaround ========== The challenge ACK rate limiting can be entirely disabled by setting net.ipv4.tcp_challenge_ack_limit to a very high value. This can be done by creating a new file in the /etc/sysctl.d/ directory containing the following line: net.ipv4.tcp_challenge_ack_limit = 999999999 then issuing the following command so that the new file is taken into account: # sysctl --system Please be aware that this workaround should be removed as soon as a patched kernel has been installed, as ACK rate limiting is a useful security feature. Description =========== A security issue has been found in the Linux kernel's implementation of challenge ACKs as specified in RFC 5961. An attacker which knows a connection's client IP, server IP and server port can abuse the challenge ACK mechanism to determine the accuracy of a normally 'blind' attack on the client or server. Successful exploitation of this flaw could allow a remote attacker to inject or control a TCP stream contents in a connection between a Linux device and its connected client/server. Impact ====== A remote attacker can detect, control and inject content into a TCP stream. References ========== http://seclists.org/oss-sec/2016/q3/44 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-5696

1 0

[arch-security] [ASA-201608-14] postgresql: multiple issues
by Remi Gacogne 14 Aug '16

14 Aug '16

Arch Linux Security Advisory ASA-201608-14 ========================================== Severity: Critical Date : 2016-08-14 CVE-ID : CVE-2016-5423 CVE-2016-5424 Package : postgresql Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package postgresql before version 9.5.4-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 9.5.4-1. # pacman -Syu "postgresql>=9.5.4-1" The problems have been fixed upstream in version 9.5.4. Workaround ========== None. Description =========== - CVE-2016-5423 (arbitrary code execution) It was discovered that certain SQL statements containing CASE/WHEN commands could crash the PostgreSQL server, or disclose a few bytes of server memory, potentially leading to arbitrary code execution. - CVE-2016-5424 (privilege escalation) It was found that PostgreSQL client programs mishandle database and role names containing newlines, carriage returns, double quotes, or backslashes. By crafting such an object name, roles with the CREATEDB or CREATEROLE option could escalate their privileges to superuser when a superuser next executes maintenance with a vulnerable program. Vulnerable programs include pg_dumpall, pg_upgrade, vacuumdb, reindexdb, and clusterdb. Impact ====== A remote authenticated attacker can execute arbitrary code on the affected server by executing a crafted SQL statement. A local authenticated attacker can gain superuser privileges by creating an object with a crafted name. References ========== https://www.postgresql.org/about/news/1688/ https://access.redhat.com/security/cve/CVE-2016-5423 https://access.redhat.com/security/cve/CVE-2016-5424

1 0

[arch-security] [ASA-201608-13] linux-grsec: information disclosure
by Remi Gacogne 14 Aug '16

14 Aug '16

Arch Linux Security Advisory ASA-201608-13 ========================================== Severity: High Date : 2016-08-14 CVE-ID : CVE-2016-5696 Package : linux-grsec Type : information disclosure Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-grsec before version 4.7.201608131240-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.7.201608131240-1. # pacman -Syu "linux-grsec>=4.7.201608131240-1" The problem has been fixed upstream in version 4.7.201608131240. Workaround ========== The challenge ACK rate limiting can be entirely disabled by setting net.ipv4.tcp_challenge_ack_limit to a very high value. This can be done by creating a new file in the /etc/sysctl.d/ directory containing the following line: net.ipv4.tcp_challenge_ack_limit = 999999999 then issuing the following command so that the new file is taken into account: # sysctl --system Please be aware that this workaround should be removed as soon as a patched kernel has been installed, as ACK rate limiting is a useful security feature. Description =========== A security issue has been found in the Linux kernel's implementation of challenge ACKs as specified in RFC 5961. An attacker which knows a connection's client IP, server IP and server port can abuse the challenge ACK mechanism to determine the accuracy of a normally 'blind' attack on the client or server. Successful exploitation of this flaw could allow a remote attacker to inject or control a TCP stream contents in a connection between a Linux device and its connected client/server. Impact ====== A remote attacker can detect, control and inject content into a TCP stream. References ========== http://seclists.org/oss-sec/2016/q3/44 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-5696

1 0