September 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201609-7] tomcat8: proxy injection
by Christian Rebischke 10 Sep '16

10 Sep '16

Arch Linux Security Advisory ASA-201609-7 ========================================= Severity: Medium Date : 2016-09-10 CVE-ID : CVE-2016-5388 Package : tomcat8 Type : proxy injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tomcat8 before version 8.0.37-1 is vulnerable to proxy injection. Resolution ========== Upgrade to 8.0.37-1. # pacman -Syu "tomcat8>=8.0.37-1" The problems have been fixed upstream in version 8.0.37. Workaround ========== None. Description =========== It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. Impact ====== A remote attacker is able to use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. References ========== https://access.redhat.com/security/cve/CVE-2016-5388 https://www.apache.org/security/asf-httpoxy-response.txt

1 0

[arch-security] [ASA-201609-6] graphicsmagick: multiple issues
by Jelle van der Waa 09 Sep '16

09 Sep '16

Arch Linux Security Advisory ASA-201609-6 ========================================= Severity: Critical Date : 2016-09-09 CVE-ID : CVE-2016-2317 Package : graphicsmagick Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package graphicsmagick before version 1.3.25-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 1.3.25-1 # pacman -Syu "graphicsmagick>=1.3.25-1" The problem has been fixed upstream in version 1.3.25. Workaround ========== None. Description =========== 1. A last instance of CVE-2016-2317 (heap buffer overflow) in the MVG rendering code (also impacts SVG). This problem was originally reported by Gustavo Grieco. 2. A possible heap overflow of the EscapeParenthesis() function. While I was not able to reproduce it for myself, the implementation is replaced with a different algorithm. This problem was reported by Gustavo Grieco. 3. The Utah RLE reader did not validate that header information was reasonable given the file size and so it could cause huge memory allocations and/or consume huge amounts of CPU. This problem was reported by Agostino Sarubbo. 4. The TIFF reader had a bug pertaining to use of TIFFGetField() when a 'count' value is returned. The bug caused a heap read overflow (due to using strlcpy() to copy a possibly unterminated string) which could allow an untrusted file to crash the software. Impact ====== An remote attacker is able to create specially crafted files that, when opened or processed, may lead to denial of service or possibly arbitrary code execution. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2317 http://www.openwall.com/lists/oss-security/2016/09/07/4

1 0

[arch-security] [ASA-201609-5] file-roller: multiple issues
by Levente Polyak 09 Sep '16

09 Sep '16

Arch Linux Security Advisory ASA-201609-5 ========================================= Severity: Medium Date : 2016-09-09 CVE-ID : CVE-2016-7162 Package : file-roller Type : directory traversal Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package file-roller before version 3.20.3-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 3.20.3-1. # pacman -Syu "file-roller>=3.20.3-1" The problem has been fixed upstream in version 3.20.3. Workaround ========== None. Description =========== File Roller was affected by a directory traversal bug that could result in deleted files if a user were tricked into opening a malicious archive. Impact ====== An attacker is able to create a specially crafted archive that results in deleted files if a user were tricked into opening it. References ========== https://access.redhat.com/security/cve/CVE-2016-7162 http://ftp.gnome.org/mirror/gnome.org/sources/file-roller/3.20/file-roller-… http://seclists.org/oss-sec/2016/q3/436

1 0

[arch-security] [ASA-201609-4] wordpress: multiple issues
by Jelle van der Waa 09 Sep '16

09 Sep '16

Arch Linux Security Advisory ASA-201609-4 ========================================= Severity: High Date : 2016-09-09 CVE-ID : CVE-2016-7168 CVE-2016-7169 Package : wordpress Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wordpress before version 4.6-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 4.6-1. # pacman -Syu "wordpress>=4.6-1" The problem has been fixed upstream in version 4.6. Workaround ========== None. Description =========== - CVE-2016-7168 (cross-site scripting) A cross-site scripting vulnerability via an image filename, reported by SumOfPwm researcher Cengiz Han Sahin. - CVE-2016-7169 (directory traversal) A directory traversal vulnerability in the upgrade package uploader, reported by Dominik Schilling from the Wordpress security team. Impact ====== A remote attacker can perform a presistent cross-site scripting attack on a WordPress installation or perform directory traversal. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7168 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7169 http://www.openwall.com/lists/oss-security/2016/09/08/19 https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance… https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_vulnerabi…

1 0

[arch-security] [ASA-201609-3] thunderbird: arbitrary code execution
by Remi Gacogne 04 Sep '16

04 Sep '16

Arch Linux Security Advisory ASA-201609-3 ========================================= Severity: Critical Date : 2016-09-04 CVE-ID : CVE-2016-2835 CVE-2016-2836 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.3.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 45.3.0-1. # pacman -Syu "thunderbird>=45.3.0-1" The problems have been fixed upstream in version 45.3.0. Workaround ========== None. Description =========== - CVE-2016-2835 (arbitrary code execution) Carsten Book, Christian Holler, Gary Kwong, Jesse Ruderman, Andrew McCreight, Phil Ringnalda and Philipp reported memory safety problems and crashes. - CVE-2016-2836 (arbitrary code execution) Christian Holler, Tyson Smith, Boris Zbarsky, Byron Campen, and Julian Seward reported memory safety problems and crashes. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/ https://access.redhat.com/security/cve/CVE-2016-2835 https://access.redhat.com/security/cve/CVE-2016-2836

1 0

[arch-security] [ASA-201609-2] webkit2gtk: multiple issues
by Levente Polyak 01 Sep '16

01 Sep '16

Arch Linux Security Advisory ASA-201609-2 ========================================= Severity: Critical Date : 2016-09-01 CVE-ID : CVE-2016-4590 CVE-2016-4591 CVE-2016-4622 CVE-2016-4624 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package webkit2gtk before version 2.12.4-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 2.12.4-1. # pacman -Syu "webkit2gtk>=2.12.4-1" The problems have been fixed upstream in version 2.12.4. Workaround ========== None. Description =========== - CVE-2016-4590 (same-origin policy bypass) xisigr of Tencent’s Xuanwu Lab discovered a vulnerability in the way webkit handles URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. - CVE-2016-4591 (arbitrary filesystem access) ma.la of LINE Corporation discoveered a vulnerability in the way webkit handles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors. - CVE-2016-4622 (arbitrary code execution) Samuel Gross working with Trend Micro’s Zero Day Initiative discovered a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. - CVE-2016-4624 (arbitrary code execution) Apple found a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Impact ====== A remote attacker can execute arbitrary code, gain arbitrary filesystem access, crash a target system or bypass same-origin policies on the affected host. References ========== https://webkitgtk.org/security/WSA-2016-0005.html#CVE-2016-4591 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4590 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4591 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4622 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4624

1 0

[arch-security] [ASA-201609-1] chromium: multiple issues
by Levente Polyak 01 Sep '16

01 Sep '16

Arch Linux Security Advisory ASA-201609-1 ========================================= Severity: Critical Date : 2016-09-01 CVE-ID : CVE-2016-5147 CVE-2016-5148 CVE-2016-5149 CVE-2016-5150 CVE-2016-5151 CVE-2016-5152 CVE-2016-5153 CVE-2016-5154 CVE-2016-5155 CVE-2016-5156 CVE-2016-5157 CVE-2016-5158 CVE-2016-5159 CVE-2016-5160 CVE-2016-5161 CVE-2016-5162 CVE-2016-5163 CVE-2016-5164 CVE-2016-5165 CVE-2016-5166 CVE-2016-5167 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 53.0.2785.89-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 53.0.2785.89-1. # pacman -Syu "chromium>=53.0.2785.89-1" The problems have been fixed upstream in version 53.0.2785.89. Workaround ========== None. Description =========== - CVE-2016-5147 CVE-2016-5148 (cross-site scripting) Universal XSS in Blink. - CVE-2016-5149 (script injection) Script injection in extensions. - CVE-2016-5150 (arbitrary code execution) Use after free in Blink. - CVE-2016-5151 (arbitrary code execution) Use after free in PDFium. - CVE-2016-5152 CVE-2016-5154 CVE-2016-5157 CVE-2016-5158 CVE-2016-5159 (arbitrary code execution) Heap overflow in PDFium. - CVE-2016-5153 (arbitrary code execution) Use after destruction in Blink. - CVE-2016-5155 CVE-2016-5163 (address bar spoofing) Address bar spoofing. - CVE-2016-5156 (arbitrary code execution) Use after free in event bindings. - CVE-2016-5160 CVE-2016-5162 (access restriction bypass) Extensions web accessible resources bypass. - CVE-2016-5161 (arbitrary code execution) Type confusion in Blink. - CVE-2016-5164 (address bar spoofing) Universal XSS using DevTools. - CVE-2016-5165 (script injection) Script injection in DevTools. - CVE-2016-5166 (smb relay attack) SMB Relay Attack via Save Page As. - CVE-2016-5167 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker is able to execute arbitrary code on the affected host, perform cross-site scripting attacks, spoof the address bar, bypass access restrictions or have other unspecified impact. References ========== https://googlechromereleases.blogspot.fr/2016/08/stable-channel-update-for- desktop_31.html https://access.redhat.com/security/cve/CVE-2016-5147 https://access.redhat.com/security/cve/CVE-2016-5148 https://access.redhat.com/security/cve/CVE-2016-5149 https://access.redhat.com/security/cve/CVE-2016-5150 https://access.redhat.com/security/cve/CVE-2016-5151 https://access.redhat.com/security/cve/CVE-2016-5152 https://access.redhat.com/security/cve/CVE-2016-5153 https://access.redhat.com/security/cve/CVE-2016-5154 https://access.redhat.com/security/cve/CVE-2016-5155 https://access.redhat.com/security/cve/CVE-2016-5156 https://access.redhat.com/security/cve/CVE-2016-5157 https://access.redhat.com/security/cve/CVE-2016-5158 https://access.redhat.com/security/cve/CVE-2016-5159 https://access.redhat.com/security/cve/CVE-2016-5160 https://access.redhat.com/security/cve/CVE-2016-5161 https://access.redhat.com/security/cve/CVE-2016-5162 https://access.redhat.com/security/cve/CVE-2016-5163 https://access.redhat.com/security/cve/CVE-2016-5164 https://access.redhat.com/security/cve/CVE-2016-5165 https://access.redhat.com/security/cve/CVE-2016-5166 https://access.redhat.com/security/cve/CVE-2016-5167

1 0