September 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201609-22] firefox: multiple issues
by Levente Polyak 22 Sep '16

22 Sep '16

Arch Linux Security Advisory ASA-201609-22 ========================================== Severity: Critical Date : 2016-09-22 CVE-ID : CVE-2016-5256 CVE-2016-5257 CVE-2016-5270 CVE-2016-5271 CVE-2016-5272 CVE-2016-5273 CVE-2016-5274 CVE-2016-5275 CVE-2016-5276 CVE-2016-5277 CVE-2016-5278 CVE-2016-5279 CVE-2016-5280 CVE-2016-5281 CVE-2016-5282 CVE-2016-5283 CVE-2016-5284 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 49.0-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, information disclosure and certificate verification bypass. Resolution ========== Upgrade to 49.0-1. # pacman -Syu "firefox>=49.0-1" The problems have been fixed upstream in version 49.0. Workaround ========== None. Description =========== - CVE-2016-5256 (arbitrary code execution) Mozilla developers Christoph Diehl, Christian Holler, Gary Kwong, Nathan Froyd, Honza Bambas, Seth Fowler, and Michael Smith reported memory safety bugs present in Firefox 48. Some of these bugs showed evidence of memory corruption under certain circumstances could potentially exploited to run arbitrary code. - CVE-2016-5257 (arbitrary code execution) Mozilla developers and community members Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, and Carsten Book reported memory safety bugs present in Firefox 48 and Firefox ESR 45.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-5270 (arbitrary code execution) An out-of-bounds write of a boolean value during text conversion with some unicode characters. - CVE-2016-5271 (information disclosure) An out-of-bounds read during the processing of text runs in some pages using display:contents. - CVE-2016-5272 (arbitrary code execution) A bad cast when processing layout with input elements can result in a potentially exploitable crash. - CVE-2016-5273 (arbitrary code execution) A potentially exploitable crash in accessibility in the mozilla::a11y::HyperTextAccessible::GetChildOffset function. - CVE-2016-5274 (arbitrary code execution) A use-after-free vulnerability has been discovered in the nsFrameManager::CaptureFrameState function in web animations during restyling. - CVE-2016-5275 (arbitrary code execution) A buffer overflow vulnerability has been discovered in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function when working with empty filters during canvas rendering. - CVE-2016-5276 (arbitrary code execution) A use-after-free vulnerability has been discovered in the mozilla::a11y::DocAccessible::ProcessInvalidationList function triggered by setting a aria-owns attribute. - CVE-2016-5277 (arbitrary code execution) A user-after-free vulnerability has been disconvered in the nsRefreshDriver::Tick function with web animations when destroying a timeline. - CVE-2016-5278 (arbitrary code execution) A potentially exploitable crash caused by a heap based buffer overflow has been discovered in the nsBMPEncoder::AddImageFrame function while encoding image frames to images. - CVE-2016-5279 (information disclosure) The full path to local files is available to scripts when local files are drag and dropped into Firefox. - CVE-2016-5280 (arbitrary code execution) A use-after-free vulnerability has been discovered in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function when changing text direction. - CVE-2016-5281 (arbitrary code execution) A use-after-free vulnerability has been discovered in the DOMSVGLength when manipulating SVG format content through a script. - CVE-2016-5282 (access restriction bypass) Favicons can be loaded through non-whitelisted protocols, such as jar. - CVE-2016-5283 (information disclosure) A timing attack vulnerability was discovered using iframes to potentially reveal private cross-origin data using document resizes and link colors. - CVE-2016-5284 (certificate verification bypass) Due to flaws in the process used to update "Preloaded Public Key Pinning", the pinning for add-on updates became ineffective in early September. An attacker who was able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not affected. Impact ====== A remote attacker is able to execute arbitrary code, disclose sensitive information and bypass certificate verification via various vectors. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/ https://access.redhat.com/security/cve/CVE-2016-5256 https://access.redhat.com/security/cve/CVE-2016-5257 https://access.redhat.com/security/cve/CVE-2016-5270 https://access.redhat.com/security/cve/CVE-2016-5271 https://access.redhat.com/security/cve/CVE-2016-5272 https://access.redhat.com/security/cve/CVE-2016-5273 https://access.redhat.com/security/cve/CVE-2016-5274 https://access.redhat.com/security/cve/CVE-2016-5275 https://access.redhat.com/security/cve/CVE-2016-5276 https://access.redhat.com/security/cve/CVE-2016-5277 https://access.redhat.com/security/cve/CVE-2016-5278 https://access.redhat.com/security/cve/CVE-2016-5279 https://access.redhat.com/security/cve/CVE-2016-5280 https://access.redhat.com/security/cve/CVE-2016-5281 https://access.redhat.com/security/cve/CVE-2016-5282 https://access.redhat.com/security/cve/CVE-2016-5283 https://access.redhat.com/security/cve/CVE-2016-5284

1 0

[arch-security] [ASA-201609-21] tomcat7: proxy injection
by Levente Polyak 22 Sep '16

22 Sep '16

Arch Linux Security Advisory ASA-201609-21 ========================================== Severity: Medium Date : 2016-09-22 CVE-ID : CVE-2016-5388 Package : tomcat7 Type : proxy injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tomcat7 before version 7.0.72-1 is vulnerable to proxy injection. Resolution ========== Upgrade to 7.0.72-1. # pacman -Syu "tomcat7>=7.0.72-1" The problems have been fixed upstream in version 7.0.72. Workaround ========== None. Description =========== It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. Impact ====== A remote attacker is able to use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. References ========== https://access.redhat.com/security/cve/CVE-2016-5388 https://www.apache.org/security/asf-httpoxy-response.txt

1 0

[arch-security] [ASA-201609-20] irssi: arbitrary code execution
by Jelle van der Waa 22 Sep '16

22 Sep '16

Arch Linux Security Advisory ASA-201609-20 ========================================== Severity: High Date : 2016-09-22 CVE-ID : CVE-2016-7045 Package : irssi Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package irssi before version 0.8.20-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.8.20-1. # pacman -Syu "irssi>=0.8.20-1" The problem has been fixed upstream in version 0.8.20. Workaround ========== None. Description =========== The format_send_to_gui() function does not validate the length of the string before incrementing the `ptr' pointer in all cases. If that happens, the pointer `ptr' can be incremented twice and thus end past the boundaries of the original `dup' buffer. Remote code execution might be difficult since only Nuls are written. Impact ====== A remote attacker can perform a denial of service attack or possibly execute arbitrary code on the affected host. References ========== https://irssi.org/security/irssi_sa_2016.txt http://www.openwall.com/lists/oss-security/2016/09/21/11 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7045

1 0

[arch-security] [ASA-201609-19] curl: denial of service
by Jelle van der Waa 20 Sep '16

20 Sep '16

Arch Linux Security Advisory ASA-201609-19 ========================================== Severity: Low Date : 20916-09-20 CVE-ID : CVE-2016-7167 Package : curl Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.50.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 7.50.3-1. # pacman -Syu "curl>=7.50.3-1" The problem has been fixed upstream in version 7.50.3. Workaround ========== None. Description =========== The four libcurl functions `curl_escape()`, `curl_easy_escape()`, `curl_unescape` and `curl_easy_unescape` perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments. (The functions having names without "easy" being the deprecated versions of the others.) The provided string length arguments were not properly checked and due to arithmetic in the functions, passing in the length 0xffffffff (2^32-1 or `UINT_MAX` or even just -1) would end up causing an allocation of zero bytes of heap memory that curl would attempt to write gigabytes of data into. The use of 'int' for this input type in the API is of course unwise but has remained so in order to maintain the API over the years. We are not aware of any exploit of this flaw. Impact ====== A remote attacker might cause a crash by providing a specially crafted URL, leading to a denial of service. References ========== http://www.openwall.com/lists/oss-security/2016/09/14/1 https://curl.haxx.se/docs/adv_20160914.html https://access.redhat.com/security/cve/CVE-2016-7167

1 0

[arch-security] [ASA-201609-18] lib32-curl: denial of service
by Jelle van der Waa 20 Sep '16

20 Sep '16

Arch Linux Security Advisory ASA-201609-18 ========================================== Severity: Low Date : 20916-09-20 CVE-ID : CVE-2016-7167 Package : lib32-curl Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-curl before version 7.50.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 7.50.3-1. # pacman -Syu "lib32-curl>=7.50.3-1" The problem has been fixed upstream in version 7.50.3. Workaround ========== None. Description =========== The four libcurl functions `curl_escape()`, `curl_easy_escape()`, `curl_unescape` and `curl_easy_unescape` perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments. (The functions having names without "easy" being the deprecated versions of the others.) The provided string length arguments were not properly checked and due to arithmetic in the functions, passing in the length 0xffffffff (2^32-1 or `UINT_MAX` or even just -1) would end up causing an allocation of zero bytes of heap memory that curl would attempt to write gigabytes of data into. The use of 'int' for this input type in the API is of course unwise but has remained so in order to maintain the API over the years. We are not aware of any exploit of this flaw. Impact ====== A remote attacker might cause a crash by providing a specially crafted URL, leading to a denial of service. References ========== http://www.openwall.com/lists/oss-security/2016/09/14/1 https://curl.haxx.se/docs/adv_20160914.html https://access.redhat.com/security/cve/CVE-2016-7167

1 0

[arch-security] [ASA-201609-17] lib32-jansson: denial of service
by Levente Polyak 20 Sep '16

20 Sep '16

Arch Linux Security Advisory ASA-201609-17 ========================================== Severity: Medium Date : 2016-09-20 CVE-ID : CVE-2016-4425 Package : lib32-jansson Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-jansson before version 2.8-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.8-1. # pacman -Syu "lib32-jansson>=2.8-1" The problem has been fixed upstream in version 2.8. Workaround ========== None. Description =========== A stack-exhaustion vulnerability has been found in jansson, causing a crash while parsing a crafted JSON document. Impact ====== A remote attacker might cause a crash by submitting a specially crafted JSON file to an application using jansson, leading to denial of service. References ========== http://marc.info/?l=oss-security&m=146219323703639&w=2 https://github.com/akheron/jansson/issues/282 https://access.redhat.com/security/cve/CVE-2016-4425

1 0

[arch-security] [ASA-201609-16] php: multiple issues
by Levente Polyak 18 Sep '16

18 Sep '16

Arch Linux Security Advisory ASA-201609-16 ========================================== Severity: Critical Date : 2016-09-18 CVE-ID : CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 Package : php Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package php before version 7.0.11-1 is vulnerable to multiple issues that can lead to arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.0.11-1. # pacman -Syu "php>=7.0.11-1" The problems have been fixed upstream in version 7.0.11. Workaround ========== None. Description =========== - CVE-2016-7411 (arbitrary code execution) A memory Corruption vulnerability was found in php's unserialize method. This happened during the deserialized-object Destruction. - CVE-2016-7412 (arbitrary code execution) Php's mysqlnd extension assumes the `flags` returned for a BIT field necessarily contains UNSIGNED_FLAG; this might not be the case, with a rogue mysql server, or a MITM attack. A malicious mysql server or MITM can return field metadata for BIT fields that does not contain the UNSIGNED_FLAG, which leads to a heap overflow. - CVE-2016-7413 (arbitrary code execution) When WDDX tries to deserialize "recordset" element, use after free happens if close tag for the field is not found. This happens only when field names are set. - CVE-2016-7414 (arbitrary code execution) The entry.uncompressed_filesize* method does not properly verify the input parameters. An attacker can create a signature.bin with size less than 8, when this value is passed to phar_verify_signature as sig_len a heap buffer overflow occurs. - CVE-2016-7416 (arbitrary code execution) Big locale string causes stack based overflow inside libicu. - CVE-2016-7417 (insufficient validation) The return value of spl_array_get_hash_table is not properly checked and used on spl_array_get_dimension_ptr_ptr. - CVE-2016-7418 (denial of service) An attacker can trigger an Out-Of-Bounds Read in php_wddx_push_element of wddx.c. A DoS (null pointer dereference) vulnerability can be triggered in the wddx_deserialize function by providing a maliciously crafted XML string. Impact ====== A remote attacker can execute arbitrary code or cause a denial of service on the affected host through different attack vectors. References ========== http://www.openwall.com/lists/oss-security/2016/09/15/10 https://bugs.php.net/bug.php?id=73052 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7411 https://bugs.php.net/bug.php?id=72293 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7412 https://bugs.php.net/bug.php?id=72860 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7413 https://bugs.php.net/bug.php?id=72928 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7414 https://bugs.php.net/bug.php?id=73007 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7416 https://bugs.php.net/bug.php?id=73029 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7417 https://bugs.php.net/bug.php?id=73065 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7418

1 0

[arch-security] [ASA-201609-15] jansson: denial of service
by Remi Gacogne 17 Sep '16

17 Sep '16

Arch Linux Security Advisory ASA-201609-15 ========================================== Severity: Low Date : 2016-09-17 CVE-ID : CVE-2016-4425 Package : jansson Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jansson before version 2.8-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.8-1. # pacman -Syu "jansson>=2.8-1" The problem has been fixed upstream in version 2.8. Workaround ========== None. Description =========== A stack-exhaustion vulnerability has been found in jansson, causing a crash while parsing a crafted JSON document. Impact ====== A remote attacker might cause a crash by submitting a specially crafted JSON file to an application using jansson, leading to denial of service. References ========== http://marc.info/?l=oss-security&m=146219323703639&w=2 https://github.com/akheron/jansson/issues/282 https://access.redhat.com/security/cve/CVE-2016-4425

1 0

[arch-security] [ASA-201609-14] lib32-libgcrypt: information disclosure
by Remi Gacogne 17 Sep '16

17 Sep '16

Arch Linux Security Advisory ASA-201609-14 ========================================== Severity: Low Date : 2016-09-17 CVE-ID : CVE-2016-6313 Package : lib32-libgcrypt Type : information disclosure Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-libgcrypt before version 1.7.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.7.3-1. # pacman -Syu "lib32-libgcrypt>=1.7.3-1" The problem has been fixed upstream in version 1.7.3. Workaround ========== None. Description =========== Felix Dörre and Vladimir Klebanov from the Karlsruhe Institute of Technology found a bug in the mixing functions of Libgcrypt's random number generator: An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. This bug exists since 1998 in all GnuPG and Libgcrypt versions. Impact ====== A remote attacker, given access to enough entropy previously generated from the RNG, can predict its output. Such access to enough entropy has been found to be very unlikely in most situations, even for a local attacker. References ========== https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html https://access.redhat.com/security/cve/CVE-2016-6313

1 0

[arch-security] [ASA-201609-13] chromium: multiple issues
by Remi Gacogne 17 Sep '16

17 Sep '16

Arch Linux Security Advisory ASA-201609-13 ========================================== Severity: Critical Date : 2016-09-17 CVE-ID : CVE-2016-5170 CVE-2016-5171 CVE-2016-5172 CVE-2016-5173 CVE-2016-5174 CVE-2016-5175 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 53.0.2785.116-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 53.0.2785.116-1. # pacman -Syu "chromium>=53.0.2785.116-1" The problems have been fixed upstream in version 53.0.2785.116. Workaround ========== None. Description =========== - CVE-2016-5170, CVE-2016-5171 (arbitrary code execution) Use after free in Blink. - CVE-2016-5172 (information leakage) Arbitrary Memory Read in v8. - CVE-2016-5173 (access restriction bypass) Extension resource access. - CVE-2016-5174 Popup not correctly suppressed. - CVE-2016-5175 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can execute arbitrary code on the affected host, access sensitive information, bypass access restrictions or have other unspecified impact. References ========== https://googlechromereleases.blogspot.fr/2016/09/stable-channel-update-for-… https://access.redhat.com/security/cve/CVE-2016-5170 https://access.redhat.com/security/cve/CVE-2016-5171 https://access.redhat.com/security/cve/CVE-2016-5172 https://access.redhat.com/security/cve/CVE-2016-5173 https://access.redhat.com/security/cve/CVE-2016-5174 https://access.redhat.com/security/cve/CVE-2016-5175

1 0