September 2016 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201609-12] lib32-flashplugin: multiple issues
by Levente Polyak 15 Sep '16

15 Sep '16

Arch Linux Security Advisory ASA-201609-12 ========================================== Severity: Critical Date : 2016-09-15 CVE-ID : CVE-2016-4271 CVE-2016-4272 CVE-2016-4274 CVE-2016-4275 CVE-2016-4276 CVE-2016-4277 CVE-2016-4278 CVE-2016-4279 CVE-2016-4280 CVE-2016-4281 CVE-2016-4282 CVE-2016-4283 CVE-2016-4284 CVE-2016-4285 CVE-2016-4287 CVE-2016-6921 CVE-2016-6922 CVE-2016-6923 CVE-2016-6924 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 CVE-2016-6932 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.635-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 11.2.202.635-1. # pacman -Syu "lib32-flashplugin>=11.2.202.635-1" The problems have been fixed upstream in version 11.2.202.635. Workaround ========== None. Description =========== - CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924 (arbitrary code execution) Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero, willJ of Tencent PC Manager, Yuki Chen of Qihoo 360 Vulcan Team, b0nd@garage4hackers working with Trend Micro's Zero Day Initiative, and Tao Yan (@Ga1ois) of Palo Alto Networks - CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932 (arbitrary code execution) Multiple use-after-free vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities have been discovered by, Mumei working with Trend Micro's Zero Day Initiative, Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program, willJ of Tencent PC Manager, JieZeng of Tencent Zhanlu Lab working with the Chromium Vulnerability Rewards Program, Nicolas Joly of Microsoft Vulnerability Research, and Yuki Chen of Qihoo 360 Vulcan Team - CVE-2016-4287 (arbitrary code execution) An integer overflow vulnerability that could lead to arbitrary code execution has been found. This vulnerability has been discovered by Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program. - CVE-2016-4271, CVE-2016-4277, CVE-2016-4278 (information disclosure) A Security bypass vulnerablity that could lead to information disclosure has been found. These vulnerabilities have been found by Leone Pontorieri, Soroush Dalili and Matthew Evans from NCC Group, and Nicolas Joly of Microsoft Vulnerability Research Impact ====== A remote attacker can execute arbitrary code, bypass security checks, or disclose information on the affected host via unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-29.html https://access.redhat.com/security/cve/CVE-2016-4271 https://access.redhat.com/security/cve/CVE-2016-4272 https://access.redhat.com/security/cve/CVE-2016-4274 https://access.redhat.com/security/cve/CVE-2016-4275 https://access.redhat.com/security/cve/CVE-2016-4276 https://access.redhat.com/security/cve/CVE-2016-4277 https://access.redhat.com/security/cve/CVE-2016-4278 https://access.redhat.com/security/cve/CVE-2016-4279 https://access.redhat.com/security/cve/CVE-2016-4280 https://access.redhat.com/security/cve/CVE-2016-4281 https://access.redhat.com/security/cve/CVE-2016-4282 https://access.redhat.com/security/cve/CVE-2016-4283 https://access.redhat.com/security/cve/CVE-2016-4284 https://access.redhat.com/security/cve/CVE-2016-4285 https://access.redhat.com/security/cve/CVE-2016-4287 https://access.redhat.com/security/cve/CVE-2016-6921 https://access.redhat.com/security/cve/CVE-2016-6922 https://access.redhat.com/security/cve/CVE-2016-6923 https://access.redhat.com/security/cve/CVE-2016-6924 https://access.redhat.com/security/cve/CVE-2016-6925 https://access.redhat.com/security/cve/CVE-2016-6926 https://access.redhat.com/security/cve/CVE-2016-6927 https://access.redhat.com/security/cve/CVE-2016-6929 https://access.redhat.com/security/cve/CVE-2016-6930 https://access.redhat.com/security/cve/CVE-2016-6931 https://access.redhat.com/security/cve/CVE-2016-6932

1 0

[arch-security] [ASA-201609-11] flashplugin: multiple issues
by Levente Polyak 15 Sep '16

15 Sep '16

Arch Linux Security Advisory ASA-201609-11 ========================================== Severity: Critical Date : 2016-09-15 CVE-ID : CVE-2016-4271 CVE-2016-4272 CVE-2016-4274 CVE-2016-4275 CVE-2016-4276 CVE-2016-4277 CVE-2016-4278 CVE-2016-4279 CVE-2016-4280 CVE-2016-4281 CVE-2016-4282 CVE-2016-4283 CVE-2016-4284 CVE-2016-4285 CVE-2016-4287 CVE-2016-6921 CVE-2016-6922 CVE-2016-6923 CVE-2016-6924 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 CVE-2016-6932 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.635-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 11.2.202.635-1. # pacman -Syu "flashplugin>=11.2.202.635-1" The problems have been fixed upstream in version 11.2.202.635. Workaround ========== None. Description =========== - CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924 (arbitrary code execution) Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero, willJ of Tencent PC Manager, Yuki Chen of Qihoo 360 Vulcan Team, b0nd@garage4hackers working with Trend Micro's Zero Day Initiative, and Tao Yan (@Ga1ois) of Palo Alto Networks - CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932 (arbitrary code execution) Multiple use-after-free vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities have been discovered by, Mumei working with Trend Micro's Zero Day Initiative, Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program, willJ of Tencent PC Manager, JieZeng of Tencent Zhanlu Lab working with the Chromium Vulnerability Rewards Program, Nicolas Joly of Microsoft Vulnerability Research, and Yuki Chen of Qihoo 360 Vulcan Team - CVE-2016-4287 (arbitrary code execution) An integer overflow vulnerability that could lead to arbitrary code execution has been found. This vulnerability has been discovered by Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program. - CVE-2016-4271, CVE-2016-4277, CVE-2016-4278 (information disclosure) A Security bypass vulnerablity that could lead to information disclosure has been found. These vulnerabilities have been found by Leone Pontorieri, Soroush Dalili and Matthew Evans from NCC Group, and Nicolas Joly of Microsoft Vulnerability Research Impact ====== A remote attacker can execute arbitrary code, bypass security checks, or disclose information on the affected host via unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-29.html https://access.redhat.com/security/cve/CVE-2016-4271 https://access.redhat.com/security/cve/CVE-2016-4272 https://access.redhat.com/security/cve/CVE-2016-4274 https://access.redhat.com/security/cve/CVE-2016-4275 https://access.redhat.com/security/cve/CVE-2016-4276 https://access.redhat.com/security/cve/CVE-2016-4277 https://access.redhat.com/security/cve/CVE-2016-4278 https://access.redhat.com/security/cve/CVE-2016-4279 https://access.redhat.com/security/cve/CVE-2016-4280 https://access.redhat.com/security/cve/CVE-2016-4281 https://access.redhat.com/security/cve/CVE-2016-4282 https://access.redhat.com/security/cve/CVE-2016-4283 https://access.redhat.com/security/cve/CVE-2016-4284 https://access.redhat.com/security/cve/CVE-2016-4285 https://access.redhat.com/security/cve/CVE-2016-4287 https://access.redhat.com/security/cve/CVE-2016-6921 https://access.redhat.com/security/cve/CVE-2016-6922 https://access.redhat.com/security/cve/CVE-2016-6923 https://access.redhat.com/security/cve/CVE-2016-6924 https://access.redhat.com/security/cve/CVE-2016-6925 https://access.redhat.com/security/cve/CVE-2016-6926 https://access.redhat.com/security/cve/CVE-2016-6927 https://access.redhat.com/security/cve/CVE-2016-6929 https://access.redhat.com/security/cve/CVE-2016-6930 https://access.redhat.com/security/cve/CVE-2016-6931 https://access.redhat.com/security/cve/CVE-2016-6932

1 0

[arch-security] [ASA-201609-10] mariadb: multiple issues
by Christian Rebischke 14 Sep '16

14 Sep '16

Arch Linux Security Advisory ASA-201609-10 ========================================== Severity: Critical Date : 2016-09-14 CVE-ID : CVE-2016-6662 CVE-2016-6663 Package : mariadb Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mariadb before version 10.1.17-1 is vulnerable to multiple issues including arbitrary code execution and access restriction bypass. Resolution ========== Upgrade to 10.1.17-1. # pacman -Syu "mariadb>=10.1.17-1" The problems have been fixed upstream in version 10.1.17. Workaround ========== None. Description =========== - CVE-2016-6662 (arbitrary code execution) Researcher Dawid Golunski discovered several security issues in the mariadb DBMS, including a vulnerability flaw that can be exploited by a remote attacker to inject malicious settings into my.cnf configuration files. The flaw can be triggered to fully compromise the DBMS by executing arbitrary code with root privileges if mysqld_safe is executed. - CVE-2016-6663 (access restriction bypass) In the past mariadb used to read the main configuration file from three different locations. One of them (the datadir) is unsafe because it's writeable by the sql-server. This way a remote attacker who could gain access to the sql-server could deploy a maliciously crafted configuration file. Impact ====== A remote attacker is able to inject malicious configuration into existing configuration files, create new configuration files, gain access to logging functions and execute arbitrary code with root privileges if mysqld_safe is executed. References ========== https://access.redhat.com/security/cve/CVE-2016-6662 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-6663 https://jira.mariadb.org/browse/MDEV-10465 http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution…

1 0

[arch-security] [ASA-201609-9] powerdns: denial of service
by Remi Gacogne 13 Sep '16

13 Sep '16

Arch Linux Security Advisory ASA-201609-9 ========================================= Severity: Medium Date : 2016-09-13 CVE-ID : CVE-2016-5426 CVE-2016-5427 Package : powerdns Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package powerdns before version 4.0.1-3 is vulnerable to denial of service. Resolution ========== Upgrade to 4.0.1-3. # pacman -Syu "powerdns>=4.0.1-3" The problems have been fixed upstream in version 4.0.0. Workaround ========== Running dnsdist in front of potentially affected servers prevents CVE-2016-5426, and can prevent CVE-2016-5427 with the use of custom rules described in the PowerDNS advisory. Description =========== Two issues have been found in PowerDNS Authoritative Server allowing a remote, unauthenticated attacker to cause an abnormal load on the PowerDNS backend by sending crafted DNS queries, which might result in a partial denial of service if the backend becomes overloaded. SQL backends for example are particularly vulnerable to this kind of unexpected load if they have not been dimensioned for it. - CVE-2016-5426 PowerDNS Authoritative Server accepts queries with a qname's length larger than 255 bytes. - CVE-2016-5427 PowerDNS Authoritative Server does not properly handle dot inside labels. Impact ====== A remote, unauthenticated attacker can cause an abnormal load on the backend by sending crafted DNS queries, resulting in denial of service. References ========== http://seclists.org/oss-sec/2016/q3/464 https://doc.powerdns.com/md/security/powerdns-advisory-2016-01/ https://access.redhat.com/security/cve/CVE-2016-5426 https://access.redhat.com/security/cve/CVE-2016-5427

1 0

[arch-security] [ASA-201609-8] libtorrent-rasterbar: denial of service
by Remi Gacogne 13 Sep '16

13 Sep '16

Arch Linux Security Advisory ASA-201609-8 ========================================= Severity: Low Date : 2016-09-13 CVE-ID : CVE-2016-7164 Package : libtorrent-rasterbar Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libtorrent-rasterbar before version 1:1.1.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1:1.1.1-1. # pacman -Syu "libtorrent-rasterbar>=1:1.1.1-1" The problem has been fixed upstream in version 1.1.1. Workaround ========== None. Description =========== A bug has been found in the libtorrent-rasterbar code handling GZIP-encoded responses from a tracker, where malformed responses could lead to a crash. Impact ====== A remote attacker can crash a client using libtorrent-rasterbar by sending malformed GZIP-encoded responses from a tracker. References ========== http://seclists.org/oss-sec/2016/q3/443 https://access.redhat.com/security/cve/CVE-2016-7164

1 0

[arch-security] [ASA-201609-7] tomcat8: proxy injection
by Christian Rebischke 10 Sep '16

10 Sep '16

Arch Linux Security Advisory ASA-201609-7 ========================================= Severity: Medium Date : 2016-09-10 CVE-ID : CVE-2016-5388 Package : tomcat8 Type : proxy injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tomcat8 before version 8.0.37-1 is vulnerable to proxy injection. Resolution ========== Upgrade to 8.0.37-1. # pacman -Syu "tomcat8>=8.0.37-1" The problems have been fixed upstream in version 8.0.37. Workaround ========== None. Description =========== It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. Impact ====== A remote attacker is able to use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. References ========== https://access.redhat.com/security/cve/CVE-2016-5388 https://www.apache.org/security/asf-httpoxy-response.txt

1 0

[arch-security] [ASA-201609-6] graphicsmagick: multiple issues
by Jelle van der Waa 09 Sep '16

09 Sep '16

Arch Linux Security Advisory ASA-201609-6 ========================================= Severity: Critical Date : 2016-09-09 CVE-ID : CVE-2016-2317 Package : graphicsmagick Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package graphicsmagick before version 1.3.25-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 1.3.25-1 # pacman -Syu "graphicsmagick>=1.3.25-1" The problem has been fixed upstream in version 1.3.25. Workaround ========== None. Description =========== 1. A last instance of CVE-2016-2317 (heap buffer overflow) in the MVG rendering code (also impacts SVG). This problem was originally reported by Gustavo Grieco. 2. A possible heap overflow of the EscapeParenthesis() function. While I was not able to reproduce it for myself, the implementation is replaced with a different algorithm. This problem was reported by Gustavo Grieco. 3. The Utah RLE reader did not validate that header information was reasonable given the file size and so it could cause huge memory allocations and/or consume huge amounts of CPU. This problem was reported by Agostino Sarubbo. 4. The TIFF reader had a bug pertaining to use of TIFFGetField() when a 'count' value is returned. The bug caused a heap read overflow (due to using strlcpy() to copy a possibly unterminated string) which could allow an untrusted file to crash the software. Impact ====== An remote attacker is able to create specially crafted files that, when opened or processed, may lead to denial of service or possibly arbitrary code execution. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2317 http://www.openwall.com/lists/oss-security/2016/09/07/4

1 0

[arch-security] [ASA-201609-5] file-roller: multiple issues
by Levente Polyak 09 Sep '16

09 Sep '16

Arch Linux Security Advisory ASA-201609-5 ========================================= Severity: Medium Date : 2016-09-09 CVE-ID : CVE-2016-7162 Package : file-roller Type : directory traversal Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package file-roller before version 3.20.3-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 3.20.3-1. # pacman -Syu "file-roller>=3.20.3-1" The problem has been fixed upstream in version 3.20.3. Workaround ========== None. Description =========== File Roller was affected by a directory traversal bug that could result in deleted files if a user were tricked into opening a malicious archive. Impact ====== An attacker is able to create a specially crafted archive that results in deleted files if a user were tricked into opening it. References ========== https://access.redhat.com/security/cve/CVE-2016-7162 http://ftp.gnome.org/mirror/gnome.org/sources/file-roller/3.20/file-roller-… http://seclists.org/oss-sec/2016/q3/436

1 0

[arch-security] [ASA-201609-4] wordpress: multiple issues
by Jelle van der Waa 09 Sep '16

09 Sep '16

Arch Linux Security Advisory ASA-201609-4 ========================================= Severity: High Date : 2016-09-09 CVE-ID : CVE-2016-7168 CVE-2016-7169 Package : wordpress Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wordpress before version 4.6-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 4.6-1. # pacman -Syu "wordpress>=4.6-1" The problem has been fixed upstream in version 4.6. Workaround ========== None. Description =========== - CVE-2016-7168 (cross-site scripting) A cross-site scripting vulnerability via an image filename, reported by SumOfPwm researcher Cengiz Han Sahin. - CVE-2016-7169 (directory traversal) A directory traversal vulnerability in the upgrade package uploader, reported by Dominik Schilling from the Wordpress security team. Impact ====== A remote attacker can perform a presistent cross-site scripting attack on a WordPress installation or perform directory traversal. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7168 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7169 http://www.openwall.com/lists/oss-security/2016/09/08/19 https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance… https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_vulnerabi…

1 0

[arch-security] [ASA-201609-3] thunderbird: arbitrary code execution
by Remi Gacogne 04 Sep '16

04 Sep '16

Arch Linux Security Advisory ASA-201609-3 ========================================= Severity: Critical Date : 2016-09-04 CVE-ID : CVE-2016-2835 CVE-2016-2836 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.3.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 45.3.0-1. # pacman -Syu "thunderbird>=45.3.0-1" The problems have been fixed upstream in version 45.3.0. Workaround ========== None. Description =========== - CVE-2016-2835 (arbitrary code execution) Carsten Book, Christian Holler, Gary Kwong, Jesse Ruderman, Andrew McCreight, Phil Ringnalda and Philipp reported memory safety problems and crashes. - CVE-2016-2836 (arbitrary code execution) Christian Holler, Tyson Smith, Boris Zbarsky, Byron Campen, and Julian Seward reported memory safety problems and crashes. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-62/ https://access.redhat.com/security/cve/CVE-2016-2835 https://access.redhat.com/security/cve/CVE-2016-2836

1 0