January 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201701-20] libvncserver: arbitrary code execution
by Levente Polyak 13 Jan '17

13 Jan '17

Arch Linux Security Advisory ASA-201701-20 ========================================== Severity: Critical Date : 2017-01-13 CVE-ID : CVE-2016-9941 CVE-2016-9942 Package : libvncserver Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-124 Summary ======= The package libvncserver before version 0.9.11-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.9.11-1. # pacman -Syu "libvncserver>=0.9.11-1" The problems have been fixed upstream in version 0.9.11. Workaround ========== None. Description =========== - CVE-2016-9941 (arbitrary code execution) A heap-based buffer overflow has been discovered in rfbproto.c in the LibVNCClient part of LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area. - CVE-2016-9942 (arbitrary code execution) A heap-based buffer overflow has been discovered in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions. Impact ====== A remote attacker is able to use specially crafted messages to execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/52481 https://github.com/LibVNC/libvncserver/pull/137 https://security.archlinux.org/CVE-2016-9941 https://security.archlinux.org/CVE-2016-9942

1 0

[arch-security] [ASA-201701-19] docker: privilege escalation
by Jelle van der Waa 13 Jan '17

13 Jan '17

Arch Linux Security Advisory ASA-201701-19 ========================================== Severity: High Date : 2017-01-13 CVE-ID : CVE-2016-9962 Package : docker Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-133 Summary ======= The package docker before version 1:1.12.6-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1:1.12.6-1. # pacman -Syu "docker>=1:1.12.6-1" The problem has been fixed upstream in version 1.12.6. Workaround ========== None. Description =========== The runc component used by `docker exec` feature of docker allowed additional container processes via to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain low-level access to these new processes during initialization. An attacker can, depending on the nature of the incoming process, leverage this to elevate access to the host. This ranges from accessing host content through the file descriptors of the incoming process to, potentially, a complete container escape by leveraging memory access or syscall interception. Impact ====== A local unprivileged attacker when running as root inside a docker container is able to access the host filesystem leading to privilege escalation. References ========== https://bugs.archlinux.org/task/52493 https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3d… https://bugzilla.suse.com/show_bug.cgi?id=1012568 https://github.com/docker/docker/compare/v1.12.5...v1.12.6 https://www.mail-archive.com/fulldisclosure@seclists.org/msg04165.html https://security.archlinux.org/CVE-2016-9962

1 0

[arch-security] [ASA-201701-18] ark: arbitrary command execution
by Remi Gacogne 13 Jan '17

13 Jan '17

Arch Linux Security Advisory ASA-201701-18 ========================================== Severity: High Date : 2017-01-13 CVE-ID : CVE-2017-5330 Package : ark Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-130 Summary ======= The package ark before version 16.12.1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 16.12.1-1. # pacman -Syu "ark>=16.12.1-1" The problem has been fixed upstream in version 16.12.1. Workaround ========== None. Description =========== Opening an url with ark will call KRUN::runURL() which detects the mime-type of the url and runs the appropriate service for that mimetype when found. This leads to unintended execution of scripts and executable files. Impact ====== An attacker can execute arbitrary command on the affected host by tricking a user into opening an executable file from an archive. References ========== http://seclists.org/oss-sec/2017/q1/45 https://cgit.kde.org/ark.git/commit/?id=82fdfd24d46966a117fa625b68784735a40… https://bugs.kde.org/show_bug.cgi?id=374572 https://security.archlinux.org/CVE-2017-5330

1 0

[arch-security] [ASA-201701-17] lib32-flashplugin: multiple issues
by Remi Gacogne 13 Jan '17

13 Jan '17

Arch Linux Security Advisory ASA-201701-17 ========================================== Severity: Critical Date : 2017-01-12 CVE-ID : CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-136 Summary ======= The package lib32-flashplugin before version 24.0.0.194-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 24.0.0.194-1. # pacman -Syu "lib32-flashplugin>=24.0.0.194-1" The problems have been fixed upstream in version 24.0.0.194. Workaround ========== None. Description =========== - CVE-2017-2925 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability in the JPEG XR codec. - CVE-2017-2926 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. - CVE-2017-2927 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing Adobe Texture Format files. - CVE-2017-2928 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setting visual mode effects. - CVE-2017-2930 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a display list. Successful exploitation could lead to arbitrary code execution. - CVE-2017-2931 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. - CVE-2017-2932 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class. - CVE-2017-2933 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture compression. - CVE-2017-2934 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Texture Format files. - CVE-2017-2935 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the Flash Video container file format. - CVE-2017-2936 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class. - CVE-2017-2937 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class, when using class inheritance. - CVE-2017-2938 (information disclosure) Adobe Flash Player versions 24.0.0.186 and earlier have a security bypass vulnerability related to handling TCP connections. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-02.html https://security.archlinux.org/CVE-2017-2925 https://security.archlinux.org/CVE-2017-2926 https://security.archlinux.org/CVE-2017-2927 https://security.archlinux.org/CVE-2017-2928 https://security.archlinux.org/CVE-2017-2930 https://security.archlinux.org/CVE-2017-2931 https://security.archlinux.org/CVE-2017-2932 https://security.archlinux.org/CVE-2017-2933 https://security.archlinux.org/CVE-2017-2934 https://security.archlinux.org/CVE-2017-2935 https://security.archlinux.org/CVE-2017-2936 https://security.archlinux.org/CVE-2017-2937 https://security.archlinux.org/CVE-2017-2938

1 0

[arch-security] [ASA-201701-16] flashplugin: multiple issues
by Remi Gacogne 13 Jan '17

13 Jan '17

Arch Linux Security Advisory ASA-201701-16 ========================================== Severity: Critical Date : 2017-01-12 CVE-ID : CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 Package : flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-135 Summary ======= The package flashplugin before version 24.0.0.194-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 24.0.0.194-1. # pacman -Syu "flashplugin>=24.0.0.194-1" The problems have been fixed upstream in version 24.0.0.194. Workaround ========== None. Description =========== - CVE-2017-2925 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability in the JPEG XR codec. - CVE-2017-2926 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. - CVE-2017-2927 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing Adobe Texture Format files. - CVE-2017-2928 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setting visual mode effects. - CVE-2017-2930 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a display list. Successful exploitation could lead to arbitrary code execution. - CVE-2017-2931 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. - CVE-2017-2932 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class. - CVE-2017-2933 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture compression. - CVE-2017-2934 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Texture Format files. - CVE-2017-2935 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the Flash Video container file format. - CVE-2017-2936 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class. - CVE-2017-2937 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class, when using class inheritance. - CVE-2017-2938 (information disclosure) Adobe Flash Player versions 24.0.0.186 and earlier have a security bypass vulnerability related to handling TCP connections. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-02.html https://security.archlinux.org/CVE-2017-2925 https://security.archlinux.org/CVE-2017-2926 https://security.archlinux.org/CVE-2017-2927 https://security.archlinux.org/CVE-2017-2928 https://security.archlinux.org/CVE-2017-2930 https://security.archlinux.org/CVE-2017-2931 https://security.archlinux.org/CVE-2017-2932 https://security.archlinux.org/CVE-2017-2933 https://security.archlinux.org/CVE-2017-2934 https://security.archlinux.org/CVE-2017-2935 https://security.archlinux.org/CVE-2017-2936 https://security.archlinux.org/CVE-2017-2937 https://security.archlinux.org/CVE-2017-2938

1 0

[arch-security] [ASA-201701-15] bind: denial of service
by Santiago Torres-Arias 12 Jan '17

12 Jan '17

Arch Linux Security Advisory ASA-201701-15 ========================================== Severity: High Date : 2017-01-12 CVE-ID : CVE-2016-9131 CVE-2016-9147 CVE-2016-9444 CVE-2016-9778 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-132 Summary ======= The package bind before version 9.11.0.P2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.0.P2-1. # pacman -Syu "bind>=9.11.0.P2-1" The problems have been fixed upstream in version 9.11.0.P2. Workaround ========== None Description =========== - CVE-2016-9131 (denial of service) A denial of service flaw was found in the way BIND processed a response to an ANY query. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. - CVE-2016-9147 (denial of service) A denial of service flaw was found in the way BIND handled a query response containing inconsistent DNSSEC information. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. - CVE-2016-9444 (denial of service) A denial of service flaw was found in the way BIND handled an unusually-formed DS record response. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. - CVE-2016-9778 (denial of service) A denial of service flaw was found in the way BIND handled certain queries using the nxdomain-redirect feature to cover a zone for which it is also providing authoritative service. A remote attacker could use this flaw to make named exit unexpectedly with an assertion failure via a specially crafted DNS response. Impact ====== A remote attacker can crash the server by performing crafted queries under certain circumstances. References ========== https://kb.isc.org/article/AA-01439/0 https://kb.isc.org/article/AA-01440/0 https://kb.isc.org/article/AA-01441/0 https://kb.isc.org/article/AA-01442/0 https://security.archlinux.org/CVE-2016-9131 https://security.archlinux.org/CVE-2016-9147 https://security.archlinux.org/CVE-2016-9444 https://security.archlinux.org/CVE-2016-9778

1 0

[arch-security] [ASA-201701-14] irssi: multiple issues
by Levente Polyak 12 Jan '17

12 Jan '17

Arch Linux Security Advisory ASA-201701-14 ========================================== Severity: High Date : 2017-01-11 CVE-ID : CVE-2017-5193 CVE-2017-5194 CVE-2017-5195 CVE-2017-5196 Package : irssi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-127 Summary ======= The package irssi before version 0.8.21-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.8.21-1. # pacman -Syu "irssi>=0.8.21-1" The problems have been fixed upstream in version 0.8.21. Workaround ========== None. Description =========== - CVE-2017-5193 (denial of service) A NULL pointer dereference has been discovered in the nickcmp function leading to application crash. - CVE-2017-5194 (arbitrary code execution) A use after free vulnerability has been discovered when receiving an invalid nick message potentially leading to arbitrary code execution. - CVE-2017-5195 (denial of service) An out of bounds read has been discovered in certain incomplete control codes leading to application crash. - CVE-2017-5196 (denial of service) An out of bounds read has been discovered in certain incomplete character sequences leading to application crash. Impact ====== A remote attacker is able to crash the application or execute arbitrary code on the affected host. References ========== https://irssi.org/security/irssi_sa_2017_01.txt http://www.openwall.com/lists/oss-security/2017/01/05/2 https://github.com/irssi/irssi/commit/6c6c42e3d1b49d90aacc0b67f8540471cae02… https://security.archlinux.org/CVE-2017-5193 https://security.archlinux.org/CVE-2017-5194 https://security.archlinux.org/CVE-2017-5195 https://security.archlinux.org/CVE-2017-5196

1 0

[arch-security] [ASA-201701-13] icoutils: arbitrary code execution
by Jelle van der Waa 09 Jan '17

09 Jan '17

Arch Linux Security Advisory ASA-201701-13 ========================================== Severity: High Date : 2017-01-09 CVE-ID : CVE-2017-5208 Package : icoutils Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-129 Summary ======= The package icoutils before version 0.31.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.31.1-1. # pacman -Syu "icoutils>=0.31.1-1" The problem has been fixed upstream in version 0.31.1. Workaround ========== None. Description =========== An integer overflow vulnerability was found in icoutils in the wrestool program. A maliciously crafted file could make the application crash or possibly lead to arbitrary code execution. This issue only affects 64-bit systems, as the result of subtracting two pointers exceeds the size of int. Impact ====== An attacker is able to execute arbitrary code on a target machine by tricking the user to open a specially crafted file. References ========== http://www.nongnu.org/icoutils/NEWS http://seclists.org/oss-sec/2017/q1/38 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850017 https://anonscm.debian.org/git/users/cjwatson/icoutils.git/plain/debian/pat… https://security.archlinux.org/CVE-2017-5208

1 0

[arch-security] [ASA-201701-12] pcsclite: privilege escalation
by Jelle van der Waa 04 Jan '17

04 Jan '17

Arch Linux Security Advisory ASA-201701-12 ========================================== Severity: Medium Date : 2017-01-04 CVE-ID : CVE-2016-10109 Package : pcsclite Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-126 Summary ======= The package pcsclite before version 1.8.20-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.8.20-1. # pacman -Syu "pcsclite>=1.8.20-1" The problem has been fixed upstream in version 1.8.20. Workaround ========== None. Description =========== The SCardReleaseContext function normally releases resources associated with the given handle (including "cardsList") and clients should cease using this handle. A malicious client can however make the daemon invoke SCardReleaseContext and continue issuing other commands that use "cardsList", resulting in a use-after-free. When SCardReleaseContext is invoked multiple times, it additionally results in a double-free of "cardsList". The issue allows a local attacker to cause a denial of service, but can potentially result in privilege escalation since the daemon is running as root while any local user can connect to the Unix socket. Fixed by patch "SCardReleaseContext: prevent use-after-free of cardsList" which is released with hpcsc-lite 1.8.20 on 30 December 2016. Impact ====== A local attacker is able to cause a denial of service or escalate privileges by sending specially crafted commands to pcscd. References ========== https://anonscm.debian.org/cgit/pcsclite/PCSC.git/commit/?id=697fe05967af7e… http://lists.alioth.debian.org/pipermail/pcsclite-muscle/Week-of-Mon-201612… http://marc.info/?l=oss-security&m=148345047107588 https://security.archlinux.org/CVE-2016-10109

1 0

[arch-security] [ASA-201701-11] lib32-libcurl-gnutls: multiple issues
by Levente Polyak 04 Jan '17

04 Jan '17

Arch Linux Security Advisory ASA-201701-11 ========================================== Severity: Medium Date : 2017-01-03 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-117 Summary ======= The package lib32-libcurl-gnutls before version 7.52.1-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 7.52.1-1. # pacman -Syu "lib32-libcurl-gnutls>=7.52.1-1" The problems have been fixed upstream in version 7.52.1. Workaround ========== None. Description =========== - CVE-2016-9586 (arbitrary code execution) libcurl's implementation of the printf() functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the correct boundary checks. The functions have been documented as deprecated for a long time and users are discouraged from using them in "new programs" as they are planned to get removed at a future point. But as the functions are present and there's nothing preventing users from using them, we expect there to be a certain amount of existing users in the wild. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. - CVE-2016-9594 (incorrect calculation) libcurl's (new) internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary strings in HTTP formposts and more. Having a weak or virtually non-existent random there makes these operations vulnerable. This function has been introduced in 7.52.0 Impact ====== A remote attacker is able to execute arbitrary code on a target machine by sending crafted data to the server. In addition, the nonces generated by libcurl 7.52.0 were not truly random, which allowed for an attacker to derive sensitive information (e.g., session keys). References ========== https://bugs.archlinux.org/task/52247 https://bugs.archlinux.org/task/52250 https://curl.haxx.se/docs/adv_20161221A.html https://curl.haxx.se/docs/adv_20161223.html https://security.archlinux.org/CVE-2016-9586 https://security.archlinux.org/CVE-2016-9594

1 0