October 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201710-34] wget: multiple issues
by Christian Rebischke 30 Oct '17

30 Oct '17

Arch Linux Security Advisory ASA-201710-34 ========================================== Severity: Critical Date : 2017-10-29 CVE-ID : CVE-2017-13089 CVE-2017-13090 CVE-2017-6508 Package : wget Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-473 Summary ======= The package wget before version 1.19.2-1 is vulnerable to multiple issues including arbitrary code execution and content spoofing. Resolution ========== Upgrade to 1.19.2-1. # pacman -Syu "wget>=1.19.2-1" The problems have been fixed upstream in version 1.19.2. Workaround ========== None. Description =========== - CVE-2017-13089 (arbitrary code execution) A stack-based buffer overflow has been found in the HTTP protocol handling code of wget < 1.19.2, when processing chunked, encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. - CVE-2017-13090 (arbitrary code execution) A heap-based buffer overflow has been found in the HTTP protocol handling code of wget < 1.19.2, when processing chunked encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. - CVE-2017-6508 (content spoofing) A CRLF injection flaw was found in the way wget < 1.19.2 handled URLs. A remote attacker could use this flaw to inject arbitrary HTTP headers in requests, via CRLF sequences in the host sub-component of a URL, by tricking a user running wget into processing crafted URLs. Impact ====== By tricking an unsuspecting user into connecting to a malicious host a remote attacker is able to execute arbitrary code or spoof returned data. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1505444 https://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734e… https://bugzilla.redhat.com/show_bug.cgi?id=1505445 https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce4147… http://lists.gnu.org/archive/html/bug-wget/2017-03/msg00018.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-6508 http://git.savannah.gnu.org/cgit/wget.git/commit/?id=4d729e322fae359a1aefaa… https://security.archlinux.org/CVE-2017-13089 https://security.archlinux.org/CVE-2017-13090 https://security.archlinux.org/CVE-2017-6508

1 0

[arch-security] [ASA-201710-33] apr-util: denial of service
by Remi Gacogne 27 Oct '17

27 Oct '17

Arch Linux Security Advisory ASA-201710-33 ========================================== Severity: Low Date : 2017-10-27 CVE-ID : CVE-2017-12618 Package : apr-util Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-468 Summary ======= The package apr-util before version 1.6.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.6.1-1. # pacman -Syu "apr-util>=1.6.1-1" The problem has been fixed upstream in version 1.6.1. Workaround ========== None. Description =========== APR-util 1.6.0 and prior failed to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service. Impact ====== A local attacker with write access to the database can cause a denial of service. References ========== https://mail-archives.apache.org/mod_mbox/apr-dev/201710.mbox/%3CCACsi252PO… https://security.archlinux.org/CVE-2017-12618

1 0

[arch-security] [ASA-201710-32] apr: information disclosure
by Remi Gacogne 27 Oct '17

27 Oct '17

Arch Linux Security Advisory ASA-201710-32 ========================================== Severity: Medium Date : 2017-10-27 CVE-ID : CVE-2017-12613 Package : apr Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-469 Summary ======= The package apr before version 1.6.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.6.3-1. # pacman -Syu "apr>=1.6.3-1" The problem has been fixed upstream in version 1.6.3. Workaround ========== None. Description =========== When apr_exp_time*() or apr_os_exp_time*() functions are invoked with an invalid month field value in APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input. Impact ====== A remote attacker can access sensitive information or cause a denial of service by submitting specially crafted input. References ========== https://mail-archives.apache.org/mod_mbox/apr-dev/201710.mbox/%3CCACsi252PO… https://security.archlinux.org/CVE-2017-12613

1 0

[arch-security] [ASA-201710-31] chromium: arbitrary code execution
by Remi Gacogne 27 Oct '17

27 Oct '17

Arch Linux Security Advisory ASA-201710-31 ========================================== Severity: Critical Date : 2017-10-27 CVE-ID : CVE-2017-15396 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-472 Summary ======= The package chromium before version 62.0.3202.75-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 62.0.3202.75-1. # pacman -Syu "chromium>=62.0.3202.75-1" The problem has been fixed upstream in version 62.0.3202.75. Workaround ========== None. Description =========== A stack overflow has been found in the V8 component of the chromium browser < 62.0.3202.75. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-des… https://crbug.com/770452 https://security.archlinux.org/CVE-2017-15396

1 0

[arch-security] [ASA-201710-30] irssi: multiple issues
by Remi Gacogne 22 Oct '17

22 Oct '17

Arch Linux Security Advisory ASA-201710-30 ========================================== Severity: High Date : 2017-10-22 CVE-ID : CVE-2017-15227 CVE-2017-15228 CVE-2017-15721 CVE-2017-15722 CVE-2017-15723 Package : irssi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-461 Summary ======= The package irssi before version 1.0.5-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.0.5-1. # pacman -Syu "irssi>=1.0.5-1" The problems have been fixed upstream in version 1.0.5. Workaround ========== None. Description =========== - CVE-2017-15227 (arbitrary code execution) While waiting for the channel synchronization, Irssi < 1.0.5 may incorrectly fail to remove destroyed channels from the query list, resulting in use-after-free conditions when updating the state later on. To be exploited, this issue requires a broken IRCd or control over the IRCd. - CVE-2017-15228 (denial of service) When installing themes with unterminated colour formatting sequences, Irssi < 1.0.5 may access data beyond the end of the string. - CVE-2017-15721 (denial of service) Certain incorrectly formatted DCC CTCP messages could cause NULL- pointer dereference in Irssi < 1.0.5. This is a separate, but similar issue to CVE-2017-9468. To be exploited, this issue requires a broken IRCd or control over the IRCd. - CVE-2017-15722 (denial of service) In certain cases Irssi may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string. To be exploited, this issue requires a broken IRCd or control over the IRCd. - CVE-2017-15723 (denial of service) Overlong nicks or targets may result in a NULL-pointer dereference in Irssi >= 0.8.17 and < 1.0.5 while splitting the message. Most IRC servers typically have length limits in place that would prevent this issue. Impact ====== A remote attacker can cause a denial of service by sending crafted IRC messages, or tricking the user into installing a crafted theme. A remote attacker in control of the IRCd to which the user is connected, or in position of man-in-the-middle, might be able to execute arbitrary code on the affected host. References ========== https://irssi.org/security/irssi_sa_2017_10.txt https://github.com/irssi/irssi/commit/49ace3251b79a9e97c6e4d0bc640f9143dc71… https://github.com/irssi/irssi/commit/2edd816e7db13b4ac0b20df9bf7fe55ee7718… https://github.com/irssi/irssi/commit/00c80cb6fcca40cfc421fe3fc181115ac4907… https://github.com/irssi/irssi/commit/9f0dc4766c7aa80e34aa2cde94323fb49971a… https://github.com/irssi/irssi/commit/45dfe2ba3889c5dc23a9bea3214f158cc651a… https://github.com/irssi/irssi/commit/0840eaec7bf56740029aae614e393f8cf76f6… https://security.archlinux.org/CVE-2017-15227 https://security.archlinux.org/CVE-2017-15228 https://security.archlinux.org/CVE-2017-15721 https://security.archlinux.org/CVE-2017-15722 https://security.archlinux.org/CVE-2017-15723

1 0

[arch-security] [ASA-201710-29] xorg-server: arbitrary code execution
by Remi Gacogne 21 Oct '17

21 Oct '17

Arch Linux Security Advisory ASA-201710-29 ========================================== Severity: High Date : 2017-10-21 CVE-ID : CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12183 Package : xorg-server Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-443 Summary ======= The package xorg-server before version 1.19.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.19.5-1. # pacman -Syu "xorg-server>=1.19.5-1" The problems have been fixed upstream in version 1.19.5. Workaround ========== None. Description =========== - CVE-2017-12176 (arbitrary code execution) A security issue has been found in xorg-server, due to a missing validation of the extra length in ProcEstablishConnection(). - CVE-2017-12177 (arbitrary code execution) A security issue has been found in the double buffer extension component of xorg-server, due to a missing validation of the length of a variable-length request in ProcDbeGetVisualInfo(). - CVE-2017-12178 (arbitrary code execution) A security issue has been found in the Xi component of xorg-server, due to an invalid length check in ProcXIChangeHierarchy. - CVE-2017-12183 (arbitrary code execution) A security issue has been found in the xfixes component of xorg-server, where buffer lengths were not correctly validated. Impact ====== An attacker able to connect to an X server, either locally or remotely, can cause a denial of service by crashing the server, or execute arbitrary code on the affected host. References ========== https://lists.x.org/archives/xorg-devel/2017-October/054871.html https://cgit.freedesktop.org/xorg/xserver/commit/?id=b747da5e25be944337a9cd… https://cgit.freedesktop.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234… https://cgit.freedesktop.org/xorg/xserver/commit/?id=859b08d523307eebde7724… https://cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc9… https://security.archlinux.org/CVE-2017-12176 https://security.archlinux.org/CVE-2017-12177 https://security.archlinux.org/CVE-2017-12178 https://security.archlinux.org/CVE-2017-12183

1 0

[arch-security] [ASA-201710-28] musl: arbitrary code execution
by Remi Gacogne 21 Oct '17

21 Oct '17

Arch Linux Security Advisory ASA-201710-28 ========================================== Severity: Critical Date : 2017-10-21 CVE-ID : CVE-2017-15650 Package : musl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-457 Summary ======= The package musl before version 1.1.17-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.1.17-1. # pacman -Syu "musl>=1.1.17-1" The problem has been fixed upstream in version 1.1.17. Workaround ========== Using a local, trusted DNS resolver mitigates the issue. Description =========== A stack-based buffer overflow has been found in the DNS response parsing code of musl libc <= 1.1.16. When an application makes a request via getaddrinfo for both IPv4 and IPv6 results (AF_UNSPEC), an attacker who controls or can spoof the nameservers configured in resolv.conf can reply to both the A and AAAA queries with A results. Since A records are smaller than AAAA records, it's possible to fit more addresses than the precomputed bound, and a buffer overflow occurs. Impact ====== A remote attacker who controls or can spoof the nameservers configured in resolv.conf can execute arbitrary code on the affected host. References ========== http://seclists.org/oss-sec/2017/q4/107 https://git.musl-libc.org/cgit/musl/commit/?id=45ca5d3fcb6f874bf5ba55d0e965… https://security.archlinux.org/CVE-2017-15650

1 0

[arch-security] [ASA-201710-27] chromium: multiple issues
by Remi Gacogne 19 Oct '17

19 Oct '17

Arch Linux Security Advisory ASA-201710-27 ========================================== Severity: Critical Date : 2017-10-19 CVE-ID : CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129 CVE-2017-5130 CVE-2017-5131 CVE-2017-5132 CVE-2017-5133 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-456 Summary ======= The package chromium before version 62.0.3202.62-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, access restriction bypass, content spoofing, information disclosure and denial of service. Resolution ========== Upgrade to 62.0.3202.62-1. # pacman -Syu "chromium>=62.0.3202.62-1" The problems have been fixed upstream in version 62.0.3202.62. Workaround ========== None. Description =========== - CVE-2017-15386 (content spoofing) A UI spoofing issue has been found in the Blink component of the Chromium browser < 62.0.3202.62. - CVE-2017-15387 (access restriction bypass) A content security bypass has been found in the Chromium browser < 62.0.3202.62. - CVE-2017-15388 (information disclosure) An out-of-bounds read has been found in the Skia component of the Chromium browser < 62.0.3202.62. - CVE-2017-15389 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser < 62.0.3202.62. - CVE-2017-15390 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser < 62.0.3202.62. - CVE-2017-15391 (access restriction bypass) An extension limitation bypass has been found in the Extensions component of the Chromium browser < 62.0.3202.62. - CVE-2017-15392 (access restriction bypass) An incorrect registry key handling issue has been found in the PlatformIntegration component of the Chromium browser < 62.0.3202.62. - CVE-2017-15393 (information disclosure) A referrer leak has been found in the Devtools component of the Chromium browser < 62.0.3202.62. - CVE-2017-15394 (content spoofing) A URL spoofing flaw has been found in the extensions UI of the Chromium browser < 62.0.3202.62. - CVE-2017-15395 (denial of service) A null-pointer dereference flaw has been found in the ImageCapture component of the Chromium browser < 62.0.3202.62. - CVE-2017-5124 (cross-site scripting) A universal XSS flaw has been found in the MHTML component of the Chromium browser < 62.0.3202.62. - CVE-2017-5125 (arbitrary code execution) A heap overflow security issue has been found in the Skia component of the Chromium browser < 62.0.3202.62. - CVE-2017-5126 (arbitrary code execution) A use-after-free security issue has been found in the PDFium component of the Chromium browser < 62.0.3202.62. - CVE-2017-5127 (arbitrary code execution) A use-after-free security issue has been found in the PDFium component of the Chromium browser < 62.0.3202.62. - CVE-2017-5128 (arbitrary code execution) A heap overflow security issue has been found in the WebGL component of the Chromium browser < 62.0.3202.62. - CVE-2017-5129 (arbitrary code execution) A use-after-free security issue has been found in the WebAudio component of the Chromium browser < 62.0.3202.62. - CVE-2017-5130 (arbitrary code execution) A heap overflow security issue has been found in libxml2. - CVE-2017-5131 (arbitrary code execution) An out-of-bounds write has been found in the Skia component of the Chromium browser < 62.0.3202.62. - CVE-2017-5132 (arbitrary code execution) An incorrect stack manipulation security issue has been found in the WebAssembly component of the Chromium browser < 62.0.3202.62. - CVE-2017-5133 (arbitrary code execution) An out-of-bounds write has been found in the Skia component of the Chromium browser < 62.0.3202.62. Impact ====== A remote attacker can bypass security measures, trick the user by spoofing parts of the UI, cause a denial of service or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-des… https://crbug.com/752003 https://crbug.com/756040 https://crbug.com/756563 https://crbug.com/739621 https://crbug.com/750239 https://crbug.com/598265 https://crbug.com/714401 https://crbug.com/732751 https://crbug.com/745580 https://crbug.com/759457 https://crbug.com/762930 https://crbug.com/749147 https://crbug.com/760455 https://crbug.com/765384 https://crbug.com/765469 https://crbug.com/765495 https://crbug.com/722079 https://crbug.com/744109 https://crbug.com/718858 https://crbug.com/762106 https://security.archlinux.org/CVE-2017-15386 https://security.archlinux.org/CVE-2017-15387 https://security.archlinux.org/CVE-2017-15388 https://security.archlinux.org/CVE-2017-15389 https://security.archlinux.org/CVE-2017-15390 https://security.archlinux.org/CVE-2017-15391 https://security.archlinux.org/CVE-2017-15392 https://security.archlinux.org/CVE-2017-15393 https://security.archlinux.org/CVE-2017-15394 https://security.archlinux.org/CVE-2017-15395 https://security.archlinux.org/CVE-2017-5124 https://security.archlinux.org/CVE-2017-5125 https://security.archlinux.org/CVE-2017-5126 https://security.archlinux.org/CVE-2017-5127 https://security.archlinux.org/CVE-2017-5128 https://security.archlinux.org/CVE-2017-5129 https://security.archlinux.org/CVE-2017-5130 https://security.archlinux.org/CVE-2017-5131 https://security.archlinux.org/CVE-2017-5132 https://security.archlinux.org/CVE-2017-5133

1 0

[arch-security] [ASA-201710-26] linux: privilege escalation
by Santiago Torres-Arias 17 Oct '17

17 Oct '17

Arch Linux Security Advisory ASA-201710-26 ========================================== Severity: High Date : 2017-10-17 CVE-ID : CVE-2017-5123 Package : linux Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-444 Summary ======= The package linux before version 4.13.7-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.13.7-1. # pacman -Syu "linux>=4.13.7-1" The problem has been fixed upstream in version 4.13.7. Workaround ========== None. Description =========== It was discovered that when the waitid() syscall in Linux kernel v4.13 was refactored, it accidentally stopped checking that the incoming argument was pointing to userspace. This allowed local attackers to write directly to kernel memory, which could lead to privilege escalation. Impact ====== A local attacker is able to escalate privileges on the affected host. References ========== http://www.openwall.com/lists/oss-security/2017/10/12/18 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2017-5123

1 0

[arch-security] [ASA-201710-25] linux-hardened: privilege escalation
by Santiago Torres-Arias 17 Oct '17

17 Oct '17

Arch Linux Security Advisory ASA-201710-25 ========================================== Severity: High Date : 2017-10-16 CVE-ID : CVE-2017-5123 Package : linux-hardened Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-446 Summary ======= The package linux-hardened before version 4.13.7.a-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.13.7.a-1. # pacman -Syu "linux-hardened>=4.13.7.a-1" The problem has been fixed upstream in version 4.13.7.a. Workaround ========== None. Description =========== It was discovered that when the waitid() syscall in Linux kernel v4.13 was refactored, it accidentally stopped checking that the incoming argument was pointing to userspace. This allowed local attackers to write directly to kernel memory, which could lead to privilege escalation. Impact ====== A local attacker is able to escalate privileges on the affected host. References ========== http://www.openwall.com/lists/oss-security/2017/10/12/18 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2017-5123

1 0