November 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201711-11] libcurl-gnutls: information disclosure
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-11 ========================================== Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : libcurl-gnutls Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-462 Summary ======= The package libcurl-gnutls before version 7.56.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.56.1-1. # pacman -Syu "libcurl-gnutls>=7.56.1-1" The problem has been fixed upstream in version 7.56.1. Workaround ========== None. Description =========== A heap buffer overrun flaw was found in the IMAP handler of libcurl >= 7.20.0 and < 7.56.1. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. Impact ====== A remote attacker is able to disclose sensitive information or crash the application by tricking an unsuspecting user into connecting to a malicious IMAP server. References ========== https://curl.haxx.se/docs/adv_20171023.html https://curl.haxx.se/CVE-2017-1000257.patch https://github.com/curl/curl/commit/13c9a9ded3ae744a1e11cbc14e9146d9fa427040 https://security.archlinux.org/CVE-2017-1000257

1 0

[arch-security] [ASA-201711-10] libcurl-compat: information disclosure
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-10 ========================================== Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : libcurl-compat Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-463 Summary ======= The package libcurl-compat before version 7.56.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.56.1-1. # pacman -Syu "libcurl-compat>=7.56.1-1" The problem has been fixed upstream in version 7.56.1. Workaround ========== None. Description =========== A heap buffer overrun flaw was found in the IMAP handler of libcurl >= 7.20.0 and < 7.56.1. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. Impact ====== A remote attacker is able to disclose sensitive information or crash the application by tricking an unsuspecting user into connecting to a malicious IMAP server. References ========== https://curl.haxx.se/docs/adv_20171023.html https://curl.haxx.se/CVE-2017-1000257.patch https://github.com/curl/curl/commit/13c9a9ded3ae744a1e11cbc14e9146d9fa427040 https://security.archlinux.org/CVE-2017-1000257

1 0

[arch-security] [ASA-201711-9] lib32-libcurl-gnutls: information disclosure
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-9 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : lib32-libcurl-gnutls Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-464 Summary ======= The package lib32-libcurl-gnutls before version 7.56.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.56.1-1. # pacman -Syu "lib32-libcurl-gnutls>=7.56.1-1" The problem has been fixed upstream in version 7.56.1. Workaround ========== None. Description =========== A heap buffer overrun flaw was found in the IMAP handler of libcurl >= 7.20.0 and < 7.56.1. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. Impact ====== A remote attacker is able to disclose sensitive information or crash the application by tricking an unsuspecting user into connecting to a malicious IMAP server. References ========== https://curl.haxx.se/docs/adv_20171023.html https://curl.haxx.se/CVE-2017-1000257.patch https://github.com/curl/curl/commit/13c9a9ded3ae744a1e11cbc14e9146d9fa427040 https://security.archlinux.org/CVE-2017-1000257

1 0

[arch-security] [ASA-201711-8] lib32-libcurl-compat: information disclosure
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-8 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : lib32-libcurl-compat Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-465 Summary ======= The package lib32-libcurl-compat before version 7.56.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.56.1-1. # pacman -Syu "lib32-libcurl-compat>=7.56.1-1" The problem has been fixed upstream in version 7.56.1. Workaround ========== None. Description =========== A heap buffer overrun flaw was found in the IMAP handler of libcurl >= 7.20.0 and < 7.56.1. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. Impact ====== A remote attacker is able to disclose sensitive information or crash the application by tricking an unsuspecting user into connecting to a malicious IMAP server. References ========== https://curl.haxx.se/docs/adv_20171023.html https://curl.haxx.se/CVE-2017-1000257.patch https://github.com/curl/curl/commit/13c9a9ded3ae744a1e11cbc14e9146d9fa427040 https://security.archlinux.org/CVE-2017-1000257

1 0

[arch-security] [ASA-201711-7] lib32-curl: information disclosure
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-7 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : lib32-curl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-466 Summary ======= The package lib32-curl before version 7.56.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.56.1-1. # pacman -Syu "lib32-curl>=7.56.1-1" The problem has been fixed upstream in version 7.56.1. Workaround ========== None. Description =========== A heap buffer overrun flaw was found in the IMAP handler of libcurl >= 7.20.0 and < 7.56.1. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. Impact ====== A remote attacker is able to disclose sensitive information or crash the application by tricking an unsuspecting user into connecting to a malicious IMAP server. References ========== https://curl.haxx.se/docs/adv_20171023.html https://curl.haxx.se/CVE-2017-1000257.patch https://github.com/curl/curl/commit/13c9a9ded3ae744a1e11cbc14e9146d9fa427040 https://security.archlinux.org/CVE-2017-1000257

1 0

[arch-security] [ASA-201711-6] curl: information disclosure
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-6 ========================================= Severity: Medium Date : 2017-11-02 CVE-ID : CVE-2017-1000257 Package : curl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-467 Summary ======= The package curl before version 7.56.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.56.1-1. # pacman -Syu "curl>=7.56.1-1" The problem has been fixed upstream in version 7.56.1. Workaround ========== None. Description =========== A heap buffer overrun flaw was found in the IMAP handler of libcurl >= 7.20.0 and < 7.56.1. An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded. By tricking an unsuspecting user into connecting to a malicious IMAP server, an attacker could exploit this flaw to potentially cause information disclosure or crash the application. Impact ====== A remote attacker is able to disclose sensitive information or crash the application by tricking an unsuspecting user into connecting to a malicious IMAP server. References ========== https://curl.haxx.se/docs/adv_20171023.html https://curl.haxx.se/CVE-2017-1000257.patch https://github.com/curl/curl/commit/13c9a9ded3ae744a1e11cbc14e9146d9fa427040 https://security.archlinux.org/CVE-2017-1000257

1 0

[arch-security] [ASA-201711-5] zathura-pdf-mupdf: arbitrary code execution
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-5 ========================================= Severity: High Date : 2017-11-01 CVE-ID : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587 Package : zathura-pdf-mupdf Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-476 Summary ======= The package zathura-pdf-mupdf before version 0.3.1-4 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.3.1-4. # pacman -Syu "zathura-pdf-mupdf>=0.3.1-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-14685 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. - CVE-2017-14686 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. - CVE-2017-14687 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. - CVE-2017-15587 (arbitrary code execution) An integer overflow leading to an out-of-bounds wrte has been found in mupdf <= 1.11. The parsing of a crafted PDF might allow an attacker to write controlled data to an arbitrary location in memory when performing truncated xref checks. Impact ====== An attacker is able to execute arbitrary code on the affected host by providing a maliciously-crafted .xps or .pdf file to the zathura process. References ========== http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=ab1a420613dec93c686a… https://bugs.ghostscript.com/show_bug.cgi?id=698539 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=0f0fbc07d9be31f5e83e… https://bugs.ghostscript.com/show_bug.cgi?id=698540 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=2b16dbd8f73269cb15ca… https://bugs.ghostscript.com/show_bug.cgi?id=698558 https://nandynarwhals.org/CVE-2017-15587/ http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=82df2631d7d0446b206e… https://security.archlinux.org/CVE-2017-14685 https://security.archlinux.org/CVE-2017-14686 https://security.archlinux.org/CVE-2017-14687 https://security.archlinux.org/CVE-2017-15587

1 0

[arch-security] [ASA-201711-4] mupdf: arbitrary code execution
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-4 ========================================= Severity: High Date : 2017-11-01 CVE-ID : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587 Package : mupdf Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-458 Summary ======= The package mupdf before version 1.11-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.11-5. # pacman -Syu "mupdf>=1.11-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-14685 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. - CVE-2017-14686 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. - CVE-2017-14687 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. - CVE-2017-15587 (arbitrary code execution) An integer overflow leading to an out-of-bounds wrte has been found in mupdf <= 1.11. The parsing of a crafted PDF might allow an attacker to write controlled data to an arbitrary location in memory when performing truncated xref checks. Impact ====== An attacker is able to execute arbitrary code on the affected host by providing a maliciously-crafted .xps or .pdf file. References ========== http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=ab1a420613dec93c686a… https://bugs.ghostscript.com/show_bug.cgi?id=698539 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=0f0fbc07d9be31f5e83e… https://bugs.ghostscript.com/show_bug.cgi?id=698540 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=2b16dbd8f73269cb15ca… https://bugs.ghostscript.com/show_bug.cgi?id=698558 https://nandynarwhals.org/CVE-2017-15587/ http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=82df2631d7d0446b206e… https://security.archlinux.org/CVE-2017-14685 https://security.archlinux.org/CVE-2017-14686 https://security.archlinux.org/CVE-2017-14687 https://security.archlinux.org/CVE-2017-15587

1 0

[arch-security] [ASA-201711-3] mupdf-tools: arbitrary code execution
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-3 ========================================= Severity: High Date : 2017-11-01 CVE-ID : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587 Package : mupdf-tools Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-458 Summary ======= The package mupdf-tools before version 1.11-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.11-5. # pacman -Syu "mupdf-tools>=1.11-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-14685 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. - CVE-2017-14686 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. - CVE-2017-14687 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. - CVE-2017-15587 (arbitrary code execution) An integer overflow leading to an out-of-bounds wrte has been found in mupdf <= 1.11. The parsing of a crafted PDF might allow an attacker to write controlled data to an arbitrary location in memory when performing truncated xref checks. Impact ====== An attacker is able to execute arbitrary code on the affected host by providing a maliciously-crafted .xps or .pdf file. References ========== http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=ab1a420613dec93c686a… https://bugs.ghostscript.com/show_bug.cgi?id=698539 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=0f0fbc07d9be31f5e83e… https://bugs.ghostscript.com/show_bug.cgi?id=698540 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=2b16dbd8f73269cb15ca… https://bugs.ghostscript.com/show_bug.cgi?id=698558 https://nandynarwhals.org/CVE-2017-15587/ http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=82df2631d7d0446b206e… https://security.archlinux.org/CVE-2017-14685 https://security.archlinux.org/CVE-2017-14686 https://security.archlinux.org/CVE-2017-14687 https://security.archlinux.org/CVE-2017-15587

1 0

[arch-security] [ASA-201711-2] libmupdf: arbitrary code execution
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-2 ========================================= Severity: High Date : 2017-11-01 CVE-ID : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587 Package : libmupdf Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-458 Summary ======= The package libmupdf before version 1.11-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.11-5. # pacman -Syu "libmupdf>=1.11-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-14685 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. - CVE-2017-14686 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. - CVE-2017-14687 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. - CVE-2017-15587 (arbitrary code execution) An integer overflow leading to an out-of-bounds wrte has been found in mupdf <= 1.11. The parsing of a crafted PDF might allow an attacker to write controlled data to an arbitrary location in memory when performing truncated xref checks. Impact ====== An attacker is able to execute arbitrary code on the affected host by providing a maliciously-crafted .xps or .pdf file. References ========== http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=ab1a420613dec93c686a… https://bugs.ghostscript.com/show_bug.cgi?id=698539 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=0f0fbc07d9be31f5e83e… https://bugs.ghostscript.com/show_bug.cgi?id=698540 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=2b16dbd8f73269cb15ca… https://bugs.ghostscript.com/show_bug.cgi?id=698558 https://nandynarwhals.org/CVE-2017-15587/ http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=82df2631d7d0446b206e… https://security.archlinux.org/CVE-2017-14685 https://security.archlinux.org/CVE-2017-14686 https://security.archlinux.org/CVE-2017-14687 https://security.archlinux.org/CVE-2017-15587

1 0