February 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201702-19] bzip2: denial of service
by Levente Polyak 22 Feb '17

22 Feb '17

Arch Linux Security Advisory ASA-201702-19 ========================================== Severity: Low Date : 2017-02-22 CVE-ID : CVE-2016-3189 Package : bzip2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-4 Summary ======= The package bzip2 before version 1.0.6-6 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.6-6. # pacman -Syu "bzip2>=1.0.6-6" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A use-after-free flaw was found in bzip2recover, leading to a null pointer dereference, or a write to a closed file descriptor. An attacker could use this flaw by sending a specially crafted bzip2 file to recover and force the program to crash. Impact ====== An attacker is able to create a specially crafted bzip2 archive that, when processed by bzip2recover, crashes the process resulting in denial of service. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1319648 https://security.archlinux.org/CVE-2016-3189

1 0

[arch-security] [ASA-201702-18] linux-zen: multiple issues
by Levente Polyak 22 Feb '17

22 Feb '17

Arch Linux Security Advisory ASA-201702-18 ========================================== Severity: High Date : 2017-02-22 CVE-ID : CVE-2016-10088 CVE-2016-9588 CVE-2017-5986 CVE-2017-6074 Package : linux-zen Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-186 Summary ======= The package linux-zen before version 4.9.11-2 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 4.9.11-2. # pacman -Syu "linux-zen>=4.9.11-2" The problems have been fixed upstream in version 4.9.11. Workaround ========== None. Description =========== - CVE-2016-10088 (privilege escalation) The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576. - CVE-2016-9588 (denial of service) Linux kernel built with the KVM visualization support (CONFIG_KVM), with nested visualization(nVMX) feature enabled(nested=1), is vulnerable to an uncaught exception issue. It could occur if an L2 guest was to throw an exception which is not handled by an L1 guest. - CVE-2017-5986 (denial of service) It was reported that with Linux kernel, earlier than version v4.10-rc8, an application may trigger a BUG_ON in sctp_wait_for_sndbuf if the socket tx buffer is full, a thread is waiting on it to queue more data, and meanwhile another thread peels off the association being used by the first thread. This issue may then lead to a segmentation fault resulting in denial of service. - CVE-2017-6074 (privilege escalation) A use-after-free vulnerability has been discovered in the DCCP implementation in the Linux kernel. The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state. A local unprivileged user could use this flaw to alter the kernel memory, allowing them to escalate their privileges on the system via an application that makes an IPV6_RECVPKTINFO setsockopt system call. Impact ====== A local unprivileged attacker is able to perform a denial of service attack or escalate their privileges on the system. References ========== https://github.com/torvalds/linux/commit/2dcab598484185dea7ec22219c76dcdd59… http://seclists.org/oss-sec/2017/q1/432 https://github.com/torvalds/linux/commit/5edabca9d4cff7f1f2b68f0bac55ef99d9… https://patchwork.ozlabs.org/patch/728808/ https://security.archlinux.org/CVE-2016-10088 https://security.archlinux.org/CVE-2016-9588 https://security.archlinux.org/CVE-2017-5986 https://security.archlinux.org/CVE-2017-6074

1 0

[arch-security] [ASA-201702-17] linux: multiple issues
by Levente Polyak 22 Feb '17

22 Feb '17

Arch Linux Security Advisory ASA-201702-17 ========================================== Severity: High Date : 2017-02-22 CVE-ID : CVE-2016-10088 CVE-2016-9588 CVE-2017-5986 CVE-2017-6074 Package : linux Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-178 Summary ======= The package linux before version 4.9.11-1 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 4.9.11-1. # pacman -Syu "linux>=4.9.11-1" The problems have been fixed upstream in version 4.9.11. Workaround ========== None. Description =========== - CVE-2016-10088 (privilege escalation) The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576. - CVE-2016-9588 (denial of service) Linux kernel built with the KVM visualization support (CONFIG_KVM), with nested visualization(nVMX) feature enabled(nested=1), is vulnerable to an uncaught exception issue. It could occur if an L2 guest was to throw an exception which is not handled by an L1 guest. - CVE-2017-5986 (denial of service) It was reported that with Linux kernel, earlier than version v4.10-rc8, an application may trigger a BUG_ON in sctp_wait_for_sndbuf if the socket tx buffer is full, a thread is waiting on it to queue more data, and meanwhile another thread peels off the association being used by the first thread. This issue may then lead to a segmentation fault resulting in denial of service. - CVE-2017-6074 (privilege escalation) A use-after-free vulnerability has been discovered in the DCCP implementation in the Linux kernel. The dccp_rcv_state_process function in net/dccp/input.c in the Linux kernel through 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state. A local unprivileged user could use this flaw to alter the kernel memory, allowing them to escalate their privileges on the system via an application that makes an IPV6_RECVPKTINFO setsockopt system call. Impact ====== A local unprivileged attacker is able to perform a denial of service attack or escalate their privileges on the system. References ========== https://github.com/torvalds/linux/commit/2dcab598484185dea7ec22219c76dcdd59… http://seclists.org/oss-sec/2017/q1/432 https://github.com/torvalds/linux/commit/5edabca9d4cff7f1f2b68f0bac55ef99d9… https://patchwork.ozlabs.org/patch/728808/ https://security.archlinux.org/CVE-2016-10088 https://security.archlinux.org/CVE-2016-9588 https://security.archlinux.org/CVE-2017-5986 https://security.archlinux.org/CVE-2017-6074

1 0

[arch-security] [ASA-201702-16] lib32-flashplugin: arbitrary code execution
by Remi Gacogne 17 Feb '17

17 Feb '17

Arch Linux Security Advisory ASA-201702-16 ========================================== Severity: Critical Date : 2017-02-17 CVE-ID : CVE-2017-2982 CVE-2017-2984 CVE-2017-2985 CVE-2017-2987 CVE-2017-2988 CVE-2017-2990 CVE-2017-2991 CVE-2017-2992 CVE-2017-2993 CVE-2017-2994 CVE-2017-2995 CVE-2017-2996 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-177 Summary ======= The package lib32-flashplugin before version 24.0.0.221-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 24.0.0.221-1. # pacman -Syu "lib32-flashplugin>=24.0.0.221-1" The problems have been fixed upstream in version 24.0.0.221. Workaround ========== None. Description =========== - CVE-2017-2982 (arbitrary code execution) A use-after-free vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2984 (arbitrary code execution) A heap-based buffer overflow vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2985 (arbitrary code execution) A use-after-free vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2987 (arbitrary code execution) An integer overflow vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2988 (arbitrary code execution) A memory corruption vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2990 (arbitrary code execution) A memory corruption vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2991 (arbitrary code execution) A memory corruption vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2992 (arbitrary code execution) A heap-based buffer overflow vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2993 (arbitrary code execution) A use-after-free vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2994 (arbitrary code execution) A use-after-free vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2995 (arbitrary code execution) A type confusion vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2996 (arbitrary code execution) A memory corruption vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-04.html https://security.archlinux.org/CVE-2017-2982 https://security.archlinux.org/CVE-2017-2984 https://security.archlinux.org/CVE-2017-2985 https://security.archlinux.org/CVE-2017-2987 https://security.archlinux.org/CVE-2017-2988 https://security.archlinux.org/CVE-2017-2990 https://security.archlinux.org/CVE-2017-2991 https://security.archlinux.org/CVE-2017-2992 https://security.archlinux.org/CVE-2017-2993 https://security.archlinux.org/CVE-2017-2994 https://security.archlinux.org/CVE-2017-2995 https://security.archlinux.org/CVE-2017-2996

1 0

[arch-security] [ASA-201702-15] flashplugin: arbitrary code execution
by Remi Gacogne 17 Feb '17

17 Feb '17

Arch Linux Security Advisory ASA-201702-15 ========================================== Severity: Critical Date : 2017-02-17 CVE-ID : CVE-2017-2982 CVE-2017-2984 CVE-2017-2985 CVE-2017-2987 CVE-2017-2988 CVE-2017-2990 CVE-2017-2991 CVE-2017-2992 CVE-2017-2993 CVE-2017-2994 CVE-2017-2995 CVE-2017-2996 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-176 Summary ======= The package flashplugin before version 24.0.0.221-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 24.0.0.221-1. # pacman -Syu "flashplugin>=24.0.0.221-1" The problems have been fixed upstream in version 24.0.0.221. Workaround ========== None. Description =========== - CVE-2017-2982 (arbitrary code execution) A use-after-free vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2984 (arbitrary code execution) A heap-based buffer overflow vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2985 (arbitrary code execution) A use-after-free vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2987 (arbitrary code execution) An integer overflow vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2988 (arbitrary code execution) A memory corruption vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2990 (arbitrary code execution) A memory corruption vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2991 (arbitrary code execution) A memory corruption vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2992 (arbitrary code execution) A heap-based buffer overflow vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2993 (arbitrary code execution) A use-after-free vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2994 (arbitrary code execution) A use-after-free vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2995 (arbitrary code execution) A type confusion vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. - CVE-2017-2996 (arbitrary code execution) A memory corruption vulnerability possibly leading to code execution has been found in Adobe Flash Player < 24.0.0.221. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-04.html https://security.archlinux.org/CVE-2017-2982 https://security.archlinux.org/CVE-2017-2984 https://security.archlinux.org/CVE-2017-2985 https://security.archlinux.org/CVE-2017-2987 https://security.archlinux.org/CVE-2017-2988 https://security.archlinux.org/CVE-2017-2990 https://security.archlinux.org/CVE-2017-2991 https://security.archlinux.org/CVE-2017-2992 https://security.archlinux.org/CVE-2017-2993 https://security.archlinux.org/CVE-2017-2994 https://security.archlinux.org/CVE-2017-2995 https://security.archlinux.org/CVE-2017-2996

1 0

[arch-security] [ASA-201702-14] diffoscope: arbitrary file overwrite
by Levente Polyak 17 Feb '17

17 Feb '17

Arch Linux Security Advisory ASA-201702-14 ========================================== Severity: Medium Date : 2017-02-17 CVE-ID : CVE-2017-0359 Package : diffoscope Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-175 Summary ======= The package diffoscope before version 77-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 77-1. # pacman -Syu "diffoscope>=77-1" The problem has been fixed upstream in version 77. Workaround ========== None. Description =========== It has been discovered that diffoscope may write to arbitrary locations on disk depending on the contents of an untrusted archive. Impact ====== An attacker is able to create a specially crafted archive that, when processed, overwrites arbitrary files on disc. References ========== https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723 https://anonscm.debian.org/git/reproducible/diffoscope.git/commit/?id=632a4… https://security.archlinux.org/CVE-2017-0359

1 0

[arch-security] [ASA-201702-13] vim: arbitrary code execution
by Levente Polyak 15 Feb '17

15 Feb '17

Arch Linux Security Advisory ASA-201702-13 ========================================== Severity: Medium Date : 2017-02-15 CVE-ID : CVE-2017-5953 Package : vim Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-174 Summary ======= The package vim before version 8.0.0322-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.0.0322-1. # pacman -Syu "vim>=8.0.0322-1" The problem has been fixed upstream in version 8.0.0322. Workaround ========== None. Description =========== It was found that vim does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow. Impact ====== An attacker is able to execute arbitrary code on the affected host by tricking a user to use a specially crafted spell file. References ========== https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d https://groups.google.com/forum/#%21topic/vim_dev/t-3RSdEnrHY https://security.archlinux.org/CVE-2017-5953

1 0

[arch-security] [ASA-201702-12] gvim: arbitrary code execution
by Levente Polyak 15 Feb '17

15 Feb '17

Arch Linux Security Advisory ASA-201702-12 ========================================== Severity: Medium Date : 2017-02-15 CVE-ID : CVE-2017-5953 Package : gvim Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-174 Summary ======= The package gvim before version 8.0.0322-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.0.0322-1. # pacman -Syu "gvim>=8.0.0322-1" The problem has been fixed upstream in version 8.0.0322. Workaround ========== None. Description =========== It was found that vim does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow. Impact ====== An attacker is able to execute arbitrary code on the affected host by tricking a user to use a specially crafted spell file. References ========== https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d https://groups.google.com/forum/#%21topic/vim_dev/t-3RSdEnrHY https://security.archlinux.org/CVE-2017-5953

1 0

[arch-security] [ASA-201702-11] kdenetwork-kopete: content spoofing
by Remi Gacogne 12 Feb '17

12 Feb '17

Arch Linux Security Advisory ASA-201702-11 ========================================== Severity: Medium Date : 2017-02-12 CVE-ID : CVE-2017-5593 Package : kdenetwork-kopete Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-173 Summary ======= The package kdenetwork-kopete before version 16.12.2-2 is vulnerable to content spoofing. Resolution ========== Upgrade to 16.12.2-2. # pacman -Syu "kdenetwork-kopete>=16.12.2-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. Impact ====== A remote attacker might impersonate any user, including contacts, by sending a crafted message. References ========== https://rt-solutions.de/en/2017/02/CVE-2017-5589_xmpp_carbons/ http://openwall.com/lists/oss-security/2017/02/09/29 https://security.archlinux.org/CVE-2017-5593

1 0

[arch-security] [ASA-201702-10] ffmpeg: arbitrary code execution
by Remi Gacogne 12 Feb '17

12 Feb '17

Arch Linux Security Advisory ASA-201702-10 ========================================== Severity: Critical Date : 2017-02-12 CVE-ID : CVE-2017-5024 CVE-2017-5025 Package : ffmpeg Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-172 Summary ======= The package ffmpeg before version 1:3.2.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:3.2.4-1. # pacman -Syu "ffmpeg>=1:3.2.4-1" The problems have been fixed upstream in version 3.2.4. Workaround ========== None. Description =========== - CVE-2017-5024 (arbitrary code execution) A heap overflow flaw was found in FFmpeg < 3.2.4. - CVE-2017-5025 (arbitrary code execution) A heap overflow flaw was found in FFmpeg < 3.2.4. Impact ====== An attacker can execute arbitrary code on the affected host via crafted multimedia content. References ========== https://ffmpeg.org/security.html https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-des… https://bugzilla.redhat.com/show_bug.cgi?id=1416675 https://code.google.com/p/chromium/issues/detail?id=643951 https://code.google.com/p/chromium/issues/detail?id=643950 https://bugzilla.redhat.com/show_bug.cgi?id=1416676 https://security.archlinux.org/CVE-2017-5024 https://security.archlinux.org/CVE-2017-5025

1 0