February 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201702-9] webkit2gtk: multiple issues
by Remi Gacogne 11 Feb '17

11 Feb '17

Arch Linux Security Advisory ASA-201702-9 ========================================= Severity: Critical Date : 2017-02-11 CVE-ID : CVE-2017-2350 CVE-2017-2354 CVE-2017-2355 CVE-2017-2356 CVE-2017-2362 CVE-2017-2363 CVE-2017-2364 CVE-2017-2365 CVE-2017-2366 CVE-2017-2369 CVE-2017-2371 CVE-2017-2373 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-170 Summary ======= The package webkit2gtk before version 2.14.4-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass and information disclosure. Resolution ========== Upgrade to 2.14.4-1. # pacman -Syu "webkit2gtk>=2.14.4-1" The problems have been fixed upstream in version 2.14.4. Workaround ========== None. Description =========== - CVE-2017-2350 (information disclosure) A security issue has been found in WebKitGTK+ before 2.14.4, where processing maliciously crafted web content may exfiltrate data cross- origin. - CVE-2017-2354 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2355 (arbitrary code execution) A memory initialization issue has been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2356 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2362 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2363 (information disclosure) Multiple validation issues have been found in the handling of page loading in WebKitGTK+ before 2.14.4, leading to cross-origin data exfiltration while processing maliciously crafted web content. - CVE-2017-2364 (information disclosure) Multiple validation issues have been found in the handling of page loading in WebKitGTK+ before 2.14.4, leading to cross-origin data exfiltration while processing maliciously crafted web content. - CVE-2017-2365 (information disclosure) A validation issue has been found in variable handling in WebKitGTK+ before 2.14.4, leading to cross-origin data exfiltration while processing maliciously crafted web content. - CVE-2017-2366 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2369 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. - CVE-2017-2371 (access restriction bypass) An issue has been found in the handling of blocking popups in WebKitGTK+ before 2.14.4, allowing a malicious website to open popups. - CVE-2017-2373 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ before 2.14.4, leading to arbitrary code execution while processing maliciously crafted web content. Impact ====== A remote attacker can access sensitive information, bypass access restrictions to open popups, or execute arbitrary code on the affected host via maliciously crafted web content. References ========== https://webkitgtk.org/security/WSA-2017-0002.html https://security.archlinux.org/CVE-2017-2350 https://security.archlinux.org/CVE-2017-2354 https://security.archlinux.org/CVE-2017-2355 https://security.archlinux.org/CVE-2017-2356 https://security.archlinux.org/CVE-2017-2362 https://security.archlinux.org/CVE-2017-2363 https://security.archlinux.org/CVE-2017-2364 https://security.archlinux.org/CVE-2017-2365 https://security.archlinux.org/CVE-2017-2366 https://security.archlinux.org/CVE-2017-2369 https://security.archlinux.org/CVE-2017-2371 https://security.archlinux.org/CVE-2017-2373

1 0

[arch-security] [ASA-201702-8] bind: denial of service
by Remi Gacogne 10 Feb '17

10 Feb '17

Arch Linux Security Advisory ASA-201702-8 ========================================= Severity: High Date : 2017-02-09 CVE-ID : CVE-2017-3135 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-169 Summary ======= The package bind before version 9.11.0.P3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.0.P3-1. # pacman -Syu "bind>=9.11.0.P3-1" The problem has been fixed upstream in version 9.11.0.P3. Workaround ========== None. Description =========== A vulnerability has been found in bind < 9.11.0-P3, allowing a remote attacker to trigger an INSIST assertion failure or a NULL pointer read in configurations using both DNS64 and RPZ. Impact ====== A remote unauthenticated attacker can crash a vulnerable server, resulting in denial of service. References ========== https://kb.isc.org/article/AA-01453 https://security.archlinux.org/CVE-2017-3135

1 0

[arch-security] [ASA-201702-7] gstreamer: denial of service
by Remi Gacogne 05 Feb '17

05 Feb '17

Arch Linux Security Advisory ASA-201702-7 ========================================= Severity: Low Date : 2017-02-03 CVE-ID : CVE-2017-5838 Package : gstreamer Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-167 Summary ======= The package gstreamer before version 1.10.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.10.3-1. # pacman -Syu "gstreamer>=1.10.3-1" The problem has been fixed upstream in version 1.10.3. Workaround ========== None. Description =========== An out of bounds read has been found in gstreamer before 1.10.3, in gst_date_time_new_from_iso8601_string. Impact ====== A remote attacker can crash gstreamer via a crafted file. References ========== http://seclists.org/oss-sec/2017/q1/284 https://bugzilla.gnome.org/show_bug.cgi?id=777263 https://security.archlinux.org/CVE-2017-5838

1 0

[arch-security] [ASA-201702-6] gst-plugins-ugly: denial of service
by Remi Gacogne 05 Feb '17

05 Feb '17

Arch Linux Security Advisory ASA-201702-6 ========================================= Severity: Low Date : 2017-02-03 CVE-ID : CVE-2017-5846 CVE-2017-5847 Package : gst-plugins-ugly Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-166 Summary ======= The package gst-plugins-ugly before version 1.10.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.10.3-1. # pacman -Syu "gst-plugins-ugly>=1.10.3-1" The problems have been fixed upstream in version 1.10.3. Workaround ========== None. Description =========== - CVE-2017-5846 (denial of service) An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_asf_demux_process_ext_stream_props. - CVE-2017-5847 (denial of service) An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_asf_demux_process_ext_content_desc. Impact ====== A remote attacker can crash gstreamer via a crafted file. References ========== http://seclists.org/oss-sec/2017/q1/284 https://bugzilla.gnome.org/show_bug.cgi?id=777937 https://bugzilla.gnome.org/show_bug.cgi?id=777955 https://security.archlinux.org/CVE-2017-5846 https://security.archlinux.org/CVE-2017-5847

1 0

[arch-security] [ASA-201702-5] gst-plugins-bad: multiple issues
by Remi Gacogne 05 Feb '17

05 Feb '17

Arch Linux Security Advisory ASA-201702-5 ========================================= Severity: Critical Date : 2017-02-03 CVE-ID : CVE-2017-5843 CVE-2017-5848 Package : gst-plugins-bad Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-165 Summary ======= The package gst-plugins-bad before version 1.10.3-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.10.3-1. # pacman -Syu "gst-plugins-bad>=1.10.3-1" The problems have been fixed upstream in version 1.10.3. Workaround ========== None. Description =========== - CVE-2017-5843 (arbitrary code execution) A double-free issue has been found in gstreamer before 1.10.3, in gst_mxf_demux_update_essence_tracks. - CVE-2017-5848 (denial of service) An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_ps_demux_parse_psm. Impact ====== A remote attacker can crash gstreamer or execute arbitrary code on the affected host via a crafted file. References ========== http://seclists.org/oss-sec/2017/q1/284 https://bugzilla.gnome.org/show_bug.cgi?id=777503 https://bugzilla.gnome.org/show_bug.cgi?id=777957 https://security.archlinux.org/CVE-2017-5843 https://security.archlinux.org/CVE-2017-5848

1 0

[arch-security] [ASA-201702-4] gst-plugins-base-libs: multiple issues
by Remi Gacogne 05 Feb '17

05 Feb '17

Arch Linux Security Advisory ASA-201702-4 ========================================= Severity: Critical Date : 2017-02-03 CVE-ID : CVE-2017-5837 CVE-2017-5839 CVE-2017-5842 CVE-2017-5844 Package : gst-plugins-base-libs Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-164 Summary ======= The package gst-plugins-base-libs before version 1.10.3-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.10.3-1. # pacman -Syu "gst-plugins-base-libs>=1.10.3-1" The problems have been fixed upstream in version 1.10.3. Workaround ========== None. Description =========== - CVE-2017-5837 (denial of service) A floating point exception issue has been found in gstreamer before 1.10.3, in gst_riff_create_audio_caps. - CVE-2017-5839 (denial of service) An endless recursion issue leading to stack overflow has been found in gstreamer before 1.10.3, in gst_riff_create_audio_caps. - CVE-2017-5842 (arbitrary code execution) An off-by-one write has been found in gstreamer before 1.10.3, in html_context_handle_element. - CVE-2017-5844 (denial of service) A floating point exception issue has been found in gstreamer before 1.10.3, in gst_riff_create_audio_caps. Impact ====== A remote attacker can crash gstreamer or execute arbitrary code on the affected host via a crafted file. References ========== http://seclists.org/oss-sec/2017/q1/284 https://bugzilla.gnome.org/show_bug.cgi?id=777262 https://bugzilla.gnome.org/show_bug.cgi?id=777265 https://bugzilla.gnome.org/show_bug.cgi?id=777502 https://bugzilla.gnome.org/show_bug.cgi?id=777525 https://security.archlinux.org/CVE-2017-5837 https://security.archlinux.org/CVE-2017-5839 https://security.archlinux.org/CVE-2017-5842 https://security.archlinux.org/CVE-2017-5844

1 0

[arch-security] [ASA-201702-3] gst-plugins-good: denial of service
by Remi Gacogne 05 Feb '17

05 Feb '17

Arch Linux Security Advisory ASA-201702-3 ========================================= Severity: Low Date : 2017-02-03 CVE-ID : CVE-2016-10198 CVE-2016-10199 CVE-2017-5840 CVE-2017-5841 CVE-2017-5845 Package : gst-plugins-good Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-163 Summary ======= The package gst-plugins-good before version 1.10.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.10.3-1. # pacman -Syu "gst-plugins-good>=1.10.3-1" The problems have been fixed upstream in version 1.10.3. Workaround ========== None. Description =========== - CVE-2016-10198 (denial of service) An invalid memory read flaw has been found in gstreamer before 1.10.3, in gst_aac_parse_sink_setcaps. - CVE-2016-10199 (denial of service) An out of bounds read has been found in gstreamer before 1.10.3, in qtdemux_tag_add_str_full. - CVE-2017-5840 (denial of service) An out-of-bounds read has been found in gstreamer before 1.10.3, in qtdemux_parse_samples. - CVE-2017-5841 (denial of service) An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_avi_demux_parse_ncdt. - CVE-2017-5845 (denial of service) An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_avi_demux_parse_ncdt. Impact ====== A remote attacker can crash gstreamer via a crafted file. References ========== http://seclists.org/oss-sec/2017/q1/284 https://bugzilla.gnome.org/show_bug.cgi?id=775450 https://bugzilla.gnome.org/show_bug.cgi?id=775451 https://bugzilla.gnome.org/show_bug.cgi?id=777469 https://bugzilla.gnome.org/show_bug.cgi?id=777500 https://bugzilla.gnome.org/show_bug.cgi?id=777532 https://security.archlinux.org/CVE-2016-10198 https://security.archlinux.org/CVE-2016-10199 https://security.archlinux.org/CVE-2017-5840 https://security.archlinux.org/CVE-2017-5841 https://security.archlinux.org/CVE-2017-5845

1 0

[arch-security] [ASA-201702-2] qt5-webengine: multiple issues
by Remi Gacogne 02 Feb '17

02 Feb '17

Arch Linux Security Advisory ASA-201702-2 ========================================= Severity: High Date : 2017-02-02 CVE-ID : CVE-2016-5182 CVE-2016-5183 CVE-2016-5189 CVE-2016-5199 CVE-2016-5201 CVE-2016-5203 CVE-2016-5204 CVE-2016-5205 CVE-2016-5206 CVE-2016-5207 CVE-2016-5208 CVE-2016-5210 CVE-2016-5211 CVE-2016-5212 CVE-2016-5213 CVE-2016-5214 CVE-2016-5215 CVE-2016-5216 CVE-2016-5217 CVE-2016-5218 CVE-2016-5219 CVE-2016-5221 CVE-2016-5222 CVE-2016-5223 CVE-2016-5224 CVE-2016-5225 CVE-2016-9650 CVE-2016-9651 Package : qt5-webengine Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-162 Summary ======= The package qt5-webengine before version 5.8.0-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, arbitrary filesystem access, cross-site scripting, same- origin policy bypass, content spoofing, information disclosure and insufficient validation. Resolution ========== Upgrade to 5.8.0-1. # pacman -Syu "qt5-webengine>=5.8.0-1" The problems have been fixed upstream in version 5.8.0. Workaround ========== None. Description =========== - CVE-2016-5182 (arbitrary code execution) A heap overflow flaw was found in the Blink component of the Chromium browser. - CVE-2016-5183 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5189 (content spoofing) An URL spoofing flaw was found in the Chromium browser. - CVE-2016-5199 (arbitrary code execution) FFMPEG MP4 decoder contains an off-by-one error resulting in an allocation of size 0, followed by corrupting an arbitrary number of pointers out of bounds on the heap, where each is pointing to controllable or uninitialized data. A remote attacker can potentially use this flaw to exploit heap corruption via a crafted video file. - CVE-2016-5201 (information disclosure) An information disclosure flaw was found in the extensions component of the Chromium browser before 54.0.2840.100. - CVE-2016-5203 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5204 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5205 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5206 (same-origin policy bypass) A same-origin bypass flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5207 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5208 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5210 (arbitrary code execution) An out of bounds write flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5211 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5212 (arbitrary filesystem access) A local file disclosure flaw was found in the DevTools component of the Chromium browser. - CVE-2016-5213 (arbitrary code execution) An use after free flaw was found in the V8 component of the Chromium browser. - CVE-2016-5214 (insufficient validation) A file download protection bypass was discovered in the Chromium browser. - CVE-2016-5215 (arbitrary code execution) An use after free flaw was found in the Webaudio component of the Chromium browser. - CVE-2016-5216 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5217 (insufficient validation) An use of unvalidated data flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5218 (content spoofing) An address spoofing flaw was found in the Omnibox component of the Chromium browser. - CVE-2016-5219 (arbitrary code execution) An use after free flaw was found in the V8 component of the Chromium browser. - CVE-2016-5221 (arbitrary code execution) An integer overflow flaw was found in the ANGLE component of the Chromium browser. - CVE-2016-5222 (content spoofing) An address spoofing flaw was found in the Omnibox component of the Chromium browser. - CVE-2016-5223 (arbitrary code execution) An integer overflow flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5224 (same-origin policy bypass) A same-origin bypass flaw was found in the SVG component of the Chromium browser. - CVE-2016-5225 (access restriction bypass) A CSP bypass flaw was found in the Blink component of the Chromium browser. - CVE-2016-9650 (information disclosure) A CSP referrer disclosure vulnerability has been discovered in the Chromium browser. - CVE-2016-9651 (access restriction bypass) A private property access flaw was found in the V8 component of the Chromium browser. Impact ====== A remote attacker might be able to bypass access restrictions, access sensitive information or files, and execute arbitrary code on the affected host. References ========== https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.8.0 https://googlechromereleases.blogspot.fr/2016/10/stable-channel-update-for-… https://chromereleases.googleblog.com/2016/11/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=643948 https://bugs.chromium.org/p/chromium/issues/detail?id=660678 https://googlechromereleases.blogspot.fr/2016/12/stable-channel-update-for-… https://security.archlinux.org/CVE-2016-5182 https://security.archlinux.org/CVE-2016-5183 https://security.archlinux.org/CVE-2016-5189 https://security.archlinux.org/CVE-2016-5199 https://security.archlinux.org/CVE-2016-5201 https://security.archlinux.org/CVE-2016-5203 https://security.archlinux.org/CVE-2016-5204 https://security.archlinux.org/CVE-2016-5205 https://security.archlinux.org/CVE-2016-5206 https://security.archlinux.org/CVE-2016-5207 https://security.archlinux.org/CVE-2016-5208 https://security.archlinux.org/CVE-2016-5210 https://security.archlinux.org/CVE-2016-5211 https://security.archlinux.org/CVE-2016-5212 https://security.archlinux.org/CVE-2016-5213 https://security.archlinux.org/CVE-2016-5214 https://security.archlinux.org/CVE-2016-5215 https://security.archlinux.org/CVE-2016-5216 https://security.archlinux.org/CVE-2016-5217 https://security.archlinux.org/CVE-2016-5218 https://security.archlinux.org/CVE-2016-5219 https://security.archlinux.org/CVE-2016-5221 https://security.archlinux.org/CVE-2016-5222 https://security.archlinux.org/CVE-2016-5223 https://security.archlinux.org/CVE-2016-5224 https://security.archlinux.org/CVE-2016-5225 https://security.archlinux.org/CVE-2016-9650 https://security.archlinux.org/CVE-2016-9651

1 0

[arch-security] [ASA-201702-1] tcpdump: arbitrary code execution
by Remi Gacogne 02 Feb '17

02 Feb '17

Arch Linux Security Advisory ASA-201702-1 ========================================= Severity: Critical Date : 2017-02-02 CVE-ID : CVE-2016-7922 CVE-2016-7923 CVE-2016-7924 CVE-2016-7925 CVE-2016-7926 CVE-2016-7927 CVE-2016-7928 CVE-2016-7929 CVE-2016-7930 CVE-2016-7931 CVE-2016-7932 CVE-2016-7933 CVE-2016-7934 CVE-2016-7935 CVE-2016-7936 CVE-2016-7937 CVE-2016-7938 CVE-2016-7939 CVE-2016-7940 CVE-2016-7973 CVE-2016-7974 CVE-2016-7975 CVE-2016-7983 CVE-2016-7984 CVE-2016-7985 CVE-2016-7986 CVE-2016-7992 CVE-2016-7993 CVE-2016-8574 CVE-2016-8575 CVE-2017-5202 CVE-2017-5203 CVE-2017-5204 CVE-2017-5205 CVE-2017-5341 CVE-2017-5342 CVE-2017-5482 CVE-2017-5483 CVE-2017-5484 CVE-2017-5485 CVE-2017-5486 Package : tcpdump Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-161 Summary ======= The package tcpdump before version 4.9.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.9.0-1. # pacman -Syu "tcpdump>=4.9.0-1" The problems have been fixed upstream in version 4.9.0. Workaround ========== None. Description =========== - CVE-2016-7922 (arbitrary code execution) The AH parser in tcpdump before 4.9.0 has a buffer overflow in print- ah.c:ah_print(). - CVE-2016-7923 (arbitrary code execution) The ARP parser in tcpdump before 4.9.0 has a buffer overflow in print- arp.c:arp_print(). - CVE-2016-7924 (arbitrary code execution) The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print- atm.c:oam_print(). - CVE-2016-7925 (arbitrary code execution) The compressed SLIP parser in tcpdump before 4.9.0 has a buffer overflow in print-sl.c:sl_if_print(). - CVE-2016-7926 (arbitrary code execution) The Ethernet parser in tcpdump before 4.9.0 has a buffer overflow in print-ether.c:ethertype_print(). - CVE-2016-7927 (arbitrary code execution) The IEEE 802.11 parser in tcpdump before 4.9.0 has a buffer overflow in print-802_11.c:ieee802_11_radio_print(). - CVE-2016-7928 (arbitrary code execution) The IPComp parser in tcpdump before 4.9.0 has a buffer overflow in print-ipcomp.c:ipcomp_print(). - CVE-2016-7929 (arbitrary code execution) The Juniper PPPoE ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-juniper.c:juniper_parse_header(). - CVE-2016-7930 (arbitrary code execution) The LLC/SNAP parser in tcpdump before 4.9.0 has a buffer overflow in print-llc.c:llc_print(). - CVE-2016-7931 (arbitrary code execution) The MPLS parser in tcpdump before 4.9.0 has a buffer overflow in print- mpls.c:mpls_print(). - CVE-2016-7932 (arbitrary code execution) The PIM parser in tcpdump before 4.9.0 has a buffer overflow in print- pim.c:pimv2_check_checksum(). - CVE-2016-7933 (arbitrary code execution) The PPP parser in tcpdump before 4.9.0 has a buffer overflow in print- ppp.c:ppp_hdlc_if_print(). - CVE-2016-7934 (arbitrary code execution) The RTCP parser in tcpdump before 4.9.0 has a buffer overflow in print- udp.c:rtcp_print(). - CVE-2016-7935 (arbitrary code execution) The RTP parser in tcpdump before 4.9.0 has a buffer overflow in print- udp.c:rtp_print(). - CVE-2016-7936 (arbitrary code execution) The UDP parser in tcpdump before 4.9.0 has a buffer overflow in print- udp.c:udp_print(). - CVE-2016-7937 (arbitrary code execution) The VAT parser in tcpdump before 4.9.0 has a buffer overflow in print- udp.c:vat_print(). - CVE-2016-7938 (arbitrary code execution) The ZeroMQ parser in tcpdump before 4.9.0 has an integer overflow in print-zeromq.c:zmtp1_print_frame(). - CVE-2016-7939 (arbitrary code execution) The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print- gre.c, multiple functions. - CVE-2016-7940 (arbitrary code execution) The STP parser in tcpdump before 4.9.0 has a buffer overflow in print- stp.c, multiple functions. - CVE-2016-7973 (arbitrary code execution) The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions. - CVE-2016-7974 (arbitrary code execution) The IP parser in tcpdump before 4.9.0 has a buffer overflow in print- ip.c, multiple functions. - CVE-2016-7975 (arbitrary code execution) The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print- tcp.c:tcp_print(). - CVE-2016-7983 (arbitrary code execution) The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print(). - CVE-2016-7984 (arbitrary code execution) The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print- tftp.c:tftp_print(). - CVE-2016-7985 (arbitrary code execution) The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print(). - CVE-2016-7986 (arbitrary code execution) The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions. - CVE-2016-7992 (arbitrary code execution) The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print(). - CVE-2016-7993 (arbitrary code execution) A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM). - CVE-2016-8574 (arbitrary code execution) The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print(). - CVE-2016-8575 (arbitrary code execution) The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482. - CVE-2017-5202 (arbitrary code execution) The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print(). - CVE-2017-5203 (arbitrary code execution) The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print(). - CVE-2017-5204 (arbitrary code execution) The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print- ip6.c:ip6_print(). - CVE-2017-5205 (arbitrary code execution) The ISAKMP parser in tcpdump before 4.9.0 has a buffer overflow in print-isakmp.c:ikev2_e_print(). - CVE-2017-5341 (arbitrary code execution) The OTV parser in tcpdump before 4.9.0 has a buffer overflow in print- otv.c:otv_print(). - CVE-2017-5342 (arbitrary code execution) In tcpdump before 4.9.0, a bug in multiple protocol parsers (Geneve, GRE, NSH, OTV, VXLAN and VXLAN GPE) could cause a buffer overflow in print-ether.c:ether_print(). - CVE-2017-5482 (arbitrary code execution) The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2016-8575. - CVE-2017-5483 (arbitrary code execution) The SNMP parser in tcpdump before 4.9.0 has a buffer overflow in print- snmp.c:asn1_parse(). - CVE-2017-5484 (arbitrary code execution) The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print- atm.c:sig_print(). - CVE-2017-5485 (arbitrary code execution) The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in addrtoname.c:lookup_nsap(). - CVE-2017-5486 (arbitrary code execution) The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print(). Impact ====== A remote attacker can execute arbitrary code on the affected host by crafting network packets. References ========== https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1494526.h… https://security.archlinux.org/CVE-2016-7922 https://security.archlinux.org/CVE-2016-7923 https://security.archlinux.org/CVE-2016-7924 https://security.archlinux.org/CVE-2016-7925 https://security.archlinux.org/CVE-2016-7926 https://security.archlinux.org/CVE-2016-7927 https://security.archlinux.org/CVE-2016-7928 https://security.archlinux.org/CVE-2016-7929 https://security.archlinux.org/CVE-2016-7930 https://security.archlinux.org/CVE-2016-7931 https://security.archlinux.org/CVE-2016-7932 https://security.archlinux.org/CVE-2016-7933 https://security.archlinux.org/CVE-2016-7934 https://security.archlinux.org/CVE-2016-7935 https://security.archlinux.org/CVE-2016-7936 https://security.archlinux.org/CVE-2016-7937 https://security.archlinux.org/CVE-2016-7938 https://security.archlinux.org/CVE-2016-7939 https://security.archlinux.org/CVE-2016-7940 https://security.archlinux.org/CVE-2016-7973 https://security.archlinux.org/CVE-2016-7974 https://security.archlinux.org/CVE-2016-7975 https://security.archlinux.org/CVE-2016-7983 https://security.archlinux.org/CVE-2016-7984 https://security.archlinux.org/CVE-2016-7985 https://security.archlinux.org/CVE-2016-7986 https://security.archlinux.org/CVE-2016-7992 https://security.archlinux.org/CVE-2016-7993 https://security.archlinux.org/CVE-2016-8574 https://security.archlinux.org/CVE-2016-8575 https://security.archlinux.org/CVE-2017-5202 https://security.archlinux.org/CVE-2017-5203 https://security.archlinux.org/CVE-2017-5204 https://security.archlinux.org/CVE-2017-5205 https://security.archlinux.org/CVE-2017-5341 https://security.archlinux.org/CVE-2017-5342 https://security.archlinux.org/CVE-2017-5482 https://security.archlinux.org/CVE-2017-5483 https://security.archlinux.org/CVE-2017-5484 https://security.archlinux.org/CVE-2017-5485 https://security.archlinux.org/CVE-2017-5486

1 0

[arch-security] [ASA-201701-41] salt: multiple issues
by Santiago Torres-Arias 01 Feb '17

01 Feb '17

Arch Linux Security Advisory ASA-201701-41 ========================================== Severity: High Date : 2017-01-31 CVE-ID : CVE-2017-5192 CVE-2017-5200 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-159 Summary ======= The package salt before version 2016.11.2-1 is vulnerable to multiple issues including arbitrary code execution and arbitrary command execution. Resolution ========== Upgrade to 2016.11.2-1. # pacman -Syu "salt>=2016.11.2-1" The problems have been fixed upstream in version 2016.11.2. Workaround ========== None. Description =========== - CVE-2017-5192 (arbitrary code execution) The `LocalClient.cmd_batch()` method client does not accept `external_auth` credentials and so access to it from salt-api has been removed for now. This vulnerability allows code execution for already- authenticated users and is only in effect when running salt-api as the `root` user. - CVE-2017-5200 (arbitrary command execution) Salt-api allows arbitrary command execution on a salt-master via Salt's ssh_client. Users of Salt-API and salt-ssh could execute a command on the salt master via a hole when both systems were enabled. Impact ====== A remote attacker is able to execute arbitrary commands on a salt master when salt is not configured properly. In addition, an authenticated attacker is able to execute arbitrary code on the salt stack if salt-api is run as root. References ========== https://groups.google.com/forum/#!msg/salt-announce/eP_kQiQdnvo/6cvBrwsqCAAJ https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html https://security.archlinux.org/CVE-2017-5192 https://security.archlinux.org/CVE-2017-5200

1 0