March 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201703-19] chromium: arbitrary code execution
by Remi Gacogne 31 Mar '17

31 Mar '17

Arch Linux Security Advisory ASA-201703-19 ========================================== Severity: Critical Date : 2017-03-31 CVE-ID : CVE-2017-5052 CVE-2017-5053 CVE-2017-5054 CVE-2017-5055 CVE-2017-5056 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-231 Summary ======= The package chromium before version 57.0.2987.133-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 57.0.2987.133-1. # pacman -Syu "chromium>=57.0.2987.133-1" The problems have been fixed upstream in version 57.0.2987.133. Workaround ========== None. Description =========== - CVE-2017-5052 (arbitrary code execution) An invalid cast vulnerability has been found in the Blink component of the Chromium browser. - CVE-2017-5053 (arbitrary code execution) An out of bounds memory access vulnerability has been found in the V8 component of the Chromium browser. - CVE-2017-5054 (arbitrary code execution) A heap buffer overflow vulnerability has been found in the V8 component of the Chromium browser. - CVE-2017-5055 (arbitrary code execution) A use-after-free vulnerability has been found in the printing component of the Chromium browser. - CVE-2017-5056 (arbitrary code execution) A use-after-free vulnerability has been found in the Blink component of the Chromium browser. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=662767 https://bugs.chromium.org/p/chromium/issues/detail?id=702058 https://bugs.chromium.org/p/chromium/issues/detail?id=699166 https://bugs.chromium.org/p/chromium/issues/detail?id=698622 https://bugs.chromium.org/p/chromium/issues/detail?id=705445 https://security.archlinux.org/CVE-2017-5052 https://security.archlinux.org/CVE-2017-5053 https://security.archlinux.org/CVE-2017-5054 https://security.archlinux.org/CVE-2017-5055 https://security.archlinux.org/CVE-2017-5056

1 0

[arch-security] [ASA-201703-18] libpurple: arbitrary code execution
by Levente Polyak 23 Mar '17

23 Mar '17

Arch Linux Security Advisory ASA-201703-18 ========================================== Severity: High Date : 2017-03-21 CVE-ID : CVE-2017-2640 Package : libpurple Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-226 Summary ======= The package libpurple before version 2.12.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.12.0-1. # pacman -Syu "libpurple>=2.12.0-1" The problem has been fixed upstream in version 2.12.0. Workaround ========== None. Description =========== An out-of-bounds write has been found in libpurple < 2.12.0 in the purple_markup_unescape_entity function. This issue can be triggered by a malicious server sending invalid XML entities separated by whitespace, eg "ஸ" to the client. Impact ====== A remote attacker is able to execute arbitrary code on the affected host if it connects to a malicious server. References ========== http://seclists.org/fulldisclosure/2017/Mar/57 https://www.pidgin.im/news/security/?id=109 https://bitbucket.org/pidgin/main/commits/b2fc9e774cb9 https://security.archlinux.org/CVE-2017-2640

1 0

[arch-security] [ASA-201703-17] irssi: arbitrary code execution
by Santiago Torres-Arias 21 Mar '17

21 Mar '17

Arch Linux Security Advisory ASA-201703-17 ========================================== Severity: High Date : 2017-03-21 CVE-ID : CVE-2017-7191 Package : irssi Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-224 Summary ======= The package irssi before version 1.0.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.0.2-1. # pacman -Syu "irssi>=1.0.2-1" The problem has been fixed upstream in version 1.0.2. Workaround ========== None. Description =========== A use after free vulnerability has been discovered in irssi < 1.0.2 while producing a list of netjoins that can result in arbitrary code execution. Impact ====== A malicious attacker is able to crash the irssi process or execute arbitrary code on the host by forcing a server disconnection during a netsplit. References ========== https://irssi.org/security/irssi_sa_2017_03.txt https://security.archlinux.org/CVE-2017-7191

1 0

[arch-security] [ASA-201703-16] mbedtls: arbitrary code execution
by Remi Gacogne 20 Mar '17

20 Mar '17

Arch Linux Security Advisory ASA-201703-16 ========================================== Severity: Critical Date : 2017-03-20 CVE-ID : CVE-2017-2784 Package : mbedtls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-198 Summary ======= The package mbedtls before version 2.4.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.4.2-1. # pacman -Syu "mbedtls>=2.4.2-1" The problem has been fixed upstream in version 2.4.2. Workaround ========== None. Description =========== A security issue has been found in mbed TLS < 2.4.2. If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application. Impact ====== A remote attacker can cause a denial of service or execute arbitrary code on the affected host via a crafted certificate. References ========== https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://security.archlinux.org/CVE-2017-2784

1 0

[arch-security] [ASA-201703-15] firefox: arbitrary code execution
by Remi Gacogne 20 Mar '17

20 Mar '17

Arch Linux Security Advisory ASA-201703-15 ========================================== Severity: High Date : 2017-03-18 CVE-ID : CVE-2017-5428 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-219 Summary ======= The package firefox before version 52.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 52.0.1-1. # pacman -Syu "firefox>=52.0.1-1" The problem has been fixed upstream in version 52.0.1. Workaround ========== None. Description =========== An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/#CVE-2017-5428 https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 https://security.archlinux.org/CVE-2017-5428

1 0

[arch-security] [ASA-201703-14] wordpress: multiple issues
by Remi Gacogne 18 Mar '17

18 Mar '17

Arch Linux Security Advisory ASA-201703-14 ========================================== Severity: Medium Date : 2017-03-16 CVE-ID : CVE-2017-6814 CVE-2017-6815 CVE-2017-6816 CVE-2017-6817 CVE-2017-6818 CVE-2017-6819 Package : wordpress Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-202 Summary ======= The package wordpress before version 4.7.3-1 is vulnerable to multiple issues including cross-site request forgery, cross-site scripting and insufficient validation. Resolution ========== Upgrade to 4.7.3-1. # pacman -Syu "wordpress>=4.7.3-1" The problems have been fixed upstream in version 4.7.3. Workaround ========== None. Description =========== - CVE-2017-6814 (cross-site scripting) An authenticated cross-site scripting (XSS) vulnerability has been discovered in WordPress before 4.7.3 via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp- includes/js/mediaelement/wp-playlist.js. - CVE-2017-6815 (insufficient validation) A vulnerability has been discovered in WordPress before 4.7.3 (wp- includes/pluggable.php) that certain control characters can trick redirect URL validation. - CVE-2017-6816 (insufficient validation) It has been discovered that unintended files can be deleted by administrators in WordPress before 4.7.3 (wp-admin/plugins.php) using the plugin deletion functionality. - CVE-2017-6817 (cross-site scripting) An authenticated cross-site scripting (XSS) vulnerability has been discovered in in WordPress before 4.7.3 (wp-includes/embed.php) via YouTube URL Embeds. - CVE-2017-6818 (cross-site scripting) A cross-site scripting (XSS) vulnerability has been discovered in WordPress before 4.7.3 (wp-admin/js/tags-box.js) via taxonomy term names. - CVE-2017-6819 (cross-site request forgery) A cross-site request forgery (CSRF) vulnerability exists on the Press This page of WordPress. This issue can be used to create a Denial of Service (DoS) condition if an authenticated administrator visits a malicious URL. Impact ====== A remote attacker is able to execute arbitrary javascript on the clients machine or perform a denial of service attack against the server by tricking an administrator to visit a certain site. Furthermore a malicious administrator is able to delete unintended files from the server. References ========== https://codex.wordpress.org/Version_4.7.3 https://github.com/WordPress/WordPress/commit/28f838ca3ee205b6f39cd2bf23eb4… https://sumofpwn.nl/advisory/2016/wordpress_audio_playlist_functionality_is… https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance… https://github.com/WordPress/WordPress/commit/288cd469396cfe7055972b457eb58… https://github.com/WordPress/WordPress/commit/4d80f8b3e1b00a3edcee0774dc9c2… https://github.com/WordPress/WordPress/commit/419c8d97ce8df7d5004ee0b566bc5… https://github.com/WordPress/WordPress/commit/9092fd01e1f452f37c313d38b18f9… https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_p… https://github.com/WordPress/WordPress/commit/263831a72d08556bc2f3a328673d9… https://security.archlinux.org/CVE-2017-6814 https://security.archlinux.org/CVE-2017-6815 https://security.archlinux.org/CVE-2017-6816 https://security.archlinux.org/CVE-2017-6817 https://security.archlinux.org/CVE-2017-6818 https://security.archlinux.org/CVE-2017-6819

1 0

[arch-security] [ASA-201703-13] linux-zen: privilege escalation
by Levente Polyak 16 Mar '17

16 Mar '17

Arch Linux Security Advisory ASA-201703-13 ========================================== Severity: High Date : 2017-03-16 CVE-ID : CVE-2017-2636 Package : linux-zen Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-203 Summary ======= The package linux-zen before version 4.10.2-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.10.2-1. # pacman -Syu "linux-zen>=4.10.2-1" The problem has been fixed upstream in version 4.10.2. Workaround ========== # echo "install n_hdlc /bin/true" >> /etc/modprobe.d/disable- n_hdlc.conf Description =========== A race condition flaw was found in the N_HLDC Linux kernel driver when accessing the n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to crash the system or increase their privileges on the system. Impact ====== A local attacker is able to escalate privileges or crash the system. References ========== https://bugs.archlinux.org/task/53242 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… http://seclists.org/oss-sec/2017/q1/569 https://security.archlinux.org/CVE-2017-2636

1 0

[arch-security] [ASA-201703-12] lib32-flashplugin: multiple issues
by Remi Gacogne 15 Mar '17

15 Mar '17

Arch Linux Security Advisory ASA-201703-12 ========================================== Severity: Critical Date : 2017-03-15 CVE-ID : CVE-2017-2997 CVE-2017-2998 CVE-2017-2999 CVE-2017-3000 CVE-2017-3001 CVE-2017-3002 CVE-2017-3003 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-209 Summary ======= The package lib32-flashplugin before version 25.0.0.127-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 25.0.0.127-1. # pacman -Syu "lib32-flashplugin>=25.0.0.127-1" The problems have been fixed upstream in version 25.0.0.127. Workaround ========== None. Description =========== - CVE-2017-2997 (arbitrary code execution) A buffer overflow vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-2998 (arbitrary code execution) A memory corruption vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-2999 (arbitrary code execution) A memory corruption vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3000 (information disclosure) A random number generator vulnerability used for constant blinding that could lead to information disclosure has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3001 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3002 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3003 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-07.html https://security.archlinux.org/CVE-2017-2997 https://security.archlinux.org/CVE-2017-2998 https://security.archlinux.org/CVE-2017-2999 https://security.archlinux.org/CVE-2017-3000 https://security.archlinux.org/CVE-2017-3001 https://security.archlinux.org/CVE-2017-3002 https://security.archlinux.org/CVE-2017-3003

1 0

[arch-security] [ASA-201703-11] flashplugin: multiple issues
by Remi Gacogne 15 Mar '17

15 Mar '17

Arch Linux Security Advisory ASA-201703-11 ========================================== Severity: Critical Date : 2017-03-15 CVE-ID : CVE-2017-2997 CVE-2017-2998 CVE-2017-2999 CVE-2017-3000 CVE-2017-3001 CVE-2017-3002 CVE-2017-3003 Package : flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-208 Summary ======= The package flashplugin before version 25.0.0.127-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 25.0.0.127-1. # pacman -Syu "flashplugin>=25.0.0.127-1" The problems have been fixed upstream in version 25.0.0.127. Workaround ========== None. Description =========== - CVE-2017-2997 (arbitrary code execution) A buffer overflow vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-2998 (arbitrary code execution) A memory corruption vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-2999 (arbitrary code execution) A memory corruption vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3000 (information disclosure) A random number generator vulnerability used for constant blinding that could lead to information disclosure has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3001 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3002 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3003 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-07.html https://security.archlinux.org/CVE-2017-2997 https://security.archlinux.org/CVE-2017-2998 https://security.archlinux.org/CVE-2017-2999 https://security.archlinux.org/CVE-2017-3000 https://security.archlinux.org/CVE-2017-3001 https://security.archlinux.org/CVE-2017-3002 https://security.archlinux.org/CVE-2017-3003

1 0

[arch-security] [ASA-201703-10] roundcubemail: cross-site scripting
by Levente Polyak 14 Mar '17

14 Mar '17

Arch Linux Security Advisory ASA-201703-10 ========================================== Severity: Medium Date : 2017-03-14 CVE-ID : CVE-2017-6820 Package : roundcubemail Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-199 Summary ======= The package roundcubemail before version 1.2.4-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.2.4-1. # pacman -Syu "roundcubemail>=1.2.4-1" The problem has been fixed upstream in version 1.2.4. Workaround ========== None. Description =========== It has been discovered that rcube_utils.php in Roundcube before 1.1.8 and before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element. Impact ====== A remote attacker is able to use a specially crafted SVG file to execute arbitrary javascript on the client's machine. References ========== http://seclists.org/oss-sec/2017/q1/583 https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797f… https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db0… https://security.archlinux.org/CVE-2017-6820

1 0