April 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201704-12] curl: certificate verification bypass
by Remi Gacogne 30 Apr '17

30 Apr '17

Arch Linux Security Advisory ASA-201704-12 ========================================== Severity: Medium Date : 2017-04-29 CVE-ID : CVE-2017-7468 Package : curl Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-241 Summary ======= The package curl before version 7.54.0-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 7.54.0-1. # pacman -Syu "curl>=7.54.0-1" The problem has been fixed upstream in version 7.54.0. Workaround ========== None. Description =========== libcurl from 7.52.0 to and including 7.53.1 would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range. Impact ====== An attacker can bypass a client certificate check by taking advantage of TLS session resumption to reuse a previously established session. References ========== https://curl.haxx.se/docs/adv_20170419.html https://security.archlinux.org/CVE-2017-7468

1 0

[arch-security] [ASA-201704-11] bind: denial of service
by Remi Gacogne 30 Apr '17

30 Apr '17

Arch Linux Security Advisory ASA-201704-11 ========================================== Severity: High Date : 2017-04-29 CVE-ID : CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-239 Summary ======= The package bind before version 9.11.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.1-1. # pacman -Syu "bind>=9.11.1-1" The problems have been fixed upstream in version 9.11.1. Workaround ========== None. Description =========== - CVE-2017-3136 (denial of service) A security issue has been found in bind, where an error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;". - CVE-2017-3137 (denial of service) A security issue has been found in bind, where a server which is performing recursion can be forced to exit with an assertion failure if it can be caused to receive a response containing CNAME or DNAME resource records with certain ordering. - CVE-2017-3138 (denial of service) A security issue has been found in the bind named daemon, that will exit with a "require" assertion failure if it receives a null command string on its control channel. The control channel is not enabled by default and is usually restricted to a few remote hosts via an ACL and/or a transaction key. Impact ====== A remote attacker can crash the application, leading to denial of service. References ========== https://deepthought.isc.org/article/AA-01471 https://deepthought.isc.org/article/AA-01465 https://deepthought.isc.org/article/AA-01466 https://security.archlinux.org/CVE-2017-3136 https://security.archlinux.org/CVE-2017-3137 https://security.archlinux.org/CVE-2017-3138

1 0

[arch-security] [ASA-201704-10] libtiff: multiple issues
by Remi Gacogne 28 Apr '17

28 Apr '17

Arch Linux Security Advisory ASA-201704-10 ========================================== Severity: Medium Date : 2017-04-28 CVE-ID : CVE-2017-7592 CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7598 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 Package : libtiff Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-237 Summary ======= The package libtiff before version 4.0.7-3 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 4.0.7-3. # pacman -Syu "libtiff>=4.0.7-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-7592 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior in putagreytile(). - CVE-2017-7593 (information disclosure) A security issue has been found in libtiff < 4.0.7, where a crafted tiff image can cause a unitialized-memory access in tif_rawdata(), leading to information leakage. - CVE-2017-7594 (denial of service) A security issue has been found in libtiff < 4.0.7, where a crafted tiff image can cause a memory leak in OJPEGReadHeaderInfoSecTablesAcTable(). - CVE-2017-7595 (denial of service) A security issue has been found in libtiff < 4.0.7, where a crafted tiff image can cause a division by zero in JPEGSetupEncode(), leading to denial of service. - CVE-2017-7596 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior. - CVE-2017-7597 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior. - CVE-2017-7598 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger a division by zero in TIFFReadDirEntryCheckedRational() or TIFFReadDirEntryCheckedSrational(), leading to denial of service - CVE-2017-7599 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior. - CVE-2017-7600 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior. - CVE-2017-7601 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior (invalid shift exponent) in JPEGSetupEncode(). - CVE-2017-7602 (denial of service) A security issue has been found in libtiff <= 4.0.7, where a crafted TIFF file can trigger an undefined behavior in TIFFReadRawStrip1(). Impact ====== A remote attacker can access sensitive information and cause an application crash via a crafted TIFF file. References ========== http://seclists.org/oss-sec/2017/q2/35 http://bugzilla.maptools.org/show_bug.cgi?id=2658 https://github.com/vadz/libtiff/commit/48780b4fcc425cddc4ef8ffdf536f96a0d1b… http://seclists.org/oss-sec/2017/q2/36 http://bugzilla.maptools.org/show_bug.cgi?id=2651 https://github.com/vadz/libtiff/commit/d60332057b9575ada4f264489582b13e3013… https://github.com/vadz/libtiff/commit/8283e4d1b7e53340684d12932880cbcbaf23… http://bugzilla.maptools.org/show_bug.cgi?id=2659 http://seclists.org/oss-sec/2017/q2/37 https://blogs.gentoo.org/ago/2017/04/01/libtiff-divide-by-zero-in-jpegsetup… https://github.com/vadz/libtiff/commit/47f2fb61a3a64667bce1a8398a8fcb1b348f… http://seclists.org/oss-sec/2017/q2/38 http://seclists.org/oss-sec/2017/q2/39 https://github.com/vadz/libtiff/commit/3144e57770c1e4d26520d8abee750f8ac8b7… https://github.com/vadz/libtiff/commit/3cfd62d77c2a7e147a05bd678524c345fa9c… https://github.com/vadz/libtiff/commit/0a76a8c765c7b8327c59646284fa78c3c27e… https://github.com/vadz/libtiff/commit/66e7bd59520996740e4df5495a830b42fae4… https://security.archlinux.org/CVE-2017-7592 https://security.archlinux.org/CVE-2017-7593 https://security.archlinux.org/CVE-2017-7594 https://security.archlinux.org/CVE-2017-7595 https://security.archlinux.org/CVE-2017-7596 https://security.archlinux.org/CVE-2017-7597 https://security.archlinux.org/CVE-2017-7598 https://security.archlinux.org/CVE-2017-7599 https://security.archlinux.org/CVE-2017-7600 https://security.archlinux.org/CVE-2017-7601 https://security.archlinux.org/CVE-2017-7602

1 0

[arch-security] [ASA-201704-9] webkit2gtk: multiple issues
by Remi Gacogne 28 Apr '17

28 Apr '17

Arch Linux Security Advisory ASA-201704-9 ========================================= Severity: Critical Date : 2017-04-28 CVE-ID : CVE-2016-9642 CVE-2016-9643 CVE-2017-2367 CVE-2017-2376 CVE-2017-2377 CVE-2017-2386 CVE-2017-2392 CVE-2017-2394 CVE-2017-2395 CVE-2017-2396 CVE-2017-2405 CVE-2017-2415 CVE-2017-2419 CVE-2017-2433 CVE-2017-2442 CVE-2017-2445 CVE-2017-2446 CVE-2017-2447 CVE-2017-2454 CVE-2017-2455 CVE-2017-2457 CVE-2017-2459 CVE-2017-2460 CVE-2017-2464 CVE-2017-2465 CVE-2017-2466 CVE-2017-2468 CVE-2017-2469 CVE-2017-2470 CVE-2017-2471 CVE-2017-2475 CVE-2017-2476 CVE-2017-2481 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-235 Summary ======= The package webkit2gtk before version 2.16.1-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing, cross-site scripting, information disclosure, same-origin policy bypass and denial of service. Resolution ========== Upgrade to 2.16.1-1. # pacman -Syu "webkit2gtk>=2.16.1-1" The problems have been fixed upstream in version 2.16.1. Workaround ========== None. Description =========== - CVE-2016-9642 (denial of service) JavaScriptCore in WebKitGTK+ before 2.16.0 allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file. - CVE-2016-9643 (denial of service) The regex code in WebKitGTK+ before 2.14.6 allows remote attackers to cause a denial of service (memory consumption) as demonstrated in a large number of ($ (open parenthesis and dollar) followed by {-2,16} and a large number of +) (plus close parenthesis). - CVE-2017-2367 (same-origin policy bypass) An issue has been found in WebKit, allowing remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. - CVE-2017-2376 (content spoofing) An issue has been found in WebKit, allowing remote attackers to spoof the address bar by leveraging text input during the loading of a page. - CVE-2017-2377 (denial of service) This issue involves the “WebKit Web Inspector” component. It allows attackers to cause a denial of service (memory corruption and application crash) by leveraging a window-close action during a debugger-pause state. - CVE-2017-2386 (same-origin policy bypass) An issue has been found in WebKit, allowing remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. - CVE-2017-2392 (arbitrary code execution) An issue has been found in WebKit, allowing attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app. - CVE-2017-2394 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2395 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2396 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2405 (arbitrary code execution) An issue has been found in the “WebKit Web Inspector” component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2415 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code by leveraging an unspecified “type confusion.”. - CVE-2017-2419 (access restriction bypass) An issue has been found in WebKit, allowing remote attackers to bypass a Content Security Policy protection mechanism via unspecified vectors. - CVE-2017-2433 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2442 (same-origin policy bypass) An issue has been found in WebKit, involving the “WebKit JavaScript Bindings” component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. - CVE-2017-2445 (cross-site scripting) An issue has been found in WebKit, allowing remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects. - CVE-2017-2446 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code via a crafted web site that leverages the mishandling of strict mode functions. - CVE-2017-2447 (information disclosure) An issue has been found in WebKit, allowing remote attackers to obtain sensitive information or cause a denial of service (memory corruption) via a crafted web site. - CVE-2017-2454 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2455 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2457 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2459 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2460 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2464 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2465 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2466 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2468 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2469 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2470 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2471 (arbitrary code execution) A use-after-free vulnerability has been found in WebKit, allowing remote attackers to execute arbitrary code via a crafted web site. - CVE-2017-2475 (cross-site scripting) An issue has been found in WebKit, allowing remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames on a web site. - CVE-2017-2476 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. - CVE-2017-2481 (arbitrary code execution) An issue has been found in WebKit, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Impact ====== A remote attacker can bypass access restrictions, spoof content, access sensitive information, cause a crash and execute arbitrary code on the affected host. References ========== https://webkitgtk.org/security/WSA-2017-0003.html https://security.archlinux.org/CVE-2016-9642 https://security.archlinux.org/CVE-2016-9643 https://security.archlinux.org/CVE-2017-2367 https://security.archlinux.org/CVE-2017-2376 https://security.archlinux.org/CVE-2017-2377 https://security.archlinux.org/CVE-2017-2386 https://security.archlinux.org/CVE-2017-2392 https://security.archlinux.org/CVE-2017-2394 https://security.archlinux.org/CVE-2017-2395 https://security.archlinux.org/CVE-2017-2396 https://security.archlinux.org/CVE-2017-2405 https://security.archlinux.org/CVE-2017-2415 https://security.archlinux.org/CVE-2017-2419 https://security.archlinux.org/CVE-2017-2433 https://security.archlinux.org/CVE-2017-2442 https://security.archlinux.org/CVE-2017-2445 https://security.archlinux.org/CVE-2017-2446 https://security.archlinux.org/CVE-2017-2447 https://security.archlinux.org/CVE-2017-2454 https://security.archlinux.org/CVE-2017-2455 https://security.archlinux.org/CVE-2017-2457 https://security.archlinux.org/CVE-2017-2459 https://security.archlinux.org/CVE-2017-2460 https://security.archlinux.org/CVE-2017-2464 https://security.archlinux.org/CVE-2017-2465 https://security.archlinux.org/CVE-2017-2466 https://security.archlinux.org/CVE-2017-2468 https://security.archlinux.org/CVE-2017-2469 https://security.archlinux.org/CVE-2017-2470 https://security.archlinux.org/CVE-2017-2471 https://security.archlinux.org/CVE-2017-2475 https://security.archlinux.org/CVE-2017-2476 https://security.archlinux.org/CVE-2017-2481

1 0

[arch-security] [ASA-201704-8] jenkins: multiple issues
by Jelle van der Waa 28 Apr '17

28 Apr '17

Arch Linux Security Advisory ASA-201704-8 ========================================= Severity: High Date : 2017-04-27 CVE-ID : CVE-2017-1000354 CVE-2017-1000355 CVE-2017-1000356 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-255 Summary ======= The package jenkins before version 2.57-1 is vulnerable to multiple issues including cross-site request forgery, privilege escalation and arbitrary code execution. Resolution ========== Upgrade to 2.57-1. # pacman -Syu "jenkins>=2.57-1" The problems have been fixed upstream in version 2.57. Workaround ========== None. Description =========== - CVE-2017-1000354 (privilege escalation) The login command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and download their encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on the same instance. This has been fixed by storing the cached authentication as a hash- based MAC with a key specific to the Jenkins instance and the CLI authentication cache. Previously cached authentications are invalidated when upgrading Jenkins to a version containing a fix for this. - CVE-2017-1000355 (arbitrary code execution) Jenkins uses the XStream library to serialize and deserialize XML. Its maintainer recently published a security vulnerability that allows anyone able to provide XML to Jenkins for processing using XStream to crash the Java process. In Jenkins this typically applies to users with permission to create or configure items (jobs), views, or agents. Jenkins now prohibits the attempted deserialization of void / Void that results in a crash. - CVE-2017-1000356 (cross-site request forgery) Multiple Cross-Site Request Forgery vulnerabilities in Jenkins allowed malicious users to perform several administrative actions by tricking a victim into opening a web page. The most notable ones: SECURITY-412: Restart Jenkins immediately, after all builds are finished, or after all plugin installations and builds are finished SECURITY-412: Schedule a downgrade of Jenkins to a previously installed version if Jenkins previously upgraded itself SECURITY-413: Install and (optionally) dynamically load any plugin present on a configured update site SECURITY-414: Remove any update site from the Jenkins configuration SECURITY-415: Change a user’s API token SECURITY-416: Submit system configuration SECURITY-417: Submit global security configuration SECURITY-418, SECURITY-420: For Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process SECURITY-419: Create a new agent, possibly executing arbitrary shell commands on the master node by choosing the appropriate launch method SECURITY-420: Update the node monitor data on all agents Impact ====== A remote attacker can escalate privileges, execute arbitrary code or execute cross-site request forgery which allows the attacker to perform several administrative actions. References ========== https://jenkins.io/security/advisory/2017-04-26/ http://seclists.org/oss-sec/2017/q2/132 http://www.openwall.com/lists/oss-security/2017/04/03/4 https://security.archlinux.org/CVE-2017-1000354 https://security.archlinux.org/CVE-2017-1000355 https://security.archlinux.org/CVE-2017-1000356

1 0

[arch-security] [ASA-201704-7] weechat: denial of service
by Christian Rebischke 24 Apr '17

24 Apr '17

Arch Linux Security Advisory ASA-201704-7 ========================================= Severity: High Date : 2017-04-23 CVE-ID : CVE-2017-8073 Package : weechat Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-253 Summary ======= The package weechat before version 1.7.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.7.1-1. # pacman -Syu "weechat>=1.7.1-1" The problem has been fixed upstream in version 1.7.1. Workaround ========== Use the following workaround for weechat>=1.1: /trigger add irc_dcc_quotes modifier "irc_in_privmsg" "${arguments} \ =~ ^[^ ]+ :${\x01}DCC SEND ${\x22} " "/.*//" Description =========== WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without_quotes function during quote removal, which results in a buffer overflow. Impact ====== A remote attacker is able to crash the application via a maliciously crafted DCC-request. References ========== https://weechat.org/download/security/ https://github.com/weechat/weechat/commit/2fb346f25f79e412cf0ed314fdf791763… https://security.archlinux.org/CVE-2017-8073

1 0

[arch-security] [ASA-201704-6] firefox: multiple issues
by Remi Gacogne 21 Apr '17

21 Apr '17

Arch Linux Security Advisory ASA-201704-6 ========================================= Severity: Critical Date : 2017-04-21 CVE-ID : CVE-2017-5429 CVE-2017-5430 CVE-2017-5432 CVE-2017-5433 CVE-2017-5434 CVE-2017-5435 CVE-2017-5436 CVE-2017-5437 CVE-2017-5438 CVE-2017-5439 CVE-2017-5440 CVE-2017-5441 CVE-2017-5442 CVE-2017-5443 CVE-2017-5444 CVE-2017-5445 CVE-2017-5446 CVE-2017-5447 CVE-2017-5448 CVE-2017-5449 CVE-2017-5451 CVE-2017-5453 CVE-2017-5454 CVE-2017-5455 CVE-2017-5456 CVE-2017-5458 CVE-2017-5459 CVE-2017-5460 CVE-2017-5461 CVE-2017-5464 CVE-2017-5465 CVE-2017-5466 CVE-2017-5467 CVE-2017-5468 CVE-2017-5469 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-249 Summary ======= The package firefox before version 53.0-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, access restriction bypass, arbitrary filesystem access, denial of service, information disclosure and content spoofing. Resolution ========== Upgrade to 53.0-1. # pacman -Syu "firefox>=53.0-1" The problems have been fixed upstream in version 53.0. Workaround ========== None. Description =========== - CVE-2017-5429 (arbitrary code execution) Mozilla developers and community members Christian Holler, Jon Coppeard, Marcia Knous, David Baron, Mats Palmgren, Ronald Crane, Bob Clary, and Chris Peterson reported memory safety bugs present in Firefox 52, Firefox ESR 45.8, and Firefox ESR 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2017-5430 (arbitrary code execution) Mozilla developers and community members Christian Holler, Jon Coppeard, Milan Sreckovic, Tyson Smith, Ronald Crane, Randell Jesup, Philipp, Tooru Fujisawa, and Kan-Ru Chen reported memory safety bugs present in Firefox 52 and Firefox ESR 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2017-5432 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53. It occurs during certain text input selection and results in a potentially exploitable crash. - CVE-2017-5433 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53, It occurs in SMIL animation functions when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. - CVE-2017-5434 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53. It occurs when redirecting focus handling and results in a potentially exploitable crash. - CVE-2017-5435 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53. It occurs during transaction processing in the editor during design mode interactions and results in a potentially exploitable crash. - CVE-2017-5436 (arbitrary code execution) An out-of-bounds write has been found in the Graphite 2 library, triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. - CVE-2017-5437 (denial of service) Three vulnerabilities were reported in the Libevent library that allow for out-of-bounds reads and denial of service (DoS) attacks: CVE-2016-10195, CVE-2016-10196, and CVE-2016-10197. These were fixed in the Libevent library and these changes were ported to Mozilla code in Firefox 53. - CVE-2017-5438 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53, during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. - CVE-2017-5439 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53, during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. - CVE-2017-5440 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53, during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. - CVE-2017-5441 (arbitrary code execution) A use-after-free vulnerability when holding a selection during scroll events has been found in Firefox < 53. This results in a potentially exploitable crash. - CVE-2017-5442 (arbitrary code execution) A use-after-free vulnerability during changes in style when manipulating DOM elements has been found in Firefox < 53. This results in a potentially exploitable crash. - CVE-2017-5443 (arbitrary code execution) An out-of-bounds write vulnerability has been found in Firefox < 53, while decoding improperly formed BinHex format archives. - CVE-2017-5444 (information disclosure) A buffer overflow vulnerability has been found in Firefox < 53, while parsing application/http-index-format format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. - CVE-2017-5445 (information disclosure) A vulnerability has been found in Firefox < 53, while parsing application/http-index-format format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. - CVE-2017-5446 (arbitrary code execution) An out-of-bounds read has been found in Firefox < 53, when an HTTP/2 connection to a servers sends DATA frames with incorrect data content. This leads to a potentially exploitable crash. - CVE-2017-5447 (arbitrary code execution) An out-of-bounds read has been found in Firefox < 53, during the processing of glyph widths while rendering text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. - CVE-2017-5448 (arbitrary code execution) A security issue has been found in Firefox < 53, an out-of-bounds write in ClearKeyDecryptor while decrypting some Clearkey-encrypted media content. The ClearKeyDecryptor code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data within memory, resulting in a potentially exploitable crash. - CVE-2017-5449 (arbitrary code execution) A possibly exploitable crash has been found in Firefox < 53, triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. - CVE-2017-5451 (content spoofing) A security issue has been found in Firefox < 53, allowing to spoof the addressbar through the user interaction on the addressbar and the onblur event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. - CVE-2017-5453 (content spoofing) A security issue has been found in Firefox < 53, allowing to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's TITLE element. This vulnerability allows for spoofing but no scripted content can be run. - CVE-2017-5454 (access restriction bypass) A security issue has been found in Firefox < 53, allowing to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. - CVE-2017-5455 (access restriction bypass) A security issue has been found in Firefox < 53. The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process. - CVE-2017-5456 (arbitrary filesystem access) A security issue has been found in Firefox < 53, allowing to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. - CVE-2017-5458 (cross-site scripting) An issue has been found in Firefox < 53. When a javascript: URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. - CVE-2017-5459 (arbitrary code execution) A buffer overflow has been found in the WebGL part of Firefox < 53. It's triggerable by web content, resulting in a potentially exploitable crash. - CVE-2017-5460 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 53. It's located in frame selection, triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. - CVE-2017-5461 (arbitrary code execution) An out-of-bounds write during Base64 decoding operation has been found in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library. The issue has been fixed in releases 3.29.5 and 3.30.1. - CVE-2017-5464 (arbitrary code execution) A security issue has been found in Firefox < 53. During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. - CVE-2017-5465 (information disclosure) An out-of-bounds read has been found in Firefox < 53, while processing SVG content in ConvolvePixel. This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. - CVE-2017-5466 (cross-site scripting) An origin confusion issue has been found in Firefox < 53. If a page is loaded from an original site through a hyperlink and contains a redirect to a data:text/html URL, triggering a reload will run the reloaded data:text/html page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. - CVE-2017-5467 (denial of service) A potential memory corruption and crash has been found in Firefox < 53, when using Skia content when drawing content outside of the bounds of a clipping region. - CVE-2017-5468 (denial of service) An issue with incorrect ownership model of privateBrowsing information exposed through developer tools has been found in Firefox < 53. This can result in a non-exploitable crash when manually triggered during debugging. - CVE-2017-5469 (arbitrary code execution) Several potential buffer overflows in generated code, due to the CVE-2016-6354 issue in Flex, have been fixed in Firefox 53. Impact ====== A remote attacker can spoof content, bypass access restrictions, access arbitrary files and sensitive information, crash the application and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5429 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1343261%2C1350844%2C1341096… https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5430 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1342101%2C1340482%2C1344686… https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5432 https://bugzilla.mozilla.org/show_bug.cgi?id=1346654 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5433 https://bugzilla.mozilla.org/show_bug.cgi?id=1347168 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5434 https://bugzilla.mozilla.org/show_bug.cgi?id=1349946 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5435 https://bugzilla.mozilla.org/show_bug.cgi?id=1350683 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5436 https://bugzilla.mozilla.org/show_bug.cgi?id=1345461 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5437 https://bugzilla.mozilla.org/show_bug.cgi?id=1343453 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5438 https://bugzilla.mozilla.org/show_bug.cgi?id=1336828 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5439 https://bugzilla.mozilla.org/show_bug.cgi?id=1336830 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5440 https://bugzilla.mozilla.org/show_bug.cgi?id=1336832 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5441 https://bugzilla.mozilla.org/show_bug.cgi?id=1343795 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5442 https://bugzilla.mozilla.org/show_bug.cgi?id=1347979 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5443 https://bugzilla.mozilla.org/show_bug.cgi?id=1342661 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5444 https://bugzilla.mozilla.org/show_bug.cgi?id=1344461 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5445 https://bugzilla.mozilla.org/show_bug.cgi?id=1344467 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5446 https://bugzilla.mozilla.org/show_bug.cgi?id=1343505 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5447 https://bugzilla.mozilla.org/show_bug.cgi?id=1343552 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5448 https://bugzilla.mozilla.org/show_bug.cgi?id=1346648 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5449 https://bugzilla.mozilla.org/show_bug.cgi?id=1340127 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5451 https://bugzilla.mozilla.org/show_bug.cgi?id=1273537 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5453 https://bugzilla.mozilla.org/show_bug.cgi?id=1321247 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5454 https://bugzilla.mozilla.org/show_bug.cgi?id=1349276 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5455 https://bugzilla.mozilla.org/show_bug.cgi?id=1341191 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5456 https://bugzilla.mozilla.org/show_bug.cgi?id=1344415 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5458 https://bugzilla.mozilla.org/show_bug.cgi?id=1229426 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5459 https://bugzilla.mozilla.org/show_bug.cgi?id=1333858 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5460 https://bugzilla.mozilla.org/show_bug.cgi?id=1343642 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461 https://bugzilla.mozilla.org/show_bug.cgi?id=1344380 https://hg.mozilla.org/projects/nss/rev/ac34db053672 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5464 https://bugzilla.mozilla.org/show_bug.cgi?id=1347075 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5465 https://bugzilla.mozilla.org/show_bug.cgi?id=1347617 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5466 https://bugzilla.mozilla.org/show_bug.cgi?id=1353975 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5467 https://bugzilla.mozilla.org/show_bug.cgi?id=1347262 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5468 https://bugzilla.mozilla.org/show_bug.cgi?id=1329521 https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5469 https://bugzilla.mozilla.org/show_bug.cgi?id=1292534 https://security.archlinux.org/CVE-2017-5429 https://security.archlinux.org/CVE-2017-5430 https://security.archlinux.org/CVE-2017-5432 https://security.archlinux.org/CVE-2017-5433 https://security.archlinux.org/CVE-2017-5434 https://security.archlinux.org/CVE-2017-5435 https://security.archlinux.org/CVE-2017-5436 https://security.archlinux.org/CVE-2017-5437 https://security.archlinux.org/CVE-2017-5438 https://security.archlinux.org/CVE-2017-5439 https://security.archlinux.org/CVE-2017-5440 https://security.archlinux.org/CVE-2017-5441 https://security.archlinux.org/CVE-2017-5442 https://security.archlinux.org/CVE-2017-5443 https://security.archlinux.org/CVE-2017-5444 https://security.archlinux.org/CVE-2017-5445 https://security.archlinux.org/CVE-2017-5446 https://security.archlinux.org/CVE-2017-5447 https://security.archlinux.org/CVE-2017-5448 https://security.archlinux.org/CVE-2017-5449 https://security.archlinux.org/CVE-2017-5451 https://security.archlinux.org/CVE-2017-5453 https://security.archlinux.org/CVE-2017-5454 https://security.archlinux.org/CVE-2017-5455 https://security.archlinux.org/CVE-2017-5456 https://security.archlinux.org/CVE-2017-5458 https://security.archlinux.org/CVE-2017-5459 https://security.archlinux.org/CVE-2017-5460 https://security.archlinux.org/CVE-2017-5461 https://security.archlinux.org/CVE-2017-5464 https://security.archlinux.org/CVE-2017-5465 https://security.archlinux.org/CVE-2017-5466 https://security.archlinux.org/CVE-2017-5467 https://security.archlinux.org/CVE-2017-5468 https://security.archlinux.org/CVE-2017-5469

1 0

[arch-security] [ASA-201704-5] chromium: multiple issues
by Remi Gacogne 20 Apr '17

20 Apr '17

Arch Linux Security Advisory ASA-201704-5 ========================================= Severity: Critical Date : 2017-04-20 CVE-ID : CVE-2017-5057 CVE-2017-5058 CVE-2017-5059 CVE-2017-5060 CVE-2017-5061 CVE-2017-5062 CVE-2017-5063 CVE-2017-5064 CVE-2017-5065 CVE-2017-5066 CVE-2017-5067 CVE-2017-5069 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-250 Summary ======= The package chromium before version 58.0.3029.81-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, incorrect calculation and same-origin policy bypass. Resolution ========== Upgrade to 58.0.3029.81-1. # pacman -Syu "chromium>=58.0.3029.81-1" The problems have been fixed upstream in version 58.0.3029.81. Workaround ========== None. Description =========== - CVE-2017-5057 (arbitrary code execution) A type confusion issue has been found in the PDFium component of the Chromium browser. - CVE-2017-5058 (arbitrary code execution) A heap use after free issue has been found in the Print Preview component of the Chromium browser. - CVE-2017-5059 (arbitrary code execution) A type confusion issue has been found in the Blink component of the Chromium browser. - CVE-2017-5060 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser. - CVE-2017-5061 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser. - CVE-2017-5062 (arbitrary code execution) A use after free issue has been found in the Chrome Apps component of the Chromium browser. - CVE-2017-5063 (arbitrary code execution) A heap overflow issue has been found in the Skia component of the Chromium browser. - CVE-2017-5064 (arbitrary code execution) A use after free flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5065 (content spoofing) An incorrect UI issue has been found in the Blink component of the Chromium browser. - CVE-2017-5066 (incorrect calculation) An incorrect signature handing issue has been found in the Networking component of the Chromium browser. - CVE-2017-5067 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser. - CVE-2017-5069 (same-origin policy bypass) A cross-origin bypass issue has been found in the Blink component of the Chromium browser. Impact ====== A remote attacker can spoof URL, bypass security checks and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/04/stable-channel-update-for-des… https://crbug.com/695826 https://crbug.com/694382 https://crbug.com/684684 https://crbug.com/683314 https://crbug.com/672847 https://crbug.com/702896 https://crbug.com/700836 https://crbug.com/693974 https://crbug.com/704560 https://crbug.com/690821 https://crbug.com/648117 https://crbug.com/691726 https://security.archlinux.org/CVE-2017-5057 https://security.archlinux.org/CVE-2017-5058 https://security.archlinux.org/CVE-2017-5059 https://security.archlinux.org/CVE-2017-5060 https://security.archlinux.org/CVE-2017-5061 https://security.archlinux.org/CVE-2017-5062 https://security.archlinux.org/CVE-2017-5063 https://security.archlinux.org/CVE-2017-5064 https://security.archlinux.org/CVE-2017-5065 https://security.archlinux.org/CVE-2017-5066 https://security.archlinux.org/CVE-2017-5067 https://security.archlinux.org/CVE-2017-5069

1 0

[arch-security] [ASA-201704-4] nss: arbitrary code execution
by Remi Gacogne 20 Apr '17

20 Apr '17

Arch Linux Security Advisory ASA-201704-4 ========================================= Severity: Critical Date : 2017-04-20 CVE-ID : CVE-2017-5461 Package : nss Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-247 Summary ======= The package nss before version 3.30.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.30.1-1. # pacman -Syu "nss>=3.30.1-1" The problem has been fixed upstream in version 3.30.1. Workaround ========== None. Description =========== An out-of-bounds write during Base64 decoding operation has been found in the Network Security Services (NSS) library due to insufficient memory being allocated to the buffer. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an application compiled against the NSS library. The issue has been fixed in releases 3.29.5 and 3.30.1. Impact ====== A remote attacker can execute arbitrary code on the affected host, using a specially crafted certificate. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461 https://bugzilla.mozilla.org/show_bug.cgi?id=1344380 https://hg.mozilla.org/projects/nss/rev/ac34db053672 https://security.archlinux.org/CVE-2017-5461

1 0

[arch-security] [ASA-201704-3] mediawiki: multiple issues
by Remi Gacogne 10 Apr '17

10 Apr '17

Arch Linux Security Advisory ASA-201704-3 ========================================= Severity: High Date : 2017-04-07 CVE-ID : CVE-2017-0361 CVE-2017-0362 CVE-2017-0363 CVE-2017-0364 CVE-2017-0365 CVE-2017-0366 CVE-2017-0367 CVE-2017-0368 CVE-2017-0369 CVE-2017-0370 CVE-2017-0372 Package : mediawiki Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-236 Summary ======= The package mediawiki before version 1.28.1-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, information disclosure, cross-site request forgery, insufficient validation, open redirect and access restriction bypass. Resolution ========== Upgrade to 1.28.1-1. # pacman -Syu "mediawiki>=1.28.1-1" The problems have been fixed upstream in version 1.28.1. Workaround ========== None. Description =========== - CVE-2017-0361 (information disclosure) MediaWiki before 1.28.1 may leak passwords in plaintext. API parameters may now be marked as "sensitive" to keep their values out of the logs. - CVE-2017-0362 (cross-site request forgery) MediaWiki before 1.18.1 did not require a CSRF token for the "Mark all pages visited" action on the watchlist. - CVE-2017-0363 (open redirect) The Special:UserLogin page in MediaWiki < 1.28.1 has an open redirect issue. - CVE-2017-0364 (open redirect) The Special:Search page in MediaWiki < 1.28.1 has an open redirect issue. - CVE-2017-0365 (cross-site scripting) SearchHighlighter::removeWiki() uses a regex to remove html from snippets. The regex - /<\/?[^>]+>/ assumes that html is well-formed. As a result when using SearchHighlighter::highlightText() as the highlighting method, this can result in an XSS when $wgAdvancedSearchHighlighting is true. - CVE-2017-0366 (cross-site scripting) MediaWiki < 1.28.1 did not properly filter the DTD declaration when a SVG file was uploaded, leading to a persistent XSS. - CVE-2017-0367 (arbitrary code execution) MediaWiki before 1.28.1 uses the default system temporary directory for the LocalisationCache directory, allowing a local attacker to execute arbitrary code as the web user by crafting a cache file whose content will be passe to unserialize(). - CVE-2017-0368 (cross-site scripting) MediaWiki < 1.28.1 did not properly mark system messages as raw HTML, hence not properly escaping it. - CVE-2017-0369 (access restriction bypass) In MediaWiki < 1.28.1, a normal sysop that doesn't have the necessary rights to override a page protection can still recreate it by restoring a former revision of that page. - CVE-2017-0370 (insufficient validation) The spam blacklist in MediaWiki before 1.28.1 could be bypassed by encoding URLs inside a file inclusion syntax's link parameter. - CVE-2017-0372 (cross-site scripting) The SyntaxHighlight extension in MediaWiki before 1.28.1 does not properly validate the 'start' parameter before passing it to Pygments. Impact ====== A remote attacker might be able to access sensitive information, trick users into visiting a malicious website, execute arbitrary JavaScript on the visitor's browser, trick users into performing unwanted actions and bypass access restrictions. A local attacker might be able to execute arbitrary code with the privileges of the webserver. References ========== https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.… https://phabricator.wikimedia.org/T125177 https://phabricator.wikimedia.org/T150044 https://phabricator.wikimedia.org/T109140 https://phabricator.wikimedia.org/T122209 https://phabricator.wikimedia.org/T144845 https://phabricator.wikimedia.org/T151735 https://phabricator.wikimedia.org/T161453 https://phabricator.wikimedia.org/T156184 https://phabricator.wikimedia.org/T108138 https://phabricator.wikimedia.org/T48143 https://phabricator.wikimedia.org/T158689 https://security.archlinux.org/CVE-2017-0361 https://security.archlinux.org/CVE-2017-0362 https://security.archlinux.org/CVE-2017-0363 https://security.archlinux.org/CVE-2017-0364 https://security.archlinux.org/CVE-2017-0365 https://security.archlinux.org/CVE-2017-0366 https://security.archlinux.org/CVE-2017-0367 https://security.archlinux.org/CVE-2017-0368 https://security.archlinux.org/CVE-2017-0369 https://security.archlinux.org/CVE-2017-0370 https://security.archlinux.org/CVE-2017-0372

1 0