May 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201705-15] zziplib: multiple issues
by Santiago Torres-Arias 12 May '17

12 May '17

Arch Linux Security Advisory ASA-201705-15 ========================================== Severity: High Date : 2017-05-12 CVE-ID : CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5979 CVE-2017-5981 Package : zziplib Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-191 Summary ======= The package zziplib before version 0.13.66-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== … [View More]

1 0

[arch-security] [ASA-201705-14] git: access restriction bypass
by Remi Gacogne 12 May '17

12 May '17

Arch Linux Security Advisory ASA-201705-14 ========================================== Severity: High Date : 2017-05-12 CVE-ID : CVE-2017-8386 Package : git Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-267 Summary ======= The package git before version 2.13.0-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 2.13.0-1. # pacman -Syu "git>=2.13.0-1" The problem has been fixed upstream in version 2.13.0. … [View More]

1 0

[arch-security] [ASA-201705-13] kdelibs: privilege escalation
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-13 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kdelibs Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-270 Summary ======= The package kdelibs before version 4.14.32-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.14.32-1. # pacman -Syu "kdelibs>=4.14.32-1" The problem has been fixed upstream in version 4.14.… [View More]

1 0

[arch-security] [ASA-201705-12] kauth: privilege escalation
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-12 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kauth Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-269 Summary ======= The package kauth before version 5.33.0-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.33.0-2. # pacman -Syu "kauth>=5.33.0-2" The problem has been fixed upstream but no release is … [View More]

1 0

[arch-security] [ASA-201705-11] smb4k: privilege escalation
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-11 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8849 Package : smb4k Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-268 Summary ======= The package smb4k before version 2.0.0-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.0.0-2. # pacman -Syu "smb4k>=2.0.0-2" The problem has been fixed upstream but no release is available … [View More]

1 0

[arch-security] [ASA-201705-10] lib32-freetype2: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-10 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8105 CVE-2017-8287 Package : lib32-freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-258 Summary ======= The package lib32-freetype2 before version 2.7.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.7.1-2. # pacman -Syu "lib32-freetype2>=2.7.1-2" The problems … [View More]

1 0

[arch-security] [ASA-201705-9] lib32-flashplugin: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-9 ========================================= Severity: Critical Date : 2017-05-09 CVE-ID : CVE-2017-3068 CVE-2017-3069 CVE-2017-3070 CVE-2017-3071 CVE-2017-3072 CVE-2017-3073 CVE-2017-3074 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-266 Summary ======= The package lib32-flashplugin before version 25.0.0.171-1 is vulnerable to arbitrary code execution. Resolution … [View More]========== Upgrade to 25.0.0.171-1. # pacman -Syu "lib32-flashplugin>=25.0.0.171-1" The problems have been fixed upstream in version 25.0.0.171. Workaround ========== None. Description =========== - CVE-2017-3068 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Advanced Video Coding engine of Adobe Flash Player < 25.0.0.171. - CVE-2017-3069 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BlendMode class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3070 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the ConvolutionFilter class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3071 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player < 25.0.0.171, when masking display object. - CVE-2017-3072 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BitmapData class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3073 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 25.0.0.171, when handling multiple mask properties of display objects. - CVE-2017-3074 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Graphics class of Adobe Flash Player < 25.0.0.171. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-15.html https://security.archlinux.org/CVE-2017-3068 https://security.archlinux.org/CVE-2017-3069 https://security.archlinux.org/CVE-2017-3070 https://security.archlinux.org/CVE-2017-3071 https://security.archlinux.org/CVE-2017-3072 https://security.archlinux.org/CVE-2017-3073 https://security.archlinux.org/CVE-2017-3074 [View Less]

1 0

[arch-security] [ASA-201705-8] flashplugin: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-8 ========================================= Severity: Critical Date : 2017-05-09 CVE-ID : CVE-2017-3068 CVE-2017-3069 CVE-2017-3070 CVE-2017-3071 CVE-2017-3072 CVE-2017-3073 CVE-2017-3074 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-265 Summary ======= The package flashplugin before version 25.0.0.171-1 is vulnerable to arbitrary code execution. Resolution ========== … [View More]Upgrade to 25.0.0.171-1. # pacman -Syu "flashplugin>=25.0.0.171-1" The problems have been fixed upstream in version 25.0.0.171. Workaround ========== None. Description =========== - CVE-2017-3068 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Advanced Video Coding engine of Adobe Flash Player < 25.0.0.171. - CVE-2017-3069 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BlendMode class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3070 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the ConvolutionFilter class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3071 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player < 25.0.0.171, when masking display object. - CVE-2017-3072 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BitmapData class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3073 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 25.0.0.171, when handling multiple mask properties of display objects. - CVE-2017-3074 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Graphics class of Adobe Flash Player < 25.0.0.171. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-15.html https://security.archlinux.org/CVE-2017-3068 https://security.archlinux.org/CVE-2017-3069 https://security.archlinux.org/CVE-2017-3070 https://security.archlinux.org/CVE-2017-3071 https://security.archlinux.org/CVE-2017-3072 https://security.archlinux.org/CVE-2017-3073 https://security.archlinux.org/CVE-2017-3074 [View Less]

1 0

[arch-security] [ASA-201705-7] freetype2: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-7 ========================================= Severity: High Date : 2017-05-09 CVE-ID : CVE-2017-8105 CVE-2017-8287 Package : freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-257 Summary ======= The package freetype2 before version 2.7.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.7.1-2. # pacman -Syu "freetype2>=2.7.1-2" The problems have been fixed … [View More]

1 0

[arch-security] [ASA-201705-6] lib32-libtirpc: denial of service
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-6 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : lib32-libtirpc Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-263 Summary ======= The package lib32-libtirpc before version 1.0.1-2 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.1-2. # pacman -Syu "lib32-libtirpc>=1.0.1-2" The problem has been fixed upstream but no … [View More]

1 0