May 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201705-15] zziplib: multiple issues
by Santiago Torres-Arias 12 May '17

12 May '17

Arch Linux Security Advisory ASA-201705-15 ========================================== Severity: High Date : 2017-05-12 CVE-ID : CVE-2017-5974 CVE-2017-5975 CVE-2017-5976 CVE-2017-5979 CVE-2017-5981 Package : zziplib Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-191 Summary ======= The package zziplib before version 0.13.66-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.13.66-2. # pacman -Syu "zziplib>=0.13.66-2" The problems have been fixed upstream in version 0.13.66. Workaround ========== None. Description =========== - CVE-2017-5974 (arbitrary code execution) Heap-based buffer overflow in the __zzip_get32 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. - CVE-2017-5975 (arbitrary code execution) Heap-based buffer overflow in the __zzip_get64 function in fetch.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. - CVE-2017-5976 (arbitrary code execution) Heap-based buffer overflow in the zzip_mem_entry_extra_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (crash) via a crafted ZIP file. - CVE-2017-5979 (denial of service) The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file. - CVE-2017-5981 (denial of service) seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file. Impact ====== A remote attacker is able to crash the target process or execute arbitrary code on the host by providing a malicious file. References ========== https://bugs.archlinux.org/task/53133 http://www.openwall.com/lists/oss-security/2017/02/14/3 https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-… https://github.com/gdraheim/zziplib/commit/03de3beabbf570474a9ac05d6dc6b42c… https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-… https://github.com/gdraheim/zziplib/commit/64e745f8a3604ba1c444febed86b5e14… https://github.com/gdraheim/zziplib/commit/33d6e9c52fcf1a8983896a512033994d… https://blogs.gentoo.org/ago/2017/02/09/zziplib-heap-based-buffer-overflow-… https://blogs.gentoo.org/ago/2017/02/09/zziplib-null-pointer-dereference-in… https://blogs.gentoo.org/ago/2017/02/09/zziplib-assertion-failure-in-seeko-… https://github.com/gdraheim/zziplib/commit/3810583f4dee1bac8f02ab41e01bbffd… https://github.com/gdraheim/zziplib/commit/0ce576bdcb330c40cc39636c6232ced0… https://security.archlinux.org/CVE-2017-5974 https://security.archlinux.org/CVE-2017-5975 https://security.archlinux.org/CVE-2017-5976 https://security.archlinux.org/CVE-2017-5979 https://security.archlinux.org/CVE-2017-5981

1 0

[arch-security] [ASA-201705-14] git: access restriction bypass
by Remi Gacogne 12 May '17

12 May '17

Arch Linux Security Advisory ASA-201705-14 ========================================== Severity: High Date : 2017-05-12 CVE-ID : CVE-2017-8386 Package : git Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-267 Summary ======= The package git before version 2.13.0-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 2.13.0-1. # pacman -Syu "git>=2.13.0-1" The problem has been fixed upstream in version 2.13.0. Workaround ========== None. Description =========== A security issue has been found in git < 2.12.3, allowing a remote restricted user to execute an interactive pager on the server by causing it to spawn "git upload-pack --help". This is only an issue for servers running the "git-shell" restricted login shell. Impact ====== A remote attacker can use the interactive pager commands to access and modify arbitrary files on the affected host. If the login shell used is not git-shell, a remote attacker might also be able to run arbitrary commands on the affected host. References ========== http://lkml.iu.edu/hypermail/linux/kernel/1705.1/01337.html https://git.kernel.org/pub/scm/git/git.git/commit/?id=3ec804490a265f4c418a3… https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-83… https://security.archlinux.org/CVE-2017-8386

1 0

[arch-security] [ASA-201705-13] kdelibs: privilege escalation
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-13 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kdelibs Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-270 Summary ======= The package kdelibs before version 4.14.32-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.14.32-1. # pacman -Syu "kdelibs>=4.14.32-1" The problem has been fixed upstream in version 4.14.32. Workaround ========== None. Description =========== KAuth <= 5.33.0 contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account. Impact ====== A local, unprivileged attacker can escalate privileges to become root on the affected host. References ========== https://commits.kde.org/kdelibs/264e97625abe2e0334f97de17f6ffb52582888ab https://www.kde.org/info/security/advisory-20170510-1.txt http://seclists.org/oss-sec/2017/q2/240 https://commits.kde.org/kauth/df875f725293af53399f5146362eb158b4f9216a https://security.archlinux.org/CVE-2017-8422

1 0

[arch-security] [ASA-201705-12] kauth: privilege escalation
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-12 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kauth Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-269 Summary ======= The package kauth before version 5.33.0-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.33.0-2. # pacman -Syu "kauth>=5.33.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== KAuth <= 5.33.0 contains a logic flaw in which the service invoking dbus is not properly checked. This allows spoofing the identity of the caller and with some carefully crafted calls can lead to gaining root from an unprivileged account. Impact ====== A local, unprivileged attacker can escalate privileges to become root on the affected host. References ========== https://cgit.kde.org/kauth.git/commit/?id=df875f725293af53399f5146362eb158b… https://www.kde.org/info/security/advisory-20170510-1.txt http://seclists.org/oss-sec/2017/q2/240 https://commits.kde.org/kauth/df875f725293af53399f5146362eb158b4f9216a https://commits.kde.org/kdelibs/264e97625abe2e0334f97de17f6ffb52582888ab https://security.archlinux.org/CVE-2017-8422

1 0

[arch-security] [ASA-201705-11] smb4k: privilege escalation
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-11 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8849 Package : smb4k Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-268 Summary ======= The package smb4k before version 2.0.0-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.0.0-2. # pacman -Syu "smb4k>=2.0.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Smb4k <= 2.0.0 contains a logic flaw in which mount helper binary does not properly verify the mount command it is being asked to run. This allows calling any other binary as root since the mount helper is typically installed as suid. Impact ====== A local, unprivileged attacker can escalate privileges to become root on the affected host. References ========== https://www.kde.org/info/security/advisory-20170510-2.txt http://seclists.org/oss-sec/2017/q2/240 https://commits.kde.org/smb4k/a90289b0962663bc1d247bbbd31b9e65b2ca000e https://security.archlinux.org/CVE-2017-8849

1 0

[arch-security] [ASA-201705-10] lib32-freetype2: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-10 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8105 CVE-2017-8287 Package : lib32-freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-258 Summary ======= The package lib32-freetype2 before version 2.7.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.7.1-2. # pacman -Syu "lib32-freetype2>=2.7.1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-8105 (arbitrary code execution) FreeType 2 <= 2.7.1 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c. - CVE-2017-8287 (arbitrary code execution) FreeType 2 <= 2.7.1 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted font. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=941 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=935 https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48… https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc0… https://security.archlinux.org/CVE-2017-8105 https://security.archlinux.org/CVE-2017-8287

1 0

[arch-security] [ASA-201705-9] lib32-flashplugin: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-9 ========================================= Severity: Critical Date : 2017-05-09 CVE-ID : CVE-2017-3068 CVE-2017-3069 CVE-2017-3070 CVE-2017-3071 CVE-2017-3072 CVE-2017-3073 CVE-2017-3074 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-266 Summary ======= The package lib32-flashplugin before version 25.0.0.171-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 25.0.0.171-1. # pacman -Syu "lib32-flashplugin>=25.0.0.171-1" The problems have been fixed upstream in version 25.0.0.171. Workaround ========== None. Description =========== - CVE-2017-3068 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Advanced Video Coding engine of Adobe Flash Player < 25.0.0.171. - CVE-2017-3069 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BlendMode class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3070 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the ConvolutionFilter class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3071 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player < 25.0.0.171, when masking display object. - CVE-2017-3072 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BitmapData class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3073 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 25.0.0.171, when handling multiple mask properties of display objects. - CVE-2017-3074 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Graphics class of Adobe Flash Player < 25.0.0.171. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-15.html https://security.archlinux.org/CVE-2017-3068 https://security.archlinux.org/CVE-2017-3069 https://security.archlinux.org/CVE-2017-3070 https://security.archlinux.org/CVE-2017-3071 https://security.archlinux.org/CVE-2017-3072 https://security.archlinux.org/CVE-2017-3073 https://security.archlinux.org/CVE-2017-3074

1 0

[arch-security] [ASA-201705-8] flashplugin: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-8 ========================================= Severity: Critical Date : 2017-05-09 CVE-ID : CVE-2017-3068 CVE-2017-3069 CVE-2017-3070 CVE-2017-3071 CVE-2017-3072 CVE-2017-3073 CVE-2017-3074 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-265 Summary ======= The package flashplugin before version 25.0.0.171-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 25.0.0.171-1. # pacman -Syu "flashplugin>=25.0.0.171-1" The problems have been fixed upstream in version 25.0.0.171. Workaround ========== None. Description =========== - CVE-2017-3068 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Advanced Video Coding engine of Adobe Flash Player < 25.0.0.171. - CVE-2017-3069 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BlendMode class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3070 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the ConvolutionFilter class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3071 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player < 25.0.0.171, when masking display object. - CVE-2017-3072 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BitmapData class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3073 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 25.0.0.171, when handling multiple mask properties of display objects. - CVE-2017-3074 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Graphics class of Adobe Flash Player < 25.0.0.171. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-15.html https://security.archlinux.org/CVE-2017-3068 https://security.archlinux.org/CVE-2017-3069 https://security.archlinux.org/CVE-2017-3070 https://security.archlinux.org/CVE-2017-3071 https://security.archlinux.org/CVE-2017-3072 https://security.archlinux.org/CVE-2017-3073 https://security.archlinux.org/CVE-2017-3074

1 0

[arch-security] [ASA-201705-7] freetype2: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-7 ========================================= Severity: High Date : 2017-05-09 CVE-ID : CVE-2017-8105 CVE-2017-8287 Package : freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-257 Summary ======= The package freetype2 before version 2.7.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.7.1-2. # pacman -Syu "freetype2>=2.7.1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-8105 (arbitrary code execution) FreeType 2 <= 2.7.1 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c. - CVE-2017-8287 (arbitrary code execution) FreeType 2 <= 2.7.1 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted font. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=941 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=935 https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48… https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc0… https://security.archlinux.org/CVE-2017-8105 https://security.archlinux.org/CVE-2017-8287

1 0

[arch-security] [ASA-201705-6] lib32-libtirpc: denial of service
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-6 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : lib32-libtirpc Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-263 Summary ======= The package lib32-libtirpc before version 1.0.1-2 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.1-2. # pacman -Syu "lib32-libtirpc>=1.0.1-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ========== https://bugs.archlinux.org/task/53928 https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial… https://security.archlinux.org/CVE-2017-8779

1 0