May 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201705-5] libtirpc: denial of service
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-5 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : libtirpc Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-262 Summary ======= The package libtirpc before version 1.0.1-3 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.1-3. # pacman -Syu "libtirpc>=1.0.1-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ========== https://bugs.archlinux.org/task/53928 https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial… https://security.archlinux.org/CVE-2017-8779

1 0

[arch-security] [ASA-201705-4] rpcbind: denial of service
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-4 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : rpcbind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-261 Summary ======= The package rpcbind before version 0.2.4-3 is vulnerable to denial of service. Resolution ========== Upgrade to 0.2.4-3. # pacman -Syu "rpcbind>=0.2.4-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ========== https://bugs.archlinux.org/task/53927 https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial… https://security.archlinux.org/CVE-2017-8779

1 0

[arch-security] [ASA-201705-3] ghostscript: arbitrary command execution
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-3 ========================================= Severity: High Date : 2017-05-07 CVE-ID : CVE-2017-8291 Package : ghostscript Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-256 Summary ======= The package ghostscript before version 9.21-2 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 9.21-2. # pacman -Syu "ghostscript>=9.21-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code via a "/OutputFile (%pipe%" substring in the context of the ghostscript process, bypassing the -dSAFER protection. Impact ====== A remote attacker is able to execute arbitrary commands via a specially crafted PostScript document. References ========== https://bugs.ghostscript.com/show_bug.cgi?id=697808 https://security.archlinux.org/CVE-2017-8291

1 0

[arch-security] [ASA-201705-2] chromium: arbitrary code execution
by Remi Gacogne 03 May '17

03 May '17

Arch Linux Security Advisory ASA-201705-2 ========================================= Severity: High Date : 2017-05-03 CVE-ID : CVE-2017-5068 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-260 Summary ======= The package chromium before version 58.0.3029.96-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 58.0.3029.96-1. # pacman -Syu "chromium>=58.0.3029.96-1" The problem has been fixed upstream in version 58.0.3029.96. Workaround ========== None. Description =========== A race condition issue has been found in the WebRTC component of the Chromium browser. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-des… https://security.archlinux.org/CVE-2017-5068

1 0

[arch-security] [ASA-201705-1] dovecot: denial of service
by Remi Gacogne 01 May '17

01 May '17

Arch Linux Security Advisory ASA-201705-1 ========================================= Severity: Medium Date : 2017-05-01 CVE-ID : CVE-2017-2669 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-238 Summary ======= The package dovecot before version 2.2.29.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.2.29.1-1. # pacman -Syu "dovecot>=2.2.29.1-1" The problem has been fixed upstream in version 2.2.29.1. Workaround ========== None. Description =========== A security issue has been found in Dovecot >= 2.2.26 and <= 2.2.28. If the "dict" passdb is used for authentication, the username sent by the client is passed to the var_expand() function and double expansion of %-variables is performed. A remote unauthenticated attacker could then send a specially crafted username containing %variables to cause a denial of service. Impact ====== A remote, unauthenticated attacker can cause a denial of service by sending a specially crafted username. References ========== https://dovecot.org/list/dovecot-news/2017-April/000341.html https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b4… https://security.archlinux.org/CVE-2017-2669

1 0