July 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201707-19] gvim: arbitrary code execution
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-19 ========================================== Severity: High Date : 2017-07-18 CVE-ID : CVE-2017-11109 Package : gvim Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-347 Summary ======= The package gvim before version 8.0.0722-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.0.0722-1. # pacman -Syu "gvim>=8.0.0722-1" The problem has been fixed upstream in version 8.0.0722. Workaround ========== None. Description =========== Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. Impact ====== An attacker is able to execute arbitrary code by tricking a user to locally execute a specially crafted vim source file. References ========== https://bugs.archlinux.org/task/54773 https://bugzilla.redhat.com/show_bug.cgi?id=1468492 https://www.mail-archive.com/vim_dev%40googlegroups.com/msg45274.html https://security.archlinux.org/CVE-2017-11109

1 0

[arch-security] [ASA-201707-18] lib32-libtiff: arbitrary code execution
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-18 ========================================== Severity: Critical Date : 2017-07-18 CVE-ID : CVE-2015-7554 CVE-2016-10095 Package : lib32-libtiff Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-87 Summary ======= The package lib32-libtiff before version 4.0.8-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.0.8-1. # pacman -Syu "lib32-libtiff>=4.0.8-1" The problems have been fixed upstream in version 4.0.8. Workaround ========== None. Description =========== - CVE-2015-7554 (arbitrary code execution) An Invalid memory write flaw was found in libtiff in the way it parsed certain extension tags when reading TIFF format files. An attacker could use this flaw to crash or even execute arbitrary code with the permission of the user running such an application compiled against libtiff. - CVE-2016-10095 (arbitrary code execution) A stack-based buffer overflow vulnerability was found in libtiff, in the _TIFFVGetField function in tif_dir.c, when running tiffslpit on crafted tiff file. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted TIFF file. References ========== https://bugs.archlinux.org/task/54842 http://seclists.org/oss-sec/2015/q4/590 http://bugzilla.maptools.org/show_bug.cgi?id=2564 http://seclists.org/oss-sec/2017/q1/10 https://blogs.gentoo.org/ago/2017/01/01/libtiff-stack-based-buffer-overflow… https://security.archlinux.org/CVE-2015-7554 https://security.archlinux.org/CVE-2016-10095

1 0

[arch-security] [ASA-201707-17] libtiff: arbitrary code execution
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-17 ========================================== Severity: Critical Date : 2017-07-18 CVE-ID : CVE-2015-7554 CVE-2016-10095 Package : libtiff Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-5 Summary ======= The package libtiff before version 4.0.8-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.0.8-2. # pacman -Syu "libtiff>=4.0.8-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-7554 (arbitrary code execution) An Invalid memory write flaw was found in libtiff in the way it parsed certain extension tags when reading TIFF format files. An attacker could use this flaw to crash or even execute arbitrary code with the permission of the user running such an application compiled against libtiff. - CVE-2016-10095 (arbitrary code execution) A stack-based buffer overflow vulnerability was found in libtiff, in the _TIFFVGetField function in tif_dir.c, when running tiffslpit on crafted tiff file. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted TIFF file. References ========== https://bugs.archlinux.org/task/54842 http://seclists.org/oss-sec/2015/q4/590 http://bugzilla.maptools.org/show_bug.cgi?id=2564 http://seclists.org/oss-sec/2017/q1/10 https://blogs.gentoo.org/ago/2017/01/01/libtiff-stack-based-buffer-overflow… https://security.archlinux.org/CVE-2015-7554 https://security.archlinux.org/CVE-2016-10095

1 0

[arch-security] [ASA-201707-16] mosquitto: information disclosure
by Jelle van der Waa 16 Jul '17

16 Jul '17

Arch Linux Security Advisory ASA-201707-16 ========================================== Severity: Medium Date : 2017-07-16 CVE-ID : CVE-2017-9868 Package : mosquitto Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-353 Summary ======= The package mosquitto before version 1.4.14-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.4.14-1. # pacman -Syu "mosquitto>=1.4.14-1" The problem has been fixed upstream in version 1.4.14. Workaround ========== None. Description =========== In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information. Impact ====== A local attacker could access sensitive information by reading the mosquitto.db. References ========== https://mosquitto.org/2017/06/security-advisory-cve-2017-9868/ https://security.archlinux.org/CVE-2017-9868

1 0

[arch-security] [ASA-201707-15] apache: multiple issues
by Remi Gacogne 14 Jul '17

14 Jul '17

Arch Linux Security Advisory ASA-201707-15 ========================================== Severity: Critical Date : 2017-07-14 CVE-ID : CVE-2017-9788 CVE-2017-9789 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-350 Summary ======= The package apache before version 2.4.27-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2.4.27-1. # pacman -Syu "apache>=2.4.27-1" The problems have been fixed upstream in version 2.4.27. Workaround ========== None. Description =========== - CVE-2017-9788 (information disclosure) A security issue has been found in apache's mod_auth_digest <= 2.4.26, leading to information disclosure or denial of service. The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault. - CVE-2017-9789 (arbitrary code execution) A security issue has been found in apache's mod_http2 <= 2.4.26. When under stress, closing many connections, the HTTP/2 handling code would sometimes access memory after it has been freed, resulting in potentially erratic behaviour. Impact ====== A remote attacker could access sensitive information if mod_auth_digest is enabled, or be able to execute arbitrary code on the affected host if mod_http2 is enabled. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://security.archlinux.org/CVE-2017-9788 https://security.archlinux.org/CVE-2017-9789

1 0

[arch-security] [ASA-201707-14] evince: arbitrary command execution
by Remi Gacogne 14 Jul '17

14 Jul '17

Arch Linux Security Advisory ASA-201707-14 ========================================== Severity: Critical Date : 2017-07-14 CVE-ID : CVE-2017-1000083 Package : evince Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-348 Summary ======= The package evince before version 3.24.0+12+g717df38f-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.24.0+12+g717df38f-1. # pacman -Syu "evince>=3.24.0+12+g717df38f-1" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The comic book backend in evince <= 3.24.0 is vulnerable to a command injection bug that can be used to execute arbitrary commands when a cbt file is opened. CBT files are simple tar archives containing images. When a cbt file is processed, evince calls "tar -xOf $archive $filename" for every image file in the archive. While both the archive name and the filename are quoted to not be interpreted by the shell, the filename is completely attacker controlled an can start with "--" which leads to tar interpreting it as a command line flag. This can be exploited by creating a tar archive with an embedded file named something like this: "--checkpoint-action=exec=bash -c 'touch ~/covfefe.evince;'.jpg" This can presumably be triggered by the evince thumbnailer, which is not sandboxed, and web browsers that allow untrusted websites to auto- downloading files without user interaction (Chrome, Epiphany) can trigger the thumbnailer to run so this is web exposed. Impact ====== A remote attacker can execute arbitrary command on the affected host by convincing the user to download a crafted CBT file. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=784630 https://git.gnome.org/browse/evince/commit/?h=gnome-3-24&id=717df38fd8509bf… https://security.archlinux.org/CVE-2017-1000083

1 0

[arch-security] [ASA-201707-13] irssi: multiple issues
by Remi Gacogne 13 Jul '17

13 Jul '17

Arch Linux Security Advisory ASA-201707-13 ========================================== Severity: Critical Date : 2017-07-13 CVE-ID : CVE-2017-10965 CVE-2017-10966 Package : irssi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-342 Summary ======= The package irssi before version 1.0.4-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.0.4-1. # pacman -Syu "irssi>=1.0.4-1" The problems have been fixed upstream in version 1.0.4. Workaround ========== None. Description =========== - CVE-2017-10965 (denial of service) When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer. This requires control over the IRC server, or a position of man-in-the-middle to be exploited. - CVE-2017-10966 (arbitrary code execution) While updating the internal nick list, Irssi may incorrectly use the GHashTable interface and free the nick while updating it. This will then result in use-after-free conditions on each access of the hash table. Note that this should not happen with a conforming IRC server, so it requires control over the IRC server or a position of man-in-the- middle to be exploitable. Impact ====== A remote attacker in position of man-in-the-middle or controlling the IRC server might be able to crash or execute arbitrary code on an affected host. References ========== https://github.com/irssi/irssi/commit/5e26325317c72a04c1610ad952974e206384d… https://irssi.org/security/irssi_sa_2017_07.txt https://security.archlinux.org/CVE-2017-10965 https://security.archlinux.org/CVE-2017-10966

1 0

[arch-security] [ASA-201707-12] nginx-mainline: information disclosure
by Remi Gacogne 12 Jul '17

12 Jul '17

Arch Linux Security Advisory ASA-201707-12 ========================================== Severity: High Date : 2017-07-12 CVE-ID : CVE-2017-7529 Package : nginx-mainline Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-346 Summary ======= The package nginx-mainline before version 1.13.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.13.3-1. # pacman -Syu "nginx-mainline>=1.13.3-1" The problem has been fixed upstream in version 1.13.3. Workaround ========== None. Description =========== A security issue was identified in the range filter module of nginx < 1.13.3. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak. When using nginx with standard modules this allows an attacker to obtain a cache file header if a response was returned from cache. In some configurations a cache file header may contain IP address of the backend server or other sensitive information. Besides, with 3rd party modules it is potentially possible that the issue may lead to a denial of service or a disclosure of a worker process memory. No such modules are currently known though. Impact ====== A remote attacker can access sensitive information by sending a specially crafted request. References ========== http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html https://nginx.org/download/patch.2017.ranges.txt https://security.archlinux.org/CVE-2017-7529

1 0

[arch-security] [ASA-201707-11] nginx: information disclosure
by Remi Gacogne 12 Jul '17

12 Jul '17

Arch Linux Security Advisory ASA-201707-11 ========================================== Severity: High Date : 2017-07-12 CVE-ID : CVE-2017-7529 Package : nginx Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-345 Summary ======= The package nginx before version 1.12.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.12.1-1. # pacman -Syu "nginx>=1.12.1-1" The problem has been fixed upstream in version 1.12.1. Workaround ========== None. Description =========== A security issue was identified in the range filter module of nginx < 1.13.3. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak. When using nginx with standard modules this allows an attacker to obtain a cache file header if a response was returned from cache. In some configurations a cache file header may contain IP address of the backend server or other sensitive information. Besides, with 3rd party modules it is potentially possible that the issue may lead to a denial of service or a disclosure of a worker process memory. No such modules are currently known though. Impact ====== A remote attacker can access sensitive information by sending a specially crafted request. References ========== http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html https://nginx.org/download/patch.2017.ranges.txt https://security.archlinux.org/CVE-2017-7529

1 0

[arch-security] [ASA-201707-10] flashplugin: multiple issues
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-10 ========================================== Severity: Critical Date : 2017-07-11 CVE-ID : CVE-2017-3080 CVE-2017-3099 CVE-2017-3100 Package : flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-344 Summary ======= The package flashplugin before version 26.0.0.137-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 26.0.0.137-1. # pacman -Syu "flashplugin>=26.0.0.137-1" The problems have been fixed upstream in version 26.0.0.137. Workaround ========== None. Description =========== - CVE-2017-3080 (information disclosure) A security issue leading to information disclosure has been found in Adobe Flash Player < 26.0.0.137. - CVE-2017-3099 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.137. - CVE-2017-3100 (information disclosure) A memory corruption vulnerability leading to the disclosure of a memory address has been found in Adobe Flash Player < 26.0.0.137. It could be used to bypass some security protections like ASLR. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-21.html https://security.archlinux.org/CVE-2017-3080 https://security.archlinux.org/CVE-2017-3099 https://security.archlinux.org/CVE-2017-3100

1 0