July 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201707-9] lib32-flashplugin: multiple issues
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-9 ========================================= Severity: Critical Date : 2017-07-11 CVE-ID : CVE-2017-3080 CVE-2017-3099 CVE-2017-3100 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-343 Summary ======= The package lib32-flashplugin before version 26.0.0.137-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 26.0.0.137-1. # pacman -Syu "lib32-flashplugin>=26.0.0.137-1" The problems have been fixed upstream in version 26.0.0.137. Workaround ========== None. Description =========== - CVE-2017-3080 (information disclosure) A security issue leading to information disclosure has been found in Adobe Flash Player < 26.0.0.137. - CVE-2017-3099 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.137. - CVE-2017-3100 (information disclosure) A memory corruption vulnerability leading to the disclosure of a memory address has been found in Adobe Flash Player < 26.0.0.137. It could be used to bypass some security protections like ASLR. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-21.html https://security.archlinux.org/CVE-2017-3080 https://security.archlinux.org/CVE-2017-3099 https://security.archlinux.org/CVE-2017-3100

1 0

[arch-security] [ASA-201707-8] tor: session hijacking
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-8 ========================================= Severity: Medium Date : 2017-07-11 CVE-ID : CVE-2017-0377 Package : tor Type : session hijacking Remote : Yes Link : https://security.archlinux.org/AVG-336 Summary ======= The package tor before version 0.3.0.9-1 is vulnerable to session hijacking. Resolution ========== Upgrade to 0.3.0.9-1. # pacman -Syu "tor>=0.3.0.9-1" The problem has been fixed upstream in version 0.3.0.9. Workaround ========== None. Description =========== A security issue has been found in Tor <= 0.3.0.8, which could make it easier to eavesdrop on Tor users' traffic. When choosing which guard to use for a circuit, Tor avoids using a node that is in the same family that the exit node it selected, but this check was accidentally removed in 0.3.0. Impact ====== An attacker might be able to eavesdrop on Tor users' traffic by getting in a position to analyze both the incoming and outgoing traffic of a circuit. References ========== https://blog.torproject.org/blog/tor-0309-released-security-update-clients https://trac.torproject.org/projects/tor/ticket/22753 https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548… https://security.archlinux.org/CVE-2017-0377

1 0

[arch-security] [ASA-201707-7] libdwarf: denial of service
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-7 ========================================= Severity: Low Date : 2017-07-11 CVE-ID : CVE-2017-9998 Package : libdwarf Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-332 Summary ======= The package libdwarf before version 20170709-1 is vulnerable to denial of service. Resolution ========== Upgrade to 20170709-1. # pacman -Syu "libdwarf>=20170709-1" The problem has been fixed upstream in version 20170709. Workaround ========== None. Description =========== The _dwarf_decode_s_leb128_chk function in dwarf_leb.c in libdwarf through 2017-06-28 allows attackers to cause a denial of service (Segmentation fault) via a crafted file. Impact ====== An attacker can cause a denial of service by tricking a local user into submitting a crafted file to a program linked against libdwarf. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1465756 https://security.archlinux.org/CVE-2017-9998

1 0

[arch-security] [ASA-201707-6] lib32-gnutls: denial of service
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-6 ========================================= Severity: Medium Date : 2017-07-11 CVE-ID : CVE-2017-7507 Package : lib32-gnutls Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-295 Summary ======= The package lib32-gnutls before version 3.5.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.5.13-1. # pacman -Syu "lib32-gnutls>=3.5.13-1" The problem has been fixed upstream in version 3.5.13. Workaround ========== None. Description =========== GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application. Impact ====== A remote attacker can crash a vulnerable TLS server by sending a crafted status_request extension in a ClientHello message. References ========== https://www.gnutls.org/security.html#GNUTLS-SA-2017-4 https://bugzilla.redhat.com/show_bug.cgi?id=1454621 https://security.archlinux.org/CVE-2017-7507

1 0

[arch-security] [ASA-201707-5] systemd: denial of service
by Remi Gacogne 04 Jul '17

04 Jul '17

Arch Linux Security Advisory ASA-201707-5 ========================================= Severity: Medium Date : 2017-07-04 CVE-ID : CVE-2017-9217 Package : systemd Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-337 Summary ======= The package systemd before version 233-7 is vulnerable to denial of service. Resolution ========== Upgrade to 233-7. # pacman -Syu "systemd>=233-7" The problem has been fixed upstream in version 233. Workaround ========== None. Description =========== A security issue has been found in systemd-resolved, allowing a remote attacker to cause a denial of service (daemon crash via NULL-pointer dereference) via a crafted DNS response with an empty question section. Impact ====== A remote attacker can cause a denial of service via a crafted DNS response. References ========== https://github.com/systemd/systemd/commit/262d95fecd357343887709006188f690c… https://github.com/systemd/systemd/pull/6020 https://security.archlinux.org/CVE-2017-9217

1 0

[arch-security] [ASA-201707-4] qt5-webengine: multiple issues
by Remi Gacogne 04 Jul '17

04 Jul '17

Arch Linux Security Advisory ASA-201707-4 ========================================= Severity: Critical Date : 2017-07-04 CVE-ID : CVE-2017-5070 CVE-2017-5071 CVE-2017-5075 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5083 CVE-2017-5088 CVE-2017-5089 Package : qt5-webengine Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-339 Summary ======= The package qt5-webengine before version 5.9.1-1 is vulnerable to multiple issues including arbitrary code execution, arbitrary command execution, information disclosure and content spoofing. Resolution ========== Upgrade to 5.9.1-1. # pacman -Syu "qt5-webengine>=5.9.1-1" The problems have been fixed upstream in version 5.9.1. Workaround ========== None. Description =========== - CVE-2017-5070 (arbitrary code execution) A type confusion flaw has been found in the V8 component of the Chromium browser. - CVE-2017-5071 (information disclosure) An out of bounds read flaw has been found in the V8 component of the Chromium browser. - CVE-2017-5075 (information disclosure) An information leak flaw has been found in the CSP reporting component of the Chromium browser. - CVE-2017-5076 (content spoofing) An address spoofing flaw has been found in the Omnibox component of the Chromium browser. - CVE-2017-5077 (arbitrary code execution) A heap buffer overflow flaw was found in the Skia component of the Chromium browser. - CVE-2017-5078 (arbitrary command execution) A possible command injection flaw has been found in the mailto handling component of the Chromium browser. - CVE-2017-5079 (content spoofing) A UI spoofing flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5083 (content spoofing) A UI spoofing flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5088 (information disclosure) An out-of-bounds read vulnerability has been found in the V8 component of the Chromium browser < 59.0.3071.104. - CVE-2017-5089 (content spoofing) A domain spoofing vulnerability has been found in the Omnibox component of the Chromium browser < 59.0.3071.104. Impact ====== A remote attacker can access sensitive information, spoof content and execute arbitrary code and commands on the affected host. References ========== https://github.com/qt/qtwebengine/blob/5.9.1/dist/changes-5.9.1 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=722756 https://bugs.chromium.org/p/chromium/issues/detail?id=715582 https://bugs.chromium.org/p/chromium/issues/detail?id=678776 https://bugs.chromium.org/p/chromium/issues/detail?id=719199 https://bugs.chromium.org/p/chromium/issues/detail?id=716311 https://bugs.chromium.org/p/chromium/issues/detail?id=711020 https://bugs.chromium.org/p/chromium/issues/detail?id=713686 https://bugs.chromium.org/p/chromium/issues/detail?id=714849 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=729991 https://bugs.chromium.org/p/chromium/issues/detail?id=714196 https://security.archlinux.org/CVE-2017-5070 https://security.archlinux.org/CVE-2017-5071 https://security.archlinux.org/CVE-2017-5075 https://security.archlinux.org/CVE-2017-5076 https://security.archlinux.org/CVE-2017-5077 https://security.archlinux.org/CVE-2017-5078 https://security.archlinux.org/CVE-2017-5079 https://security.archlinux.org/CVE-2017-5083 https://security.archlinux.org/CVE-2017-5088 https://security.archlinux.org/CVE-2017-5089

1 0

[arch-security] [ASA-201707-3] bind: access restriction bypass
by Remi Gacogne 04 Jul '17

04 Jul '17

Arch Linux Security Advisory ASA-201707-3 ========================================= Severity: High Date : 2017-07-04 CVE-ID : CVE-2017-3142 CVE-2017-3143 Package : bind Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-335 Summary ======= The package bind before version 9.11.1.P2-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 9.11.1.P2-1. # pacman -Syu "bind>=9.11.1.P2-1" The problems have been fixed upstream in version 9.11.1.P2. Workaround ========== None. Description =========== - CVE-2017-3142 (access restriction bypass) An error in TSIG authentication has been found in Bind <= 9.11.1-P1, allowing a remote attacker to bypass authentication in order to perform unauthorized zone transfers or forge NOTIFY packets. The attacker needs to have knowledge of the key name, and should be allowed by the other ACL restrictions if any. - CVE-2017-3143 (access restriction bypass) An error in TSIG authentication has been found in Bind <= 9.11.1-P1, allowing a remote attacker to bypass authentication in order to perform unauthorized zone updates, altering the content of the zone. The attacker needs to have knowledge of the key name, and should be allowed by the other ACL restrictions if any. Impact ====== A remote attacker can bypass authentication in order to retrieve or update the content of a zone. References ========== https://kb.isc.org/article/AA-01504/74/CVE-2017-3142%3A-An-error-in-TSIG-au… https://kb.isc.org/article/AA-01503/74/CVE-2017-3143%3A-An-error-in-TSIG-au… https://security.archlinux.org/CVE-2017-3142 https://security.archlinux.org/CVE-2017-3143

1 0

[arch-security] [ASA-201707-2] systemd: arbitrary code execution
by Christian Rebischke 03 Jul '17

03 Jul '17

Arch Linux Security Advisory ASA-201707-2 ========================================= Severity: Critical Date : 2017-07-03 CVE-ID : CVE-2017-9445 Package : systemd Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-329 Summary ======= The package systemd before version 233-6 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 233-6. # pacman -Syu "systemd>=233-6" The problem has been fixed upstream in version 233. Workaround ========== None. Description =========== An out-of-bounds write was discovered in systemd-resolved when handling specially crafted DNS responses. A remote attacker could potentially exploit this to cause a denial of service (daemon crash) or execute arbitrary code. Impact ====== A remote attacker is able to craft a malicious DNS response to crash systemd-resolved or execute arbitrary code on the target host. References ========== https://bugs.archlinux.org/task/54619 http://seclists.org/oss-sec/2017/q2/618 https://security.archlinux.org/CVE-2017-9445

1 0

[arch-security] [ASA-201707-1] libgcrypt: private key recovery
by Remi Gacogne 03 Jul '17

03 Jul '17

Arch Linux Security Advisory ASA-201707-1 ========================================= Severity: High Date : 2017-07-03 CVE-ID : CVE-2017-7526 Package : libgcrypt Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-338 Summary ======= The package libgcrypt before version 1.7.8-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1.7.8-1. # pacman -Syu "libgcrypt>=1.7.8-1" The problem has been fixed upstream in version 1.7.8. Workaround ========== None. Description =========== The pattern of squarings and multiplications in left-to-right sliding windows in libgcrypt <= 1.7.7 leaks significant information about exponent bits, allowing for the very efficient recovery of a full 1024-bit RSA key. Impact ====== A local attacker can use a side-channel attack to recover a secret private key. References ========== https://eprint.iacr.org/2017/627 https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=a9f… https://security.archlinux.org/CVE-2017-7526

1 0