September 2017 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201709-23] ffmpeg2.8: denial of service
by Levente Polyak 28 Sep '17

28 Sep '17

Arch Linux Security Advisory ASA-201709-23 ========================================== Severity: Medium Date : 2017-09-28 CVE-ID : CVE-2017-14055 CVE-2017-14056 CVE-2017-14057 CVE-2017-14058 CVE-2017-14059 CVE-2017-14169 CVE-2017-14170 CVE-2017-14171 CVE-2017-14225 Package : ffmpeg2.8 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-405 Summary ======= The package ffmpeg2.8 before version 2.8.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.8.13-1. # pacman -Syu "ffmpeg2.8>=2.8.13-1" The problems have been fixed upstream in version 2.8.13. Workaround ========== None. Description =========== - CVE-2017-14055 (denial of service) In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14056 (denial of service) In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops. - CVE-2017-14057 (denial of service) In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops. - CVE-2017-14058 (denial of service) In FFmpeg 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop). - CVE-2017-14059 (denial of service) In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14169 (denial of service) In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value. - CVE-2017-14170 (denial of service) In libavformat/mxfdec.c in FFmpeg 3.3.3, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file. - CVE-2017-14171 (denial of service) In libavformat/nsvdec.c in FFmpeg 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop. - CVE-2017-14225 (denial of service) The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. Impact ====== A remote attacker is able to crash the application while watching a HLS stream. Furthermore an attacker is able to crash the application by tricking the user into opening a specially crafted video file. References ========== https://github.com/FFmpeg/FFmpeg/commit/4f05e2e2dc1a89f38cd9f0960a6561083d7… https://github.com/FFmpeg/FFmpeg/commit/96f24d1bee7fe7bac08e2b7c74db1a046c9… https://github.com/FFmpeg/FFmpeg/commit/7f9ec5593e04827249e7aeb466da06a98a0… https://github.com/FFmpeg/FFmpeg/commit/7ec414892ddcad88313848494b6fc5f437c… https://github.com/FFmpeg/FFmpeg/commit/7e80b63ecd259d69d383623e75b318bf2bd… https://github.com/FFmpeg/FFmpeg/commit/9d00fb9d70ee8c0cc7002b89318c5be00f1… https://github.com/FFmpeg/FFmpeg/commit/900f39692ca0337a98a7cf047e4e2611071… https://github.com/FFmpeg/FFmpeg/commit/c24bcb553650b91e9eff15ef6e54ca73de2… https://github.com/FFmpeg/FFmpeg/commit/837cb4325b712ff1aab531bf41668933f61… https://security.archlinux.org/CVE-2017-14055 https://security.archlinux.org/CVE-2017-14056 https://security.archlinux.org/CVE-2017-14057 https://security.archlinux.org/CVE-2017-14058 https://security.archlinux.org/CVE-2017-14059 https://security.archlinux.org/CVE-2017-14169 https://security.archlinux.org/CVE-2017-14170 https://security.archlinux.org/CVE-2017-14171 https://security.archlinux.org/CVE-2017-14225

1 0

[arch-security] [ASA-201709-22] nvidia: multiple issues
by Levente Polyak 28 Sep '17

28 Sep '17

Arch Linux Security Advisory ASA-201709-22 ========================================== Severity: High Date : 2017-09-28 CVE-ID : CVE-2017-6266 CVE-2017-6267 CVE-2017-6272 Package : nvidia Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-418 Summary ======= The package nvidia before version 384.90-1 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 384.90-1. # pacman -Syu "nvidia>=384.90-1" The problems have been fixed upstream in version 384.90. Workaround ========== None. Description =========== - CVE-2017-6266 (denial of service) NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where improper access controls could allow unprivileged users to cause a denial of service. - CVE-2017-6267 (denial of service) NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where an incorrect initialization of internal objects can cause an infinite loop, which may lead to a denial of service. - CVE-2017-6272 (privilege escalation) NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used as the index to an array, which may lead to a denial of service or possible escalation of privileges. Impact ====== A remote attacker who is able to invoke certain graphics API calls may be able to escalate privileges or crash the system on the affected host. References ========== https://nvidia.custhelp.com/app/answers/detail/a_id/4544 https://security.archlinux.org/CVE-2017-6266 https://security.archlinux.org/CVE-2017-6267 https://security.archlinux.org/CVE-2017-6272

1 0

[arch-security] [ASA-201709-21] openvpn: arbitrary code execution
by Levente Polyak 28 Sep '17

28 Sep '17

Arch Linux Security Advisory ASA-201709-21 ========================================== Severity: Medium Date : 2017-09-28 CVE-ID : CVE-2017-12166 Package : openvpn Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-420 Summary ======= The package openvpn before version 2.4.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.4.4-1. # pacman -Syu "openvpn>=2.4.4-1" The problem has been fixed upstream in version 2.4.4. Workaround ========== Ensure 'key-method 2' is used (default value). Description =========== The bounds check in the read_key() function in OpenVPN before 2.4.4 and 2.3.18 was performed after using the value, instead of before. If 'key-method 1' is used, this allowed an attacker to send a malformed packet to trigger a stack buffer overflow. Note that 'key-method 1' has been replaced by 'key method 2' as the default in OpenVPN 2.0 (released on 2005-04-17), and explicitly deprecated in 2.4 and marked for removal in 2.5. This should limit the amount of users impacted by this issue. Impact ====== A remote attacker is able to execute arbitrary code on the affected host when an old key-method is configured. References ========== https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 https://github.com/OpenVPN/openvpn/commit/3b1a61e9fb27213c46f76312f4065816b… https://security.archlinux.org/CVE-2017-12166

1 0

[arch-security] [ASA-201709-20] weechat: denial of service
by Christian Rebischke 27 Sep '17

27 Sep '17

Arch Linux Security Advisory ASA-201709-20 ========================================== Severity: Medium Date : 2017-09-25 CVE-ID : CVE-2017-14727 Package : weechat Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-412 Summary ======= The package weechat before version 1.9.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.9.1-1. # pacman -Syu "weechat>=1.9.1-1" The problem has been fixed upstream in version 1.9.1. Workaround ========== Unload the logger plugin: /plugin unload logger Description =========== It has been discovered that in logger.c in the logger plugin before weechat 1.9.1 the date/time conversion specifiers are expanded after replacing buffer local variables in name of log files. In some cases, this can lead to an error in function strftime and a crash caused by the use of an uninitialized buffer. Impact ====== A remote attacker can crash the client via a specially crafted string. References ========== https://weechat.org/download/security/ https://github.com/weechat/weechat/commit/e4cc90f4b43153dc1c6516c1f1aad2504… https://security.archlinux.org/CVE-2017-14727

1 0

[arch-security] Subject: [ASA-201709-20] weechat: denial of service
by Christian Rebischke 26 Sep '17

26 Sep '17

Subject: [ASA-201709-20] weechat: denial of service Arch Linux Security Advisory ASA-201709-20 ========================================== Severity: Medium Date : 2017-09-25 CVE-ID : CVE-2017-14727 Package : weechat Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-412 Summary ======= The package weechat before version 1.9.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.9.1-1. # pacman -Syu "weechat>=1.9.1-1" The problem has been fixed upstream in version 1.9.1. Workaround ========== Unload the logger plugin: /plugin unload logger Description =========== It has been discovered that in logger.c in the logger plugin before weechat 1.9.1 the date/time conversion specifiers are expanded after replacing buffer local variables in name of log files. In some cases, this can lead to an error in function strftime and a crash caused by the use of an uninitialized buffer. Impact ====== A remote attacker can crash the client via a specially crafted string. References ========== https://weechat.org/download/security/ https://github.com/weechat/weechat/commit/e4cc90f4b43153dc1c6516c1f1aad2504… https://security.archlinux.org/CVE-2017-14727

1 0

[arch-security] [ASA-201709-19] chromium: arbitrary code execution
by Remi Gacogne 26 Sep '17

26 Sep '17

Arch Linux Security Advisory ASA-201709-19 ========================================== Severity: Critical Date : 2017-09-23 CVE-ID : CVE-2017-5121 CVE-2017-5122 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-411 Summary ======= The package chromium before version 61.0.3163.100-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 61.0.3163.100-1. # pacman -Syu "chromium>=61.0.3163.100-1" The problems have been fixed upstream in version 61.0.3163.100. Workaround ========== None. Description =========== - CVE-2017-5121 (arbitrary code execution) An out-of-bounds access has been found in the V8 component of the chromium browser before 61.0.3163.100. - CVE-2017-5122 (arbitrary code execution) An out-of-bounds access has been found in the V8 component of the chromium browser before 61.0.3163.100. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=765433 https://bugs.chromium.org/p/chromium/issues/detail?id=752423 https://security.archlinux.org/CVE-2017-5121 https://security.archlinux.org/CVE-2017-5122

1 0

[arch-security] [ASA-201709-18] libraw: multiple issues
by Levente Polyak 25 Sep '17

25 Sep '17

Arch Linux Security Advisory ASA-201709-18 ========================================== Severity: High Date : 2017-09-22 CVE-ID : CVE-2017-13735 CVE-2017-14265 Package : libraw Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-410 Summary ======= The package libraw before version 0.18.5-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.18.5-1. # pacman -Syu "libraw>=0.18.5-1" The problems have been fixed upstream in version 0.18.5. Workaround ========== None. Description =========== - CVE-2017-13735 (denial of service) There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2 leading to denial of service. - CVE-2017-14265 (arbitrary code execution) A stack-based buffer overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3 leading to denial of service or arbitrary code execution. Impact ====== An attacker is able to crash the application or execute arbitrary code by tricking the user into opening or processing a specially crafted image file. References ========== https://github.com/LibRaw/LibRaw/issues/96 https://bugzilla.redhat.com/show_bug.cgi?id=1483988 https://github.com/LibRaw/LibRaw/issues/99 https://security.archlinux.org/CVE-2017-13735 https://security.archlinux.org/CVE-2017-14265

1 0

[arch-security] [ASA-201709-17] tomcat7: information disclosure
by Levente Polyak 21 Sep '17

21 Sep '17

Arch Linux Security Advisory ASA-201709-17 ========================================== Severity: Medium Date : 2017-09-19 CVE-ID : CVE-2017-12616 Package : tomcat7 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-408 Summary ======= The package tomcat7 before version 7.0.81-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.0.81-1. # pacman -Syu "tomcat7>=7.0.81-1" The problem has been fixed upstream in version 7.0.81. Workaround ========== None. Description =========== It has been discovered that tomcat version 7.0.80 and before are vulnerable to information disclosure. When using a VirtualDirContext it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. Impact ====== A remote attacker is able to view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. References ========== http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81 https://mail-archives.apache.org/mod_mbox/tomcat-announce/201709.mbox/%3C0b… http://svn.apache.org/viewvc?view=revision&revision=1804729 https://security.archlinux.org/CVE-2017-12616

1 0

[arch-security] [ASA-201709-16] ettercap: multiple issues
by Jelle van der Waa 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-16 ========================================== Severity: High Date : 2017-09-18 CVE-ID : CVE-2017-6430 CVE-2017-8366 Package : ettercap Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-212 Summary ======= The package ettercap before version 0.8.2-5 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.8.2-5. # pacman -Syu "ettercap>=0.8.2-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-6430 (denial of service) The compile_tree function in ef_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows attackers to cause a denial of service (out-of-bounds read) via a crafted filter. - CVE-2017-8366 (arbitrary code execution) The strescape function in ec_strings.c in Ettercap 0.8.2 allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code via a crafted filter that is mishandled by etterfilter. Impact ====== An attacker is able to crash the application or execute arbitrary code by tricking the user to open a specially crafted filter. References ========== https://github.com/Ettercap/ettercap/issues/782 https://github.com/Ettercap/ettercap/commit/7f50c57b2101fe75592c8dc9960883b… https://github.com/Ettercap/ettercap/issues/792 https://github.com/Ettercap/ettercap/issues/789 https://github.com/Ettercap/ettercap/commit/1083d604930ebb9f350126b83802ecd… https://security.archlinux.org/CVE-2017-6430 https://security.archlinux.org/CVE-2017-8366

1 0

[arch-security] [ASA-201709-15] apache: information disclosure
by Levente Polyak 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-15 ========================================== Severity: High Date : 2017-09-18 CVE-ID : CVE-2017-9798 Package : apache Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-404 Summary ======= The package apache before version 2.4.27-2 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.4.27-2. # pacman -Syu "apache>=2.4.27-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== An use after free vulnerability has been discovered in Apache HTTP 2.4.27 that causes a corrupted Allow header to be constructed in response to HTTP OPTIONS requests. This can leak pieces of arbitrary memory from the server process that may contain secrets. The memory pieces change after multiple requests, so for a vulnerable host an arbitrary number of memory chunks can be leaked. The bug appears if a webmaster tries to use the "Limit" directive with an invalid HTTP method. Impact ====== A remote attacker is able to leak memory and potentially obtain sensitive information from the server process. References ========== https://bz.apache.org/bugzilla/show_bug.cgi?id=61207 https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1… http://www.openwall.com/lists/oss-security/2017/09/18/2 https://github.com/hannob/optionsbleed https://security.archlinux.org/CVE-2017-9798

1 0