October 2018 - Arch-security - lists.archlinux.org

[ASA-201810-16] gitlab: multiple issues
by Jelle van der Waa 31 Oct '18

31 Oct '18

Arch Linux Security Advisory ASA-201810-16 ========================================== Severity: Critical Date : 2018-10-31 CVE-ID : CVE-2018-18640 CVE-2018-18641 CVE-2018-18643 CVE-2018-18645 CVE-2018-18646 CVE-2018-18648 CVE-2018-18649 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-794 Summary ======= The package gitlab before version 11.4.3-1 is vulnerable to multiple issues including arbitrary code execution, cross-site request forgery, cross-site scripting and information disclosure. Resolution ========== Upgrade to 11.4.3-1. # pacman -Syu "gitlab>=11.4.3-1" The problems have been fixed upstream in version 11.4.3. Workaround ========== None. Description =========== - CVE-2018-18640 (information disclosure) A security issue has been found in gitlab versions prior to 11.4.3, where private project pages had inadequate cache control, which resulted in unauthorized users being able to view them in the browser. - CVE-2018-18641 (information disclosure) A security issue has been found in gitlab versions prior to 11.4.3, where personal access tokens were being stored unencrypted as plain text in the database which could result in attackers potentially reading them via SQL injection or other database leaks. - CVE-2018-18643 (cross-site scripting) A security issue has been found in gitlab versions prior to 11.4.3, where the fragment identifier (hash) of several pages contained a lack of input validation and output encoding issue which resulted in a persistent XSS. - CVE-2018-18645 (information disclosure) A security issue has been found in gitlab versions prior to 11.4.3, where when replying to an issue through email, with the GitLab email footer included, a user's unsubscribe link would be included in the issue. This information is considered sensitive. - CVE-2018-18646 (cross-site request forgery) A security issue has been found in gitlab versions prior to 11.4.3, where the Hipchat integration was vulnerable to a SSRF issue which allowed an attacker to make requests to any local network resource accessible from the GitLab server. - CVE-2018-18648 (information disclosure) A security issue has been found in gitlab versions prior to 11.4.3, where a JSON endpoint was disclosing Gem version information which could result in an attacker discovering vulnerable Gems available on a specific GitLab instance. - CVE-2018-18649 (arbitrary code execution) A security issue has been found in gitlab versions prior to 11.4.3, where the wiki API contained an input validation issue which resulted in remote code execution. Impact ====== A remote attacker is able to execute arbitrary code, disclose information, perform cross-site request forgery or cross-site scripting. References ========== https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-… https://gitlab.com/gitlab-org/gitlab-ce/commit/5e125b0f84ad768d7ff19905d038… https://gitlab.com/gitlab-org/gitlab-ce/commit/daed01a5ca348e7d267b50e325bf… https://gitlab.com/gitlab-org/gitlab-ce/commit/5342df04045e1c8a98fdb9fe8203… https://gitlab.com/gitlab-org/gitlab-ce/commit/82c12bd8bf9e0ea9e8df3bbcad91… https://gitlab.com/gitlab-org/gitlab-ce/commit/f17e36feab266a62b316bfe88d7d… https://gitlab.com/gitlab-org/gitlab-ce/commit/b9b68fe7d30778338625fb606457… https://gitlab.com/gitlab-org/gitlab-ce/commit/e05636e2794d975876958c3781b6… https://security.archlinux.org/CVE-2018-18640 https://security.archlinux.org/CVE-2018-18641 https://security.archlinux.org/CVE-2018-18643 https://security.archlinux.org/CVE-2018-18645 https://security.archlinux.org/CVE-2018-18646 https://security.archlinux.org/CVE-2018-18648 https://security.archlinux.org/CVE-2018-18649

1 0

[ASA-201810-15] xorg-server: privilege escalation
by Remi Gacogne 29 Oct '18

29 Oct '18

Arch Linux Security Advisory ASA-201810-15 ========================================== Severity: High Date : 2018-10-29 CVE-ID : CVE-2018-14665 Package : xorg-server Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-788 Summary ======= The package xorg-server before version 1.20.3-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.20.3-1. # pacman -Syu "xorg-server>=1.20.3-1" The problem has been fixed upstream in version 1.20.3. Workaround ========== None. Description =========== Incorrect command-line parameter validation in the Xorg X server can lead to privilege elevation and/or arbitrary files overwrite, when the X server is installed with the setuid bit set and unprivileged users have the ability to log in to the system via physical console. The -modulepath argument can be used to specify an insecure path to modules that are going to be loaded in the X server, allowing to execute unprivileged code in the privileged process. The -logfile argument can be used to overwrite arbitrary files in the file system, due to incorrect checks in the parsing of the option. Impact ====== A local attacker can elevate privileges to root by passing crafted parameters to the Xorg X server. References ========== https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49… https://gitlab.freedesktop.org/xorg/xserver/commit/032b1d79b7 https://www.openwall.com/lists/oss-security/2018/10/25/1 https://security.archlinux.org/CVE-2018-14665

1 0

[ASA-201810-14] firefox: multiple issues
by Remi Gacogne 26 Oct '18

26 Oct '18

Arch Linux Security Advisory ASA-201810-14 ========================================== Severity: Critical Date : 2018-10-24 CVE-ID : CVE-2018-12388 CVE-2018-12390 CVE-2018-12392 CVE-2018-12395 CVE-2018-12396 CVE-2018-12397 CVE-2018-12398 CVE-2018-12399 CVE-2018-12401 CVE-2018-12402 CVE-2018-12403 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-787 Summary ======= The package firefox before version 63.0-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, privilege escalation, content spoofing, denial of service and information disclosure. Resolution ========== Upgrade to 63.0-1. # pacman -Syu "firefox>=63.0-1" The problems have been fixed upstream in version 63.0. Workaround ========== None. Description =========== - CVE-2018-12388 (arbitrary code execution) Several memory safety bugs have been found in Firefox versions prior to 63.0. Some of these bugs showed evidence of memory corruption and Mozilla engineers presume that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-12390 (arbitrary code execution) Several memory safety bugs have been found in Firefox versions prior to 63.0. Some of these bugs showed evidence of memory corruption and Mozilla engineers presume that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-12392 (arbitrary code execution) A security issue has been found in Firefox versions prior to 63.0. When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. - CVE-2018-12395 (access restriction bypass) A security issue has been found in Firefox versions prior to 63.0, where by rewriting the Host request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. - CVE-2018-12396 (privilege escalation) A security issue has been found in Firefox versions prior to 63.0, where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. - CVE-2018-12397 (access restriction bypass) A security issue has been found in Firefox versions prior to 63.0, where a WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. - CVE-2018-12398 (access restriction bypass) A security issue has been found in Firefox versions prior to 63.0, where it is possible to inject stylesheets and bypass Content Security Policy (CSP) by using the reflected URL in some special resource URIs, such as chrome:. - CVE-2018-12399 (content spoofing) A security issue has been found in Firefox versions prior to 63.0, where when a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the new protocol. This may result in the user approving a protocol handler that they otherwise would not have. - CVE-2018-12401 (denial of service) A security issue has been found in Firefox versions prior to 63.0, where some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This could lead to denial of service (DOS) attacks. - CVE-2018-12402 (information disclosure) A security issue has been found in Firefox versions prior to 63.0, where SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page, violating cookie policy. This can result in saving the wrong version of resources based on those cookies. - CVE-2018-12403 (content spoofing) A security issue has been found in Firefox versions prior to 63.0, where if a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. Impact ====== A remote attacker can bypass domain restrictions, bypass various warnings, crash the browser, escalate privileges and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1472639%2C1485698%2C1301547… https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1487098%2C1487660%2C1490234… https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1492823 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1467523 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1483602 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1487478 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1460538 https://bugzilla.mozilla.org/show_bug.cgi?id=1488061 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1490276 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-124… https://bugzilla.mozilla.org/show_bug.cgi?id=1422456 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-124… https://bugzilla.mozilla.org/show_bug.cgi?id=1469916 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-124… https://bugzilla.mozilla.org/show_bug.cgi?id=1484753 https://security.archlinux.org/CVE-2018-12388 https://security.archlinux.org/CVE-2018-12390 https://security.archlinux.org/CVE-2018-12392 https://security.archlinux.org/CVE-2018-12395 https://security.archlinux.org/CVE-2018-12396 https://security.archlinux.org/CVE-2018-12397 https://security.archlinux.org/CVE-2018-12398 https://security.archlinux.org/CVE-2018-12399 https://security.archlinux.org/CVE-2018-12401 https://security.archlinux.org/CVE-2018-12402 https://security.archlinux.org/CVE-2018-12403

1 0

[ASA-201810-13] thunderbird: multiple issues
by Santiago Torres-Arias 19 Oct '18

19 Oct '18

Arch Linux Security Advisory ASA-201810-13 ========================================== Severity: Critical Date : 2018-10-18 CVE-ID : CVE-2018-12376 CVE-2018-12377 CVE-2018-12378 CVE-2018-12379 CVE-2018-12383 CVE-2018-12385 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-782 Summary ======= The package thunderbird before version 60.2.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 60.2.1-1. # pacman -Syu "thunderbird>=60.2.1-1" The problems have been fixed upstream in version 60.2.1. Workaround ========== None. Description =========== - CVE-2018-12376 (arbitrary code execution) Several memory safety bugs have been found in Thunderbird versions prior to 60.2.1. - CVE-2018-12377 (arbitrary code execution) A use-after-free vulnerability has been found in Thunderbird versions prior to 60.2.1, which can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use. This results in a potentially exploitable crash. - CVE-2018-12378 (arbitrary code execution) A use-after-free vulnerability has been found in Thunderbird versions prior to 60.2.1, which can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored. This results in a potentially exploitable crash. - CVE-2018-12379 (arbitrary code execution) A security issue has been found in Thunderbird versions prior to 60.2.1. When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash. This requires running the Mozilla Updater manually on the local system with the malicious MAR file in order to occur. - CVE-2018-12383 (information disclosure) A security issue has been found in Thunderbird versions prior to 60.2.1. If a user saved passwords before the move to a new password format and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. - CVE-2018-12385 (arbitrary code execution) A security issue has been found in Thunderbird versions prior to 60.2.1. A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/60424 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1469309%2C1469914%2C1450989… https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1470260 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1459383 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1473113 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1475775 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1490585 https://security.archlinux.org/CVE-2018-12376 https://security.archlinux.org/CVE-2018-12377 https://security.archlinux.org/CVE-2018-12378 https://security.archlinux.org/CVE-2018-12379 https://security.archlinux.org/CVE-2018-12383 https://security.archlinux.org/CVE-2018-12385

1 0

[ASA-201810-12] chromium: multiple issues
by Remi Gacogne 18 Oct '18

18 Oct '18

Arch Linux Security Advisory ASA-201810-12 ========================================== Severity: Critical Date : 2018-10-17 CVE-ID : CVE-2018-5179 CVE-2018-17462 CVE-2018-17463 CVE-2018-17464 CVE-2018-17465 CVE-2018-17466 CVE-2018-17467 CVE-2018-17468 CVE-2018-17469 CVE-2018-17470 CVE-2018-17471 CVE-2018-17473 CVE-2018-17474 CVE-2018-17475 CVE-2018-17476 CVE-2018-17477 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-781 Summary ======= The package chromium before version 70.0.3538.67-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, sandbox escape, information disclosure and denial of service. Resolution ========== Upgrade to 70.0.3538.67-1. # pacman -Syu "chromium>=70.0.3538.67-1" The problems have been fixed upstream in version 70.0.3538.67. Workaround ========== None. Description =========== - CVE-2018-5179 (denial of service) A security issue has been found in the ServiceWorker component of the chromium browser before 70.0.3538.67, due to a lack of limits on the update() function. - CVE-2018-17462 (sandbox escape) A sandbox escape has been found in the AppCache component of the chromium browser before 70.0.3538.67. - CVE-2018-17463 (arbitrary code execution) A remote code execution issue has been found in the V8 component of the chromium browser before 70.0.3538.67. - CVE-2018-17464 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the chromium browser before 70.0.3538.67. - CVE-2018-17465 (arbitrary code execution) A use-after-free issue has been found in the V8 component of the chromium browser before 70.0.3538.67. - CVE-2018-17466 (arbitrary code execution) A memory corruption issue has been found in the Angle component of the chromium browser before 70.0.3538.67. - CVE-2018-17467 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the chromium browser before 70.0.3538.67. - CVE-2018-17468 (information disclosure) A cross-origin URL disclosure issue has been found in the Blink component of the chromium browser before 70.0.3538.67. - CVE-2018-17469 (arbitrary code execution) A heap-based buffer overflow has been found in the PDFium component of the chromium browser before 70.0.3538.67. - CVE-2018-17470 (arbitrary code execution) A memory corruption issue has been found in the GPU internals component of the chromium browser before 70.0.3538.67. - CVE-2018-17471 (content spoofing) A security UI occlusion has been found in the the full screen mode of the chromium browser before 70.0.3538.67. - CVE-2018-17473 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the chromium browser before 70.0.3538.67. - CVE-2018-17474 (arbitrary code execution) A use-after-free has been found in the Blink component of the chromium browser before 70.0.3538.67. - CVE-2018-17475 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the chromium browser before 70.0.3538.67. - CVE-2018-17476 (content spoofing) A security UI occlusion has been found in the the full screen mode of the chromium browser before 70.0.3538.67. - CVE-2018-17477 (content spoofing) A UI spoofing issue has been found in the Extensions component of the chromium browser before 70.0.3538.67. Impact ====== A remote attacker can spoof the URL or the security status of a page, access sensitive information, crash the browser or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=805496 https://bugs.chromium.org/p/chromium/issues/detail?id=888926 https://bugs.chromium.org/p/chromium/issues/detail?id=888923 https://bugs.chromium.org/p/chromium/issues/detail?id=887273 https://bugs.chromium.org/p/chromium/issues/detail?id=870226 https://bugs.chromium.org/p/chromium/issues/detail?id=880906 https://bugs.chromium.org/p/chromium/issues/detail?id=844881 https://bugs.chromium.org/p/chromium/issues/detail?id=876822 https://bugs.chromium.org/p/chromium/issues/detail?id=880675 https://bugs.chromium.org/p/chromium/issues/detail?id=877874 https://bugs.chromium.org/p/chromium/issues/detail?id=873080 https://bugs.chromium.org/p/chromium/issues/detail?id=882078 https://bugs.chromium.org/p/chromium/issues/detail?id=843151 https://bugs.chromium.org/p/chromium/issues/detail?id=852634 https://bugs.chromium.org/p/chromium/issues/detail?id=812769 https://bugs.chromium.org/p/chromium/issues/detail?id=863703 https://security.archlinux.org/CVE-2018-5179 https://security.archlinux.org/CVE-2018-17462 https://security.archlinux.org/CVE-2018-17463 https://security.archlinux.org/CVE-2018-17464 https://security.archlinux.org/CVE-2018-17465 https://security.archlinux.org/CVE-2018-17466 https://security.archlinux.org/CVE-2018-17467 https://security.archlinux.org/CVE-2018-17468 https://security.archlinux.org/CVE-2018-17469 https://security.archlinux.org/CVE-2018-17470 https://security.archlinux.org/CVE-2018-17471 https://security.archlinux.org/CVE-2018-17473 https://security.archlinux.org/CVE-2018-17474 https://security.archlinux.org/CVE-2018-17475 https://security.archlinux.org/CVE-2018-17476 https://security.archlinux.org/CVE-2018-17477

1 0

[ASA-201810-11] net-snmp: multiple issues
by Levente Polyak 17 Oct '18

17 Oct '18

Arch Linux Security Advisory ASA-201810-11 ========================================== Severity: High Date : 2018-10-17 CVE-ID : CVE-2015-5621 CVE-2018-18065 Package : net-snmp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-777 Summary ======= The package net-snmp before version 5.8-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.8-1. # pacman -Syu "net-snmp>=5.8-1" The problems have been fixed upstream in version 5.8. Workaround ========== None. Description =========== - CVE-2015-5621 (arbitrary code execution) It was discovered that in net-snmp before 5.8 the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables. A remote, unauthenticated attacker could use this flaw to crash snmpd or potentially execute arbitrary code on the system with the privileges of the user running snmpd. - CVE-2018-18065 (denial of service) A denial of service vulnerability has been discovered in net-snmp before 5.8. The _set_key function in agent/helpers/table_container.c has a NULL pointer exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in denial of service. Impact ====== A remote unauthenticated attacker is able to crash snmpd or potentially execute arbitrary code on the system by sending specially crafted packets. References ========== https://seclists.org/oss-sec/2018/q4/24 https://sourceforge.net/p/net-snmp/bugs/2615/ https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc7… https://www.openwall.com/lists/oss-security/2015/04/13/1 https://bugzilla.redhat.com/show_bug.cgi?id=1212408 https://sourceforge.net/p/net-snmp/bugs/2743/ https://sourceforge.net/p/net-snmp/code/ci/7ffb8e25a0db851953155de91f0170e9… https://dumpco.re/blog/net-snmp-5.7.3-remote-dos https://security.archlinux.org/CVE-2015-5621 https://security.archlinux.org/CVE-2018-18065

1 0

[ASA-201810-10] libssh: authentication bypass
by Levente Polyak 17 Oct '18

17 Oct '18

Arch Linux Security Advisory ASA-201810-10 ========================================== Severity: Critical Date : 2018-10-17 CVE-ID : CVE-2018-10933 Package : libssh Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-780 Summary ======= The package libssh before version 0.8.4-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 0.8.4-1. # pacman -Syu "libssh>=0.8.4-1" The problem has been fixed upstream in version 0.8.4. Workaround ========== None. Description =========== An authentication bypass vulnerability has been discovered in libssh versions prior to 0.7.6 and 0.8.4, in the server-side state machine. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authenticate without any credentials, resulting in unauthorized access. Impact ====== A remote attacker is able to successfully authenticate without any credentials, resulting in unauthorized access. References ========== https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfi… https://www.libssh.org/security/advisories/CVE-2018-10933.txt https://git.libssh.org/projects/libssh.git/commit/?id=2bddafeb709eacc80ad31… https://git.libssh.org/projects/libssh.git/commit/?id=825f4ba96407abe8cebb0… https://git.libssh.org/projects/libssh.git/commit/?id=20981bf2296202e95d791… https://git.libssh.org/projects/libssh.git/commit/?id=5d7414467d6dac100a93d… https://git.libssh.org/projects/libssh.git/commit/?id=459868c4a57d2d11cf783… https://git.libssh.org/projects/libssh.git/commit/?id=68b0c7a93448123cc0d6a… https://git.libssh.org/projects/libssh.git/commit/?id=75be012b4a14f4550ce6a… https://git.libssh.org/projects/libssh.git/commit/?id=e1548a71bdac73da08417… https://security.archlinux.org/CVE-2018-10933

1 0

[ASA-201810-9] wireshark-cli: multiple issues
by Remi Gacogne 12 Oct '18

12 Oct '18

Arch Linux Security Advisory ASA-201810-9 ========================================= Severity: High Date : 2018-10-12 CVE-ID : CVE-2018-12086 CVE-2018-18225 CVE-2018-18226 CVE-2018-18227 Package : wireshark-cli Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-779 Summary ======= The package wireshark-cli before version 2.6.4-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.6.4-1. # pacman -Syu "wireshark-cli>=2.6.4-1" The problems have been fixed upstream in version 2.6.4. Workaround ========== None. Description =========== - CVE-2018-12086 (arbitrary code execution) A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the OpcUa dissector where a specially crafted structured request could lead to stack overflow. This could be used by an attacker to crash wireshark or execute arbitrary code on the affected host by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2018-18225 (denial of service) A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the CoAP dissector where an invalid frame could lead to NULL-pointer dereference. This could be used by an attacker to crash wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2018-18226 (denial of service) A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the Steam IHS Discovery dissector where dynamically allocated memory was not properly freed on exception. This could be used by an attacker to crash wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2018-18227 (denial of service) A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the MS-WSP dissector where an invalid type could lead to an assertion failure. This could be used by an attacker to crash wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== An attacker can crash wireshark or execute arbitrary code on the affected host by injecting a malformed packet onto the wire or by convincing a local user to read a malformed packet trace file. References ========== https://www.wireshark.org/docs/relnotes/wireshark-2.6.4.html https://www.wireshark.org/security/wnpa-sec-2018-50 https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foun… https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=fc9… https://www.wireshark.org/security/wnpa-sec-2018-49 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15172 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=b2b… https://www.wireshark.org/security/wnpa-sec-2018-48 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15171 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=6e9… https://www.wireshark.org/security/wnpa-sec-2018-47 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15119 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=536… https://security.archlinux.org/CVE-2018-12086 https://security.archlinux.org/CVE-2018-18225 https://security.archlinux.org/CVE-2018-18226 https://security.archlinux.org/CVE-2018-18227

1 0

[ASA-201810-8] patch: multiple issues
by Remi Gacogne 10 Oct '18

10 Oct '18

Arch Linux Security Advisory ASA-201810-8 ========================================= Severity: High Date : 2018-10-09 CVE-ID : CVE-2018-6951 CVE-2018-6952 CVE-2018-1000156 Package : patch Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-619 Summary ======= The package patch before version 2.7.6-3 is vulnerable to multiple issues including arbitrary command execution and denial of service. Resolution ========== Upgrade to 2.7.6-3. # pacman -Syu "patch>=2.7.6-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2018-6951 (denial of service) An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue. - CVE-2018-6952 (denial of service) A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patches. - CVE-2018-1000156 (arbitrary command execution) An arbitrary command execution vulnerability has been found in patch versions prior to 2.7.7 when applying ed-style patches. Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch to pass certain ed scripts to the ed editor, which would run commands. This issue could be exploited to execute arbitrary commands as the user invoking patch against a specially crafted patch file, which could be leveraged to obtain elevated privileges. Impact ====== An attacker can execute arbitrary commands or crash the patch utility via a specially crafted patch file. References ========== https://bugs.archlinux.org/task/57526 https://savannah.gnu.org/bugs/?53132 https://git.savannah.gnu.org/cgit/patch.git/commit/?id=f290f48a621867084884… https://savannah.gnu.org/bugs/?53133 https://git.savannah.gnu.org/cgit/patch.git/commit/?id=9c986353e420ead6e706… https://savannah.gnu.org/bugs/?53566 https://git.savannah.gnu.org/cgit/patch.git/commit/?id=123eaff0d5d1aebe1282… https://security.archlinux.org/CVE-2018-6951 https://security.archlinux.org/CVE-2018-6952 https://security.archlinux.org/CVE-2018-1000156

1 0

[ASA-201810-7] git: arbitrary code execution
by Remi Gacogne 09 Oct '18

09 Oct '18

Arch Linux Security Advisory ASA-201810-7 ========================================= Severity: High Date : 2018-10-09 CVE-ID : CVE-2018-17456 Package : git Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-776 Summary ======= The package git before version 2.19.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.19.1-1. # pacman -Syu "git>=2.19.1-1" The problem has been fixed upstream in version 2.19.1. Workaround ========== None. Description =========== A security issue has been found in git versions prior to 2.19.1, which allows an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules. When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone". Impact ====== A remote attacker can execute arbitrary code on the affected host by convincing a local user to clone a specially crafted git repository and its sub-modules. References ========== https://marc.info/?l=git&m=153875888916397&w=2 https://git.kernel.org/pub/scm/git/git.git/commit/?id=98afac7a7cefdca0d2c49… https://git.kernel.org/pub/scm/git/git.git/commit/?id=f6adec4e329ef0e25e14c… https://git.kernel.org/pub/scm/git/git.git/commit/?id=273c61496f88c6495b886… https://security.archlinux.org/CVE-2018-17456

1 0