October 2018 - Arch-security - lists.archlinux.org

[ASA-201810-6] firefox: multiple issues
by Remi Gacogne 04 Oct '18

04 Oct '18

Arch Linux Security Advisory ASA-201810-6 ========================================= Severity: Critical Date : 2018-10-04 CVE-ID : CVE-2018-12386 CVE-2018-12387 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-775 Summary ======= The package firefox before version 62.0.3-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 62.0.3-1. # pacman -Syu "firefox>=62.0.3-1" The problems have been fixed upstream in version 62.0.3. Workaround ========== None. Description =========== - CVE-2018-12386 (arbitrary code execution) A vulnerability has been found in Firefox before 62.0.3 in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. - CVE-2018-12387 (information disclosure) A vulnerability has been found in Firefox before 62.0.3 where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. Impact ====== A remote attacker can execute arbitrary code on the affected host via crafted Javascript code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1493900 https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1493903 https://security.archlinux.org/CVE-2018-12386 https://security.archlinux.org/CVE-2018-12387

1 0

[ASA-201810-5] python-django: information disclosure
by Jelle van der Waa 03 Oct '18

03 Oct '18

Arch Linux Security Advisory ASA-201810-5 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-16984 Package : python-django Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-773 Summary ======= The package python-django before version 2.1.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.1.2-1. # pacman -Syu "python-django>=2.1.2-1" The problem has been fixed upstream in version 2.1.2. Workaround ========== None. Description =========== If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view (but not change) permission to the user model were displayed the entire hash. While it's typically infeasible to reverse a strong password hash, if your site uses weaker password hashing algorithms such as MD5 or SHA1, it could be a problem. Impact ====== A remote authenticated administrator with change permissions is able to obtain the password hashes of users. References ========== https://www.djangoproject.com/weblog/2018/oct/01/security-release/ https://github.com/django/django/commit/c4bd5b597e0aa2432e4c867b86650f18af1… https://security.archlinux.org/CVE-2018-16984

1 0

[ASA-201810-4] lib32-libxml2: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-4 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : lib32-libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-673 Summary ======= The package lib32-libxml2 before version 2.9.8-4 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.8-4. # pacman -Syu "lib32-libxml2>=2.9.8-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in libxml2 <= 2.9.8 compiled with LZMA support enabled, in the xz_decomp function in xzlib.c. This flaw allows a remote attacker to cause a denial of service via an infinite loop, using a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR. Impact ====== A remote attacker is able to cause a denial of service by parsing a specially crafted XML payload. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=794914 https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e263… https://security.archlinux.org/CVE-2018-9251

1 0

[ASA-201810-3] libxml2: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-3 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-672 Summary ======= The package libxml2 before version 2.9.8-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.8-5. # pacman -Syu "libxml2>=2.9.8-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in libxml2 <= 2.9.8 compiled with LZMA support enabled, in the xz_decomp function in xzlib.c. This flaw allows a remote attacker to cause a denial of service via an infinite loop, using a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR. Impact ====== A remote attacker is able to cause a denial of service by parsing a specially crafted XML payload. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=794914 https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e263… https://security.archlinux.org/CVE-2018-9251

1 0

[ASA-201810-3] libxml2: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-3 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-672 Summary ======= The package libxml2 before version 2.9.8-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.8-5. # pacman -Syu "libxml2>=2.9.8-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in libxml2 <= 2.9.8 compiled with LZMA support enabled, in the xz_decomp function in xzlib.c. This flaw allows a remote attacker to cause a denial of service via an infinite loop, using a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR. Impact ====== A remote attacker is able to cause a denial of service by parsing a specially crafted XML payload. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=794914 https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e263… https://security.archlinux.org/CVE-2018-9251

1 0

[ASA-201810-2] ntp: arbitrary code execution
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-2 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-12327 Package : ntp Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-723 Summary ======= The package ntp before version 4.2.8.p12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.2.8.p12-1. # pacman -Syu "ntp>=4.2.8.p12-1" The problem has been fixed upstream in version 4.2.8.p12. Workaround ========== None. Description =========== Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. Impact ====== A local attacker is able to execute arbitrary code via specially crafted command line options. References ========== https://gist.github.com/fakhrizulkifli/9b58ed8e0354e8deee50b0eebd1c011f http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=5b3ba863G-42Ac2TFzCy-PZ8vqNfVA https://security.archlinux.org/CVE-2018-12327

1 0

[ASA-201810-1] mosquitto: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-1 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-12543 Package : mosquitto Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-772 Summary ======= The package mosquitto before version 1.5.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.5.3-1. # pacman -Syu "mosquitto>=1.5.3-1" The problem has been fixed upstream in version 1.5.3. Workaround ========== None. Description =========== If a message is sent to Mosquitto before 1.5.3 with a topic that begins with $, but is not $SYS, then an assert that should be unreachable is triggered and Mosquitto will exit. Impact ====== A remote attacker is able to cause a denial of service by sending a specially crafted mqtt message. References ========== https://mosquitto.org/blog/2018/09/security-advisory-cve-2018-12543/ https://github.com/eclipse/mosquitto/commit/f7474d348225bf086f6b9c69b18d641… https://security.archlinux.org/CVE-2018-12543

1 0