November 2018 - Arch-security - lists.archlinux.org

[ASA-201811-12] powerdns: denial of service
by Remi Gacogne 13 Nov '18

13 Nov '18

Arch Linux Security Advisory ASA-201811-12 ========================================== Severity: Medium Date : 2018-11-12 CVE-ID : CVE-2018-10851 CVE-2018-14626 Package : powerdns Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-804 Summary ======= The package powerdns before version 4.1.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.1.5-1. # pacman -Syu "powerdns>=4.1.5-1" The problems have been fixed upstream in version 4.1.5. Workaround ========== None. Description =========== - CVE-2018-10851 (denial of service) An issue has been found in PowerDNS Authoritative Server before 4.1.5 and PowerDNS Recursor before 4.1.5. The issue is due to the fact that some memory is allocated before the parsing and is not always properly released if the record is malformed. In the authoritative server case, it allows an authorized user to cause a memory leak by inserting a specially crafted record in a zone under their control, then sending a DNS query for that record. In the case of the recursor, it allows a malicious authoritative server to cause a memory leak by sending specially crafted records. - CVE-2018-14626 (denial of service) An issue has been found in PowerDNS Authoritative Server before 4.1.5 and PowerDNS Recursor before 4.1.5, allowing a remote user to craft a DNS query that will cause an answer without DNSSEC records to be inserted into the packet cache and be returned to clients asking for DNSSEC records, thus hiding the presence of DNSSEC signatures for a specific qname and qtype. For a DNSSEC-signed domain, this means that DNSSEC validating clients will consider the answer to be bogus until it expires from the packet cache, leading to a denial of service. Impact ====== A remote attacker might be able to use crafted queries to crash the PowerDNS server or force it to serve answers without DNSSEC-related records to DNSSEC-enabled queries, causing validation failures. References ========== https://docs.powerdns.com/authoritative/security-advisories/powerdns-adviso… https://docs.powerdns.com/authoritative/security-advisories/powerdns-adviso… https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://security.archlinux.org/CVE-2018-10851 https://security.archlinux.org/CVE-2018-14626

1 0

[ASA-201811-11] systemd: multiple issues
by Jelle van der Waa 11 Nov '18

11 Nov '18

Arch Linux Security Advisory ASA-201811-11 ========================================== Severity: Critical Date : 2018-11-07 CVE-ID : CVE-2018-15686 CVE-2018-15687 CVE-2018-15688 Package : systemd Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-789 Summary ======= The package systemd before version 239.300-1 is vulnerable to multiple issues including arbitrary code execution and privilege escalation. Resolution ========== Upgrade to 239.300-1. # pacman -Syu "systemd>=239.300-1" The problems have been fixed upstream in version 239.300. Workaround ========== - CVE-2018-15688 Disable IPv6 by setting either LinkLocalAddressing=ipv4 or LinkLocalAddressing=no in the corresponding network configuration file. Description =========== - CVE-2018-15686 (privilege escalation) A security issue has been found in systemd up to and including 239, where the use of fgets() allows an attacker to escalate privilege via a crafted service with NotifyAccess. - CVE-2018-15687 (privilege escalation) A security issue has been found in systemd up to and including 239, where a race condition in the chown_one() function can be used to escalate privileges via a crafted symlink. - CVE-2018-15688 (arbitrary code execution) An out-of-bounds write has been found in the dhcpv6 option handing code of systemd-networkd up to and including v239. It was discovered that systemd-network does not correctly keep track of a buffer size in the dhcp6_option_append_ia() function, when constructing DHCPv6 packets. This flaw may lead to an integer underflow that can be used to produce an heap-based buffer overflow. A malicious host on the same network segment as the victim's one may advertise itself as a DHCPv6 server and exploit this flaw to cause a Denial of Service or potentially gain code execution on the victim's machine. The overflow can be triggered relatively easy by advertising a DHCPv6 server with a server-id >= 493 characters long. Impact ====== A remote attacker is able to cause arbitrary code execution by advertising itself as a DHCPv6 server with a specially crafted server- id. A local attacker can escalate privileges with a specially crafted service or a crafted symlink. References ========== https://bugs.archlinux.org/task/60609 https://bugs.chromium.org/p/project-zero/issues/detail?id=1687 https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796402 https://github.com/systemd/systemd/pull/10447 https://github.com/systemd/systemd/pull/10450 https://bugs.chromium.org/p/project-zero/issues/detail?id=1689 https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796692 https://github.com/systemd/systemd/pull/10517 https://bugs.launchpad.net/ubuntu/%2Bsource/systemd/%2Bbug/1795921 https://github.com/systemd/systemd/pull/10518 https://github.com/poettering/systemd/commit/49653743f69658aeeebdb14faf1ab1… https://security.archlinux.org/CVE-2018-15686 https://security.archlinux.org/CVE-2018-15687 https://security.archlinux.org/CVE-2018-15688

1 0

[ASA-201811-10] thunderbird: arbitrary code execution
by Jelle van der Waa 11 Nov '18

11 Nov '18

Arch Linux Security Advisory ASA-201811-10 ========================================== Severity: Critical Date : 2018-11-06 CVE-ID : CVE-2018-12389 CVE-2018-12390 CVE-2018-12392 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-803 Summary ======= The package thunderbird before version 60.3.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 60.3.0-1. # pacman -Syu "thunderbird>=60.3.0-1" The problems have been fixed upstream in version 60.3.0. Workaround ========== None. Description =========== - CVE-2018-12389 (arbitrary code execution) Several memory safety bugs have been found in Thunderbird versions prior to 63.0. Some of these bugs showed evidence of memory corruption and Mozilla engineers presume that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-12390 (arbitrary code execution) Several memory safety bugs have been found in Firefox and Thunderbird versions prior to 63.0. Some of these bugs showed evidence of memory corruption and Mozilla engineers presume that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-12392 (arbitrary code execution) A security issue has been found in Firefox and Thunderbird versions prior to 63.0. When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. Impact ====== A remote attacker is able to execute arbitrary code via a specially crafted HTML document. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-28/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-28/#CVE-2018-123… https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1487098%2C1487660%2C1490234… https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://www.mozilla.org/en-US/security/advisories/mfsa2018-28/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1492823 https://security.archlinux.org/CVE-2018-12389 https://security.archlinux.org/CVE-2018-12390 https://security.archlinux.org/CVE-2018-12392

1 0

[ASA-201811-9] lib32-curl: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-9 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16839 CVE-2018-16840 Package : lib32-curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-796 Summary ======= The package lib32-curl before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "lib32-curl>=7.62.0-1" The problems have been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== - CVE-2018-16839 (arbitrary code execution) The internal function Curl_auth_create_plain_message fails to correctly verify that the passed in lengths for name and password aren't too long, then calculates a buffer size to allocate. On systems with a 32 bit size_t, the math to calculate the buffer size triggers an integer overflow when the user name length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. - CVE-2018-16840 (arbitrary code execution) A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. A malicious user could execute arbitrary code by passing a very long username or password used for SASL authentication. References ========== https://curl.haxx.se/docs/CVE-2018-16839.html https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5 https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16839 https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-8] lib32-libcurl-compat: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-8 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16839 CVE-2018-16840 Package : lib32-libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-797 Summary ======= The package lib32-libcurl-compat before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "lib32-libcurl-compat>=7.62.0-1" The problems have been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== - CVE-2018-16839 (arbitrary code execution) The internal function Curl_auth_create_plain_message fails to correctly verify that the passed in lengths for name and password aren't too long, then calculates a buffer size to allocate. On systems with a 32 bit size_t, the math to calculate the buffer size triggers an integer overflow when the user name length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. - CVE-2018-16840 (arbitrary code execution) A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. A malicious user could execute arbitrary code by passing a very long username or password used for SASL authentication. References ========== https://curl.haxx.se/docs/CVE-2018-16839.html https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5 https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16839 https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-7] lib32-libcurl-gnutls: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-7 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16839 CVE-2018-16840 Package : lib32-libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-798 Summary ======= The package lib32-libcurl-gnutls before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.62.0-1" The problems have been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== - CVE-2018-16839 (arbitrary code execution) The internal function Curl_auth_create_plain_message fails to correctly verify that the passed in lengths for name and password aren't too long, then calculates a buffer size to allocate. On systems with a 32 bit size_t, the math to calculate the buffer size triggers an integer overflow when the user name length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. - CVE-2018-16840 (arbitrary code execution) A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. A malicious user could execute arbitrary code by passing a very long username or password used for SASL authentication. References ========== https://curl.haxx.se/docs/CVE-2018-16839.html https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5 https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16839 https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-6] libcurl-gnutls: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-6 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16840 Package : libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-799 Summary ======= The package libcurl-gnutls before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "libcurl-gnutls>=7.62.0-1" The problem has been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. References ========== https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-5] libcurl-compat: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-5 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16840 Package : libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-800 Summary ======= The package libcurl-compat before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "libcurl-compat>=7.62.0-1" The problem has been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. References ========== https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-4] curl: multiple issues
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-4 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16840 CVE-2018-16842 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-795 Summary ======= The package curl before version 7.62.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "curl>=7.62.0-1" The problems have been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== - CVE-2018-16840 (arbitrary code execution) A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. - CVE-2018-16842 (information disclosure) Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. This display function formats the output to wrap at 80 columns. The wrap logic is however flawed, so if a single word in the message is itself longer than 80 bytes the buffer arithmetic calculates the remainder wrong and will end up reading behind the end of the buffer. Impact ====== A malicious remote server could execute arbitrary commands by closing the client initialized with easy handlers. A malicious local user could disclose information and crash the application if invalid flags were passed. References ========== https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://curl.haxx.se/docs/CVE-2018-16842.html https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211 https://security.archlinux.org/CVE-2018-16840 https://security.archlinux.org/CVE-2018-16842

1 0

[ASA-201811-3] ghostscript: sandbox escape
by Morten Linderud 07 Nov '18

07 Nov '18

Arch Linux Security Advisory ASA-201811-3 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-17961 CVE-2018-18073 CVE-2018-18284 Package : ghostscript Type : sandbox escape Remote : Yes Link : https://security.archlinux.org/AVG-786 Summary ======= The package ghostscript before version 9.25-4 is vulnerable to sandbox escape. Resolution ========== Upgrade to 9.25-4. # pacman -Syu "ghostscript>=9.25-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2018-17961 (sandbox escape) Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. - CVE-2018-18073 (sandbox escape) Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object. - CVE-2018-18284 (sandbox escape) Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. Impact ====== A remote attacker is able to escape the sandbox via a specially crafted PostScript document. References ========== https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a54c9e61e7d02bbc… https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a5a9bf8c6a63aa4a… https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a6807394bd94b708… https://www.openwall.com/lists/oss-security/2018/10/09/4 https://bugs.chromium.org/p/project-zero/issues/detail?id=1682&desc=2 https://bugs.ghostscript.com/show_bug.cgi?id=699816 https://lists.debian.org/debian-lts-announce/2018/10/msg00013.html https://www.exploit-db.com/exploits/45573/ https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=34cc326eb2c56958… http://packetstormsecurity.com/files/149758/Ghostscript-Exposed-System-Oper… http://www.openwall.com/lists/oss-security/2018/10/10/12 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=8d19fdf63f91f504… https://www.openwall.com/lists/oss-security/2018/10/16/2 https://bugs.chromium.org/p/project-zero/issues/detail?id=1696 https://bugs.ghostscript.com/show_bug.cgi?id=699963 https://security.archlinux.org/CVE-2018-17961 https://security.archlinux.org/CVE-2018-18073 https://security.archlinux.org/CVE-2018-18284

1 0