February 2018 - Arch-security - lists.archlinux.org

[ASA-201802-15] mbedtls: arbitrary code execution
by Santiago Torres-Arias 28 Feb '18

28 Feb '18

Arch Linux Security Advisory ASA-201802-15 ========================================== Severity: High Date : 2018-02-24 CVE-ID : CVE-2018-0487 CVE-2018-0488 Package : mbedtls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-617 Summary ======= The package mbedtls before version 2.7.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.7.0-1. # pacman -Syu "mbedtls>=2.7.0-1" The problems have been fixed upstream in version 2.7.0. Workaround ========== None. Description =========== - CVE-2018-0487 (arbitrary code execution) ARM mbed TLS before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session. - CVE-2018-0488 (arbitrary code execution) ARM mbed TLS before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session. Impact ====== A remote attacker is able to execute arbitrary code on the affected host. References ========== https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://security.archlinux.org/CVE-2018-0487 https://security.archlinux.org/CVE-2018-0488

1 0

[ASA-201802-14] unixodbc: arbitrary code execution
by Levente Polyak 24 Feb '18

24 Feb '18

Arch Linux Security Advisory ASA-201802-14 ========================================== Severity: High Date : 2018-02-23 CVE-ID : CVE-2018-7409 Package : unixodbc Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-627 Summary ======= The package unixodbc before version 2.3.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.3.5-1. # pacman -Syu "unixodbc>=2.3.5-1" The problem has been fixed upstream in version 2.3.5. Workaround ========== None. Description =========== In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c possibly leading to arbitrary code execution. Impact ====== A remote attacker is able to execute arbitrary code on the affected host. References ========== https://security.archlinux.org/CVE-2018-7409

1 0

[ASA-201802-13] lib32-wavpack: arbitrary code execution
by Levente Polyak 24 Feb '18

24 Feb '18

Arch Linux Security Advisory ASA-201802-13 ========================================== Severity: High Date : 2018-02-23 CVE-ID : CVE-2018-6767 CVE-2018-7253 CVE-2018-7254 Package : lib32-wavpack Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-634 Summary ======= The package lib32-wavpack before version 5.1.0-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.1.0-2. # pacman -Syu "lib32-wavpack>=5.1.0-2" The problems have been fixed upstream in version 5.1.0. Workaround ========== None. Description =========== - CVE-2018-6767 (arbitrary code execution) A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file. - CVE-2018-7253 (arbitrary code execution) The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file. - CVE-2018-7254 (arbitrary code execution) The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file. Impact ====== A remote attacker is able to execute arbitrary code on the affected host via maliciously crafted files. References ========== https://bugs.archlinux.org/task/57609 https://github.com/dbry/WavPack/commit/d5bf76b5a88d044a1be1d5656698e3ba7371… https://github.com/dbry/WavPack/issues/27 https://github.com/dbry/WavPack/commit/36a24c7881427d2e1e4dc1cef58f19eee0d1… https://github.com/dbry/WavPack/issues/28 https://github.com/dbry/WavPack/commit/8e3fe45a7bac31d9a3b558ae0079e2d92a04… https://github.com/dbry/WavPack/issues/26 https://security.archlinux.org/CVE-2018-6767 https://security.archlinux.org/CVE-2018-7253 https://security.archlinux.org/CVE-2018-7254

1 0

[ASA-201802-12] wavpack: arbitrary code execution
by Levente Polyak 24 Feb '18

24 Feb '18

Arch Linux Security Advisory ASA-201802-12 ========================================== Severity: High Date : 2018-02-23 CVE-ID : CVE-2018-6767 CVE-2018-7253 CVE-2018-7254 Package : wavpack Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-631 Summary ======= The package wavpack before version 5.1.0-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.1.0-2. # pacman -Syu "wavpack>=5.1.0-2" The problems have been fixed upstream in version 5.1.0. Workaround ========== None. Description =========== - CVE-2018-6767 (arbitrary code execution) A stack-based buffer over-read in the ParseRiffHeaderConfig function of cli/riff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service attack or possibly have unspecified other impact via a maliciously crafted RF64 file. - CVE-2018-7253 (arbitrary code execution) The ParseDsdiffHeaderConfig function of the cli/dsdiff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (heap-based buffer over-read) or possibly overwrite the heap via a maliciously crafted DSDIFF file. - CVE-2018-7254 (arbitrary code execution) The ParseCaffHeaderConfig function of the cli/caff.c file of WavPack 5.1.0 allows a remote attacker to cause a denial-of-service (global buffer over-read), or possibly trigger a buffer overflow or incorrect memory allocation, via a maliciously crafted CAF file. Impact ====== A remote attacker is able to execute arbitrary code on the affected host via maliciously crafted files. References ========== https://bugs.archlinux.org/task/57609 https://github.com/dbry/WavPack/commit/d5bf76b5a88d044a1be1d5656698e3ba7371… https://github.com/dbry/WavPack/issues/27 https://github.com/dbry/WavPack/commit/36a24c7881427d2e1e4dc1cef58f19eee0d1… https://github.com/dbry/WavPack/issues/28 https://github.com/dbry/WavPack/commit/8e3fe45a7bac31d9a3b558ae0079e2d92a04… https://github.com/dbry/WavPack/issues/26 https://security.archlinux.org/CVE-2018-6767 https://security.archlinux.org/CVE-2018-7253 https://security.archlinux.org/CVE-2018-7254

1 0

[ASA-201802-11] phpmyadmin: cross-site scripting
by Levente Polyak 24 Feb '18

24 Feb '18

Arch Linux Security Advisory ASA-201802-11 ========================================== Severity: Medium Date : 2018-02-23 CVE-ID : CVE-2018-7260 Package : phpmyadmin Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-630 Summary ======= The package phpmyadmin before version 4.7.8-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 4.7.8-1. # pacman -Syu "phpmyadmin>=4.7.8-1" The problem has been fixed upstream in version 4.7.8. Workaround ========== None. Description =========== Cross-site scripting (XSS) vulnerability in db_central_columns.php in phpMyAdmin before 4.7.8 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. Impact ====== A remote authenticated attacker is able to inject arbitrary javascript via a crafted URL. References ========== https://udiniya.wordpress.com/2018/02/21/a-tale-of-stealing-session-cookie-… https://www.phpmyadmin.net/security/PMASA-2018-1/ https://github.com/phpmyadmin/phpmyadmin/commit/d2886a3e8745e8845633ae8a005… https://security.archlinux.org/CVE-2018-7260

1 0

[ASA-201802-10] strongswan: denial of service
by Morten Linderud 22 Feb '18

22 Feb '18

Arch Linux Security Advisory ASA-201802-10 ========================================== Severity: Medium Date : 2018-02-21 CVE-ID : CVE-2018-6459 Package : strongswan Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-625 Summary ======= The package strongswan before version 5.6.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.6.2-1. # pacman -Syu "strongswan>=5.6.2-1" The problem has been fixed upstream in version 5.6.2. Workaround ========== None. Description =========== The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c before strongSwan 5.6.2 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that lacks a mask generation function parameter. Impact ====== A remote attacker is able to crash the application by providing a maliciously-crafted signature. References ========== https://bugs.archlinux.org/task/57597 https://www.strongswan.org/blog/2018/02/19/strongswan-vulnerability-(cve-20… https://download.strongswan.org/security/CVE-2018-6459/strongswan-5.6.1_pss… https://github.com/strongswan/strongswan/commit/40da179f28b768ffcf6ff7e2f68… https://security.archlinux.org/CVE-2018-6459

1 0

[ASA-201802-9] libmspack: multiple issues
by Levente Polyak 21 Feb '18

21 Feb '18

Arch Linux Security Advisory ASA-201802-9 ========================================= Severity: Critical Date : 2018-02-20 CVE-ID : CVE-2017-6419 CVE-2017-11423 Package : libmspack Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-603 Summary ======= The package libmspack before version 1:0.6alpha-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1:0.6alpha-1. # pacman -Syu "libmspack>=1:0.6alpha-1" The problems have been fixed upstream in version 0.6alpha. Workaround ========== None. Description =========== - CVE-2017-6419 (arbitrary code execution) mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV before 0.99.3, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code via a crafted CHM file. - CVE-2017-11423 (denial of service) The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV before 0.99.3 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. Impact ====== A remote attacker is able to crash the application or execute arbitrary code by providing a maliciously-crafted file. References ========== https://bugzilla.clamav.net/show_bug.cgi?id=11701 https://github.com/vrtadmin/clamav-devel/commit/a83773682e856ad6529ba6db8d1… https://github.com/kyz/libmspack/commit/6139a0b9e93fcb7fcf423e56aa825bc869e… https://bugzilla.clamav.net/show_bug.cgi?id=11873 https://github.com/kyz/libmspack/commit/17038206fcc384dcee6dd9e3a75f08fd3dd… https://github.com/vrtadmin/clamav-devel/commit/ffa31264a657618a0e40c51c01e… https://github.com/vrtadmin/clamav-devel/commit/ada5f94e5cfb04e1ac2a6f383f2… https://github.com/hackerlib/hackerlib-vul/tree/master/clamav-vul https://security.archlinux.org/CVE-2017-6419 https://security.archlinux.org/CVE-2017-11423

1 0

[ASA-201802-8] irssi: multiple issues
by Santiago Torres-Arias 16 Feb '18

16 Feb '18

Arch Linux Security Advisory ASA-201802-8 ========================================= Severity: High Date : 2018-02-15 CVE-ID : CVE-2018-7050 CVE-2018-7051 CVE-2018-7052 CVE-2018-7053 CVE-2018-7054 Package : irssi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-616 Summary ======= The package irssi before version 1.1.1-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 1.1.1-1. # pacman -Syu "irssi>=1.1.1-1" The problems have been fixed upstream in version 1.1.1. Workaround ========== None. Description =========== - CVE-2018-7050 (arbitrary code execution) An issue was discovered in Irssi before 1.1.1. A NULL pointer dereference occurs for an "empty" nick. - CVE-2018-7051 (information disclosure) An issue was discovered in Irssi before 1.1.1. Certain nick names could result in out-of-bounds access when printing theme strings. - CVE-2018-7052 (denial of service) An issue was discovered in Irssi before 1.1.1. When the number of windows exceeds the available space, a crash due to a NULL pointer dereference would occur. - CVE-2018-7053 (arbitrary code execution) An issue was discovered in Irssi before 1.1.1. There is a use-after- free when SASL messages are received in an unexpected order. - CVE-2018-7054 (arbitrary code execution) An issue was discovered in Irssi before 1.1.1. There is a use-after- free when a server is disconnected during netsplits. Impact ====== A remote attacker is able to crash the application, execute arbitrary code or read memory via a malicious server or by tricking a user to use malicious commands. References ========== https://irssi.org/security/irssi_sa_2018_02.txt https://security.archlinux.org/CVE-2018-7050 https://security.archlinux.org/CVE-2018-7051 https://security.archlinux.org/CVE-2018-7052 https://security.archlinux.org/CVE-2018-7053 https://security.archlinux.org/CVE-2018-7054

1 0

[ASA-201802-7] mpv: arbitrary code execution
by Jelle van der Waa 13 Feb '18

13 Feb '18

Arch Linux Security Advisory ASA-201802-7 ========================================= Severity: High Date : 2018-02-13 CVE-ID : CVE-2018-6360 Package : mpv Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-605 Summary ======= The package mpv before version 1:0.27.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:0.27.1-1. # pacman -Syu "mpv>=1:0.27.1-1" The problem has been fixed upstream in version 0.27.1. Workaround ========== None. Description =========== mpv allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdl_hook.lua. For example, an av://lavfi:ladspa=file= URL signifies that the product should call dlopen on a shared object file located at an arbitrary local pathname. The issue exists because the product does not consider that youtube-dl can provide a potentially unsafe URL. Impact ====== A remote attacker can execute arbitrary code on the affected host by tricking the user into playing a malicious web page. References ========== https://github.com/mpv-player/mpv/releases/tag/v0.27.1 https://github.com/mpv-player/mpv/commit/e6e6b0dcc7e9b0dbf35154a179b3dc1fcf… https://github.com/mpv-player/mpv/issues/5456 https://security.archlinux.org/CVE-2018-6360

1 0

[ASA-201802-6] exim: arbitrary code execution
by Jelle van der Waa 13 Feb '18

13 Feb '18

Arch Linux Security Advisory ASA-201802-6 ========================================= Severity: High Date : 2018-02-12 CVE-ID : CVE-2018-6789 Package : exim Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-608 Summary ======= The package exim before version 4.90.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.90.1-1. # pacman -Syu "exim>=4.90.1-1" The problem has been fixed upstream in version 4.90.1. Workaround ========== None. Description =========== An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely. Impact ====== A remote attacker is able to execute arbitrary code on the affected host by sending a crafted message. References ========== http://exim.org/static/doc/security/CVE-2018-6789.txt https://marc.info/?l=oss-security&m=151828631632609 https://security.archlinux.org/CVE-2018-6789

1 0