May 2018 - Arch-security - lists.archlinux.org

[ASA-201805-26] strongswan: denial of service
by Christian Rebischke 29 May '18

29 May '18

Arch Linux Security Advisory ASA-201805-26 ========================================== Severity: Low Date : 2018-05-26 CVE-ID : CVE-2018-5388 Package : strongswan Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-710 Summary ======= The package strongswan before version 5.6.2-2 is vulnerable to denial of service. Resolution ========== Upgrade to 5.6.2-2. # pacman -Syu "strongswan>=5.6.2-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== strongSwan VPN's charon server prior to version 5.6.3 is missing a packet length check in stroke_socket.c, allowing a buffer overflow which may lead to resource exhaustion and denial of service while reading from the socket. According to the vendor, an attacker must typically have local root permissions to access the socket. However, other accounts and groups such as the vpn group (if capability dropping in enabled, for example) may also have sufficient permissions, but this configuration does not appear to be the default behavior. Impact ====== A local attacker with access to the VPN socket is able to crash the service. References ========== https://bugs.archlinux.org/task/58719 https://www.kb.cert.org/vuls/id/338343 https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=0acd1ab4 https://security.archlinux.org/CVE-2018-5388

1 0

[ASA-201805-25] wireshark-cli: multiple issues
by Remi Gacogne 29 May '18

29 May '18

Arch Linux Security Advisory ASA-201805-25 ========================================== Severity: Critical Date : 2018-05-25 CVE-ID : CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 Package : wireshark-cli Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-708 Summary ======= The package wireshark-cli before version 2.6.1-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 2.6.1-1. # pacman -Syu "wireshark-cli>=2.6.1-1" The problems have been fixed upstream in version 2.6.1. Workaround ========== None. Description =========== - CVE-2018-11354 (information disclosure) An out-of-bounds read has been found in the IEEE 1905.1a dissector of Wireshark <= 2.6.0. - CVE-2018-11355 (arbitrary code execution) A heap-based buffer overflow has been found in the RTCP dissector of Wireshark <= 2.6.0. - CVE-2018-11356 (denial of service) A null-pointer dereference has been found in the DNS dissector of Wireshark <= 2.6.0. - CVE-2018-11357 (denial of service) An integer overflow leading to excessive memory allocation has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11358 (arbitrary code execution) A heap-based use-after-free has been found in the Q.931 dissector of Wireshark <= 2.6.0. - CVE-2018-11359 (denial of service) A null-pointer dereference has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11360 (arbitrary code execution) A heap-based off-by-one write has been found in the GSM A DTAP dissector of Wireshark <= 2.6.0. - CVE-2018-11361 (denial of service) A heap-based out-of-bounds read has been found in the IEEE 802.11 dissector of Wireshark <= 2.6.0. - CVE-2018-11362 (information disclosure) An out-of-bounds read has been found in the LDSS dissector of Wireshark <= 2.6.0. Impact ====== A remote attacker can crash the application, access sensitive information present in memory or execute arbitrary code on the affected host via a specially crafted network packet or by convincing a local user to open a specially crafted PCAP file. References ========== https://www.wireshark.org/security/wnpa-sec-2018-26.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14647 https://www.wireshark.org/security/wnpa-sec-2018-27.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14673 https://www.wireshark.org/security/wnpa-sec-2018-29.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14681 https://www.wireshark.org/security/wnpa-sec-2018-28.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14678 https://www.wireshark.org/security/wnpa-sec-2018-31.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14689 https://www.wireshark.org/security/wnpa-sec-2018-33.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14703 https://www.wireshark.org/security/wnpa-sec-2018-30.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14688 https://www.wireshark.org/security/wnpa-sec-2018-32.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14686 https://www.wireshark.org/security/wnpa-sec-2018-25.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14615 https://security.archlinux.org/CVE-2018-11354 https://security.archlinux.org/CVE-2018-11355 https://security.archlinux.org/CVE-2018-11356 https://security.archlinux.org/CVE-2018-11357 https://security.archlinux.org/CVE-2018-11358 https://security.archlinux.org/CVE-2018-11359 https://security.archlinux.org/CVE-2018-11360 https://security.archlinux.org/CVE-2018-11361 https://security.archlinux.org/CVE-2018-11362

1 0

[ASA-201805-24] wireshark-common: multiple issues
by Remi Gacogne 29 May '18

29 May '18

Arch Linux Security Advisory ASA-201805-24 ========================================== Severity: Critical Date : 2018-05-25 CVE-ID : CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 Package : wireshark-common Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-708 Summary ======= The package wireshark-common before version 2.6.1-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 2.6.1-1. # pacman -Syu "wireshark-common>=2.6.1-1" The problems have been fixed upstream in version 2.6.1. Workaround ========== None. Description =========== - CVE-2018-11354 (information disclosure) An out-of-bounds read has been found in the IEEE 1905.1a dissector of Wireshark <= 2.6.0. - CVE-2018-11355 (arbitrary code execution) A heap-based buffer overflow has been found in the RTCP dissector of Wireshark <= 2.6.0. - CVE-2018-11356 (denial of service) A null-pointer dereference has been found in the DNS dissector of Wireshark <= 2.6.0. - CVE-2018-11357 (denial of service) An integer overflow leading to excessive memory allocation has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11358 (arbitrary code execution) A heap-based use-after-free has been found in the Q.931 dissector of Wireshark <= 2.6.0. - CVE-2018-11359 (denial of service) A null-pointer dereference has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11360 (arbitrary code execution) A heap-based off-by-one write has been found in the GSM A DTAP dissector of Wireshark <= 2.6.0. - CVE-2018-11361 (denial of service) A heap-based out-of-bounds read has been found in the IEEE 802.11 dissector of Wireshark <= 2.6.0. - CVE-2018-11362 (information disclosure) An out-of-bounds read has been found in the LDSS dissector of Wireshark <= 2.6.0. Impact ====== A remote attacker can crash the application, access sensitive information present in memory or execute arbitrary code on the affected host via a specially crafted network packet or by convincing a local user to open a specially crafted PCAP file. References ========== https://www.wireshark.org/security/wnpa-sec-2018-26.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14647 https://www.wireshark.org/security/wnpa-sec-2018-27.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14673 https://www.wireshark.org/security/wnpa-sec-2018-29.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14681 https://www.wireshark.org/security/wnpa-sec-2018-28.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14678 https://www.wireshark.org/security/wnpa-sec-2018-31.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14689 https://www.wireshark.org/security/wnpa-sec-2018-33.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14703 https://www.wireshark.org/security/wnpa-sec-2018-30.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14688 https://www.wireshark.org/security/wnpa-sec-2018-32.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14686 https://www.wireshark.org/security/wnpa-sec-2018-25.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14615 https://security.archlinux.org/CVE-2018-11354 https://security.archlinux.org/CVE-2018-11355 https://security.archlinux.org/CVE-2018-11356 https://security.archlinux.org/CVE-2018-11357 https://security.archlinux.org/CVE-2018-11358 https://security.archlinux.org/CVE-2018-11359 https://security.archlinux.org/CVE-2018-11360 https://security.archlinux.org/CVE-2018-11361 https://security.archlinux.org/CVE-2018-11362

1 0

[ASA-201805-23] wireshark-qt: multiple issues
by Remi Gacogne 29 May '18

29 May '18

Arch Linux Security Advisory ASA-201805-23 ========================================== Severity: Critical Date : 2018-05-25 CVE-ID : CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 Package : wireshark-qt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-708 Summary ======= The package wireshark-qt before version 2.6.1-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 2.6.1-1. # pacman -Syu "wireshark-qt>=2.6.1-1" The problems have been fixed upstream in version 2.6.1. Workaround ========== None. Description =========== - CVE-2018-11354 (information disclosure) An out-of-bounds read has been found in the IEEE 1905.1a dissector of Wireshark <= 2.6.0. - CVE-2018-11355 (arbitrary code execution) A heap-based buffer overflow has been found in the RTCP dissector of Wireshark <= 2.6.0. - CVE-2018-11356 (denial of service) A null-pointer dereference has been found in the DNS dissector of Wireshark <= 2.6.0. - CVE-2018-11357 (denial of service) An integer overflow leading to excessive memory allocation has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11358 (arbitrary code execution) A heap-based use-after-free has been found in the Q.931 dissector of Wireshark <= 2.6.0. - CVE-2018-11359 (denial of service) A null-pointer dereference has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11360 (arbitrary code execution) A heap-based off-by-one write has been found in the GSM A DTAP dissector of Wireshark <= 2.6.0. - CVE-2018-11361 (denial of service) A heap-based out-of-bounds read has been found in the IEEE 802.11 dissector of Wireshark <= 2.6.0. - CVE-2018-11362 (information disclosure) An out-of-bounds read has been found in the LDSS dissector of Wireshark <= 2.6.0. Impact ====== A remote attacker can crash the application, access sensitive information present in memory or execute arbitrary code on the affected host via a specially crafted network packet or by convincing a local user to open a specially crafted PCAP file. References ========== https://www.wireshark.org/security/wnpa-sec-2018-26.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14647 https://www.wireshark.org/security/wnpa-sec-2018-27.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14673 https://www.wireshark.org/security/wnpa-sec-2018-29.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14681 https://www.wireshark.org/security/wnpa-sec-2018-28.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14678 https://www.wireshark.org/security/wnpa-sec-2018-31.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14689 https://www.wireshark.org/security/wnpa-sec-2018-33.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14703 https://www.wireshark.org/security/wnpa-sec-2018-30.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14688 https://www.wireshark.org/security/wnpa-sec-2018-32.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14686 https://www.wireshark.org/security/wnpa-sec-2018-25.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14615 https://security.archlinux.org/CVE-2018-11354 https://security.archlinux.org/CVE-2018-11355 https://security.archlinux.org/CVE-2018-11356 https://security.archlinux.org/CVE-2018-11357 https://security.archlinux.org/CVE-2018-11358 https://security.archlinux.org/CVE-2018-11359 https://security.archlinux.org/CVE-2018-11360 https://security.archlinux.org/CVE-2018-11361 https://security.archlinux.org/CVE-2018-11362

1 0

[ASA-201805-22] wireshark-gtk: multiple issues
by Remi Gacogne 29 May '18

29 May '18

Arch Linux Security Advisory ASA-201805-22 ========================================== Severity: Critical Date : 2018-05-25 CVE-ID : CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 Package : wireshark-gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-708 Summary ======= The package wireshark-gtk before version 2.6.1-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 2.6.1-1. # pacman -Syu "wireshark-gtk>=2.6.1-1" The problems have been fixed upstream in version 2.6.1. Workaround ========== None. Description =========== - CVE-2018-11354 (information disclosure) An out-of-bounds read has been found in the IEEE 1905.1a dissector of Wireshark <= 2.6.0. - CVE-2018-11355 (arbitrary code execution) A heap-based buffer overflow has been found in the RTCP dissector of Wireshark <= 2.6.0. - CVE-2018-11356 (denial of service) A null-pointer dereference has been found in the DNS dissector of Wireshark <= 2.6.0. - CVE-2018-11357 (denial of service) An integer overflow leading to excessive memory allocation has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11358 (arbitrary code execution) A heap-based use-after-free has been found in the Q.931 dissector of Wireshark <= 2.6.0. - CVE-2018-11359 (denial of service) A null-pointer dereference has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11360 (arbitrary code execution) A heap-based off-by-one write has been found in the GSM A DTAP dissector of Wireshark <= 2.6.0. - CVE-2018-11361 (denial of service) A heap-based out-of-bounds read has been found in the IEEE 802.11 dissector of Wireshark <= 2.6.0. - CVE-2018-11362 (information disclosure) An out-of-bounds read has been found in the LDSS dissector of Wireshark <= 2.6.0. Impact ====== A remote attacker can crash the application, access sensitive information present in memory or execute arbitrary code on the affected host via a specially crafted network packet or by convincing a local user to open a specially crafted PCAP file. References ========== https://www.wireshark.org/security/wnpa-sec-2018-26.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14647 https://www.wireshark.org/security/wnpa-sec-2018-27.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14673 https://www.wireshark.org/security/wnpa-sec-2018-29.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14681 https://www.wireshark.org/security/wnpa-sec-2018-28.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14678 https://www.wireshark.org/security/wnpa-sec-2018-31.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14689 https://www.wireshark.org/security/wnpa-sec-2018-33.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14703 https://www.wireshark.org/security/wnpa-sec-2018-30.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14688 https://www.wireshark.org/security/wnpa-sec-2018-32.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14686 https://www.wireshark.org/security/wnpa-sec-2018-25.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14615 https://security.archlinux.org/CVE-2018-11354 https://security.archlinux.org/CVE-2018-11355 https://security.archlinux.org/CVE-2018-11356 https://security.archlinux.org/CVE-2018-11357 https://security.archlinux.org/CVE-2018-11358 https://security.archlinux.org/CVE-2018-11359 https://security.archlinux.org/CVE-2018-11360 https://security.archlinux.org/CVE-2018-11361 https://security.archlinux.org/CVE-2018-11362

1 0

[ASA-201805-21] thunderbird: multiple issues
by Remi Gacogne 25 May '18

25 May '18

Arch Linux Security Advisory ASA-201805-21 ========================================== Severity: Critical Date : 2018-05-21 CVE-ID : CVE-2018-5150 CVE-2018-5154 CVE-2018-5155 CVE-2018-5159 CVE-2018-5161 CVE-2018-5162 CVE-2018-5168 CVE-2018-5170 CVE-2018-5178 CVE-2018-5183 CVE-2018-5184 CVE-2018-5185 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-707 Summary ======= The package thunderbird before version 52.8.0-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, access restriction bypass, content spoofing and denial of service. Resolution ========== Upgrade to 52.8.0-1. # pacman -Syu "thunderbird>=52.8.0-1" The problems have been fixed upstream in version 52.8.0. Workaround ========== Most of these issues can be mitigated by viewing e-mails in plain text mode, via the "View", "Message Body As", "Plain Text" menus. Description =========== - CVE-2018-5150 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 60.0 and Thunderbird before 52.8. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-5154 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 60.0 and Thunderbird < 52.8, while enumerating attributes during SVG animations with clip paths. - CVE-2018-5155 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 60.0 and Thunderbird < 52.8, while adjusting layout during SVG animations with text paths. - CVE-2018-5159 (arbitrary code execution) An integer overflow vulnerability has been found in the Skia library used in Firefox < 60.0 and Thunderbird < 52.8, due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. - CVE-2018-5161 (denial of service) A security issue has been found in Thunderbird before 52.8, where crafted message headers can cause a Thunderbird process to hang on receiving the message. - CVE-2018-5162 (information disclosure) A security issue has been found in Thunderbird before 52.8, where plaintext of decrypted emails can leak through the src attribute of remote images, or links. - CVE-2018-5168 (access restriction bypass) Sites can bypass security checks on permissions to install lightweight themes in Firefox before 60.0 and Thunderbird before 52.8, by manipulating the baseURI property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. - CVE-2018-5170 (content spoofing) It is possible in Thunderbird before 52.8 to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected. - CVE-2018-5178 (information disclosure) A buffer overflow was found in Thunderbird before 52.8, during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerability requires the use of a malicious or vulnerable legacy extension in order to occur. - CVE-2018-5183 (arbitrary code execution) Several memory corruption issues including invalid buffer reads and writes during graphic operations have been found in the Skia library. - CVE-2018-5184 (information disclosure) A security issue has been found in Thunderbird before 52.8, where using remote content in S/MIME encrypted messages can lead to the disclosure of plaintext via chosen-ciphertext attack. - CVE-2018-5185 (information disclosure) A security issue has been found in Thunderbird before 52.8, where plaintext of decrypted emails can leak through by user submitting an embedded form. Impact ====== A remote attacker might be able to access sensitive information via a crafted encrypted e-mail, and spoof the name of an attachment. A remote attacker might also be able to access sensitive information, crash the process or execute arbitrary code via a crafted HTML e-mail if viewing HTML messages is enabled. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5150 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388020%2C1433609%2C1409440… https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5154 https://bugzilla.mozilla.org/show_bug.cgi?id=1443092 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5155 https://bugzilla.mozilla.org/show_bug.cgi?id=1448774 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5159 https://bugzilla.mozilla.org/show_bug.cgi?id=1441941 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5161 https://bugzilla.mozilla.org/show_bug.cgi?id=1411720 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5162 https://bugzilla.mozilla.org/show_bug.cgi?id=1457721 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5168 https://bugzilla.mozilla.org/show_bug.cgi?id=1449548 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5170 https://bugzilla.mozilla.org/show_bug.cgi?id=1411732 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5178 https://bugzilla.mozilla.org/show_bug.cgi?id=1443891 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5183 https://bugzilla.mozilla.org/show_bug.cgi?id=1454692 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5184 https://bugzilla.mozilla.org/show_bug.cgi?id=1411592 https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5185 https://bugzilla.mozilla.org/show_bug.cgi?id=1450345 https://security.archlinux.org/CVE-2018-5150 https://security.archlinux.org/CVE-2018-5154 https://security.archlinux.org/CVE-2018-5155 https://security.archlinux.org/CVE-2018-5159 https://security.archlinux.org/CVE-2018-5161 https://security.archlinux.org/CVE-2018-5162 https://security.archlinux.org/CVE-2018-5168 https://security.archlinux.org/CVE-2018-5170 https://security.archlinux.org/CVE-2018-5178 https://security.archlinux.org/CVE-2018-5183 https://security.archlinux.org/CVE-2018-5184 https://security.archlinux.org/CVE-2018-5185

1 0

[ASA-201805-20] bind: denial of service
by Jelle van der Waa 24 May '18

24 May '18

Arch Linux Security Advisory ASA-201805-20 ========================================== Severity: Medium Date : 2018-05-20 CVE-ID : CVE-2018-5736 CVE-2018-5737 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-706 Summary ======= The package bind before version 9.12.1.P2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.12.1.P2-1. # pacman -Syu "bind>=9.12.1.P2-1" The problems have been fixed upstream in version 9.12.1.P2. Workaround ========== - CVE-2018-5736 For servers which must receive notifies to keep slave zone contents current, no complete workarounds are known although restricting BIND to only accept NOTIFY messages from authorised sources can greatly mitigate the risk of attack. - CVE-2018-5737 Setting "max-stale-ttl 0;" in named.conf will prevent exploitation of this vulnerability (but will effectively disable the serve-stale feature.) Description =========== - CVE-2018-5736 (denial of service) An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attempts several transfers of a slave zone in quick succession. - CVE-2018-5737 (denial of service) A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale- answer-enable is off. Impact ====== A remote attacker is able to cause a denial of service via crafted queries. References ========== http://marc.info/?i=6688abb0-fbc5-4c60-5876-66cdf36bb8bf@isc.org https://kb.isc.org/article/AA-01602/74/CVE-2018-5736 https://kb.isc.org/article/AA-01606/74/CVE-2018-5737 https://security.archlinux.org/CVE-2018-5736 https://security.archlinux.org/CVE-2018-5737

1 0

[ASA-201805-19] libofx: denial of service
by Jelle van der Waa 24 May '18

24 May '18

Arch Linux Security Advisory ASA-201805-19 ========================================== Severity: Medium Date : 2018-05-20 CVE-ID : CVE-2017-14731 Package : libofx Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-536 Summary ======= The package libofx before version 0.9.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.9.13-1. # pacman -Syu "libofx>=0.9.13-1" The problem has been fixed upstream in version 0.9.13. Workaround ========== None. Description =========== ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call. Impact ====== A remote attacker is able to cause a denial of service via a specially crafted file. References ========== https://bugs.archlinux.org/task/56544 https://github.com/libofx/libofx/issues/10 https://github.com/libofx/libofx/commit/fad8418f34094de42e1307113598e0e8bee… https://security.archlinux.org/CVE-2017-14731

1 0

[ASA-201805-18] libcurl-gnutls: multiple issues
by Remi Gacogne 20 May '18

20 May '18

Arch Linux Security Advisory ASA-201805-18 ========================================== Severity: Critical Date : 2018-05-18 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-699 Summary ======= The package libcurl-gnutls before version 7.60.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.60.0-1. # pacman -Syu "libcurl-gnutls>=7.60.0-1" The problems have been fixed upstream in version 7.60.0. Workaround ========== None. Description =========== - CVE-2018-1000300 (arbitrary code execution) curl >= 7.54.1 and < 7.60.0 might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies. When doing FTP transfers, curl keeps a spare "closure handle" around internally that will be used when an FTP connection gets shut down since the original curl easy handle is then already removed. FTP server response data that gets cached from the original transfer might then be larger than the default buffer size (16 KB) allocated in the "closure handle", which can lead to a buffer overwrite. The contents and size of that overwrite is controllable by the server. - CVE-2018-1000301 (denial of service) curl >= 7.20.0 and < 7.60.0 can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part. The function that splits up the response into headers is called Curl_http_readwrite_headers() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use. This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw. Impact ====== A malicious, remote server can cause a denial of service via a crafted RTSP answer, and execute arbitrary code on the affected host via a crafted FTP answer. References ========== https://curl.haxx.se/docs/adv_2018-82c2.html https://curl.haxx.se/CVE-2018-1000300.patch https://curl.haxx.se/docs/adv_2018-b138.html https://curl.haxx.se/CVE-2018-1000301.patch https://security.archlinux.org/CVE-2018-1000300 https://security.archlinux.org/CVE-2018-1000301

1 0

[ASA-201805-17] libcurl-compat: multiple issues
by Remi Gacogne 20 May '18

20 May '18

Arch Linux Security Advisory ASA-201805-17 ========================================== Severity: Critical Date : 2018-05-18 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-698 Summary ======= The package libcurl-compat before version 7.60.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.60.0-1. # pacman -Syu "libcurl-compat>=7.60.0-1" The problems have been fixed upstream in version 7.60.0. Workaround ========== None. Description =========== - CVE-2018-1000300 (arbitrary code execution) curl >= 7.54.1 and < 7.60.0 might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies. When doing FTP transfers, curl keeps a spare "closure handle" around internally that will be used when an FTP connection gets shut down since the original curl easy handle is then already removed. FTP server response data that gets cached from the original transfer might then be larger than the default buffer size (16 KB) allocated in the "closure handle", which can lead to a buffer overwrite. The contents and size of that overwrite is controllable by the server. - CVE-2018-1000301 (denial of service) curl >= 7.20.0 and < 7.60.0 can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part. The function that splits up the response into headers is called Curl_http_readwrite_headers() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use. This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw. Impact ====== A malicious, remote server can cause a denial of service via a crafted RTSP answer, and execute arbitrary code on the affected host via a crafted FTP answer. References ========== https://curl.haxx.se/docs/adv_2018-82c2.html https://curl.haxx.se/CVE-2018-1000300.patch https://curl.haxx.se/docs/adv_2018-b138.html https://curl.haxx.se/CVE-2018-1000301.patch https://security.archlinux.org/CVE-2018-1000300 https://security.archlinux.org/CVE-2018-1000301

1 0