May 2018 - Arch-security - lists.archlinux.org

[ASA-201805-16] lib32-libcurl-gnutls: multiple issues
by Remi Gacogne 20 May '18

20 May '18

Arch Linux Security Advisory ASA-201805-16 ========================================== Severity: Critical Date : 2018-05-18 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-697 Summary ======= The package lib32-libcurl-gnutls before version 7.60.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.60.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.60.0-1" The problems have been fixed upstream in version 7.60.0. Workaround ========== None. Description =========== - CVE-2018-1000300 (arbitrary code execution) curl >= 7.54.1 and < 7.60.0 might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies. When doing FTP transfers, curl keeps a spare "closure handle" around internally that will be used when an FTP connection gets shut down since the original curl easy handle is then already removed. FTP server response data that gets cached from the original transfer might then be larger than the default buffer size (16 KB) allocated in the "closure handle", which can lead to a buffer overwrite. The contents and size of that overwrite is controllable by the server. - CVE-2018-1000301 (denial of service) curl >= 7.20.0 and < 7.60.0 can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part. The function that splits up the response into headers is called Curl_http_readwrite_headers() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use. This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw. Impact ====== A malicious, remote server can cause a denial of service via a crafted RTSP answer, and execute arbitrary code on the affected host via a crafted FTP answer. References ========== https://curl.haxx.se/docs/adv_2018-82c2.html https://curl.haxx.se/CVE-2018-1000300.patch https://curl.haxx.se/docs/adv_2018-b138.html https://curl.haxx.se/CVE-2018-1000301.patch https://security.archlinux.org/CVE-2018-1000300 https://security.archlinux.org/CVE-2018-1000301

1 0

[ASA-201805-15] lib32-libcurl-compat: multiple issues
by Remi Gacogne 20 May '18

20 May '18

Arch Linux Security Advisory ASA-201805-15 ========================================== Severity: Critical Date : 2018-05-18 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-696 Summary ======= The package lib32-libcurl-compat before version 7.60.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.60.0-1. # pacman -Syu "lib32-libcurl-compat>=7.60.0-1" The problems have been fixed upstream in version 7.60.0. Workaround ========== None. Description =========== - CVE-2018-1000300 (arbitrary code execution) curl >= 7.54.1 and < 7.60.0 might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies. When doing FTP transfers, curl keeps a spare "closure handle" around internally that will be used when an FTP connection gets shut down since the original curl easy handle is then already removed. FTP server response data that gets cached from the original transfer might then be larger than the default buffer size (16 KB) allocated in the "closure handle", which can lead to a buffer overwrite. The contents and size of that overwrite is controllable by the server. - CVE-2018-1000301 (denial of service) curl >= 7.20.0 and < 7.60.0 can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part. The function that splits up the response into headers is called Curl_http_readwrite_headers() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use. This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw. Impact ====== A malicious, remote server can cause a denial of service via a crafted RTSP answer, and execute arbitrary code on the affected host via a crafted FTP answer. References ========== https://curl.haxx.se/docs/adv_2018-82c2.html https://curl.haxx.se/CVE-2018-1000300.patch https://curl.haxx.se/docs/adv_2018-b138.html https://curl.haxx.se/CVE-2018-1000301.patch https://security.archlinux.org/CVE-2018-1000300 https://security.archlinux.org/CVE-2018-1000301

1 0

[ASA-201805-14] lib32-curl: multiple issues
by Remi Gacogne 20 May '18

20 May '18

Arch Linux Security Advisory ASA-201805-14 ========================================== Severity: Critical Date : 2018-05-18 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-695 Summary ======= The package lib32-curl before version 7.60.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.60.0-1. # pacman -Syu "lib32-curl>=7.60.0-1" The problems have been fixed upstream in version 7.60.0. Workaround ========== None. Description =========== - CVE-2018-1000300 (arbitrary code execution) curl >= 7.54.1 and < 7.60.0 might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies. When doing FTP transfers, curl keeps a spare "closure handle" around internally that will be used when an FTP connection gets shut down since the original curl easy handle is then already removed. FTP server response data that gets cached from the original transfer might then be larger than the default buffer size (16 KB) allocated in the "closure handle", which can lead to a buffer overwrite. The contents and size of that overwrite is controllable by the server. - CVE-2018-1000301 (denial of service) curl >= 7.20.0 and < 7.60.0 can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part. The function that splits up the response into headers is called Curl_http_readwrite_headers() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use. This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw. Impact ====== A malicious, remote server can cause a denial of service via a crafted RTSP answer, and execute arbitrary code on the affected host via a crafted FTP answer. References ========== https://curl.haxx.se/docs/adv_2018-82c2.html https://curl.haxx.se/CVE-2018-1000300.patch https://curl.haxx.se/docs/adv_2018-b138.html https://curl.haxx.se/CVE-2018-1000301.patch https://security.archlinux.org/CVE-2018-1000300 https://security.archlinux.org/CVE-2018-1000301

1 0

[ASA-201805-13] curl: multiple issues
by Remi Gacogne 18 May '18

18 May '18

Arch Linux Security Advisory ASA-201805-13 ========================================== Severity: Critical Date : 2018-05-17 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-694 Summary ======= The package curl before version 7.60.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.60.0-1. # pacman -Syu "curl>=7.60.0-1" The problems have been fixed upstream in version 7.60.0. Workaround ========== None. Description =========== - CVE-2018-1000300 (arbitrary code execution) curl >= 7.54.1 and < 7.60.0 might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies. When doing FTP transfers, curl keeps a spare "closure handle" around internally that will be used when an FTP connection gets shut down since the original curl easy handle is then already removed. FTP server response data that gets cached from the original transfer might then be larger than the default buffer size (16 KB) allocated in the "closure handle", which can lead to a buffer overwrite. The contents and size of that overwrite is controllable by the server. - CVE-2018-1000301 (denial of service) curl >= 7.20.0 and < 7.60.0 can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content. When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part. The function that splits up the response into headers is called Curl_http_readwrite_headers() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use. This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw. Impact ====== A malicious, remote server can cause a denial of service via a crafted RTSP answer, and execute arbitrary code on the affected host via a crafted FTP answer. References ========== https://curl.haxx.se/docs/adv_2018-82c2.html https://curl.haxx.se/CVE-2018-1000300.patch https://curl.haxx.se/docs/adv_2018-b138.html https://curl.haxx.se/CVE-2018-1000301.patch https://security.archlinux.org/CVE-2018-1000300 https://security.archlinux.org/CVE-2018-1000301

1 0

[ASA-201805-12] zathura-pdf-mupdf: multiple issues
by Santiago Torres-Arias 17 May '18

17 May '18

Arch Linux Security Advisory ASA-201805-12 ========================================== Severity: High Date : 2018-05-16 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : zathura-pdf-mupdf Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-691 Summary ======= The package zathura-pdf-mupdf before version 0.3.3-3 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.3.3-3. # pacman -Syu "zathura-pdf-mupdf>=0.3.3-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2018-5686 (denial of service) In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6187 (denial of service) In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf- write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6192 (denial of service) In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf- xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file. - CVE-2018-6544 (denial of service) pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. - CVE-2018-1000051 (arbitrary code execution) Artifex Mupdf version 1.12.0 contains a use-after-free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF. Impact ====== A remote attacker is able to crash the application or execute arbitrary code via a specially crafted PDF file. References ========== https://bugs.archlinux.org/task/57486 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af… https://bugs.ghostscript.com/show_bug.cgi?id=698908 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df4… https://bugs.ghostscript.com/show_bug.cgi?id=698916 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db… https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=fa9cd085533f68367c2… https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800… https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c225… https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036… https://security.archlinux.org/CVE-2018-5686 https://security.archlinux.org/CVE-2018-6187 https://security.archlinux.org/CVE-2018-6192 https://security.archlinux.org/CVE-2018-6544 https://security.archlinux.org/CVE-2018-1000051

1 0

[ASA-201805-11] runc: privilege escalation
by Santiago Torres-Arias 16 May '18

16 May '18

Arch Linux Security Advisory ASA-201805-11 ========================================== Severity: High Date : 2018-05-16 CVE-ID : CVE-2016-9962 Package : runc Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-134 Summary ======= The package runc before version 1.0.0rc5+19+g69663f0b-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.0.0rc5+19+g69663f0b-1. # pacman -Syu "runc>=1.0.0rc5+19+g69663f0b-1" The problem has been fixed upstream in version 1.0.0rc5. Workaround ========== None. Description =========== The runc component used by `docker exec` feature of docker allowed additional container processes to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain low-level access to these new processes during initialization. An attacker can, depending on the nature of the incoming process, leverage this to elevate access to the host. This ranges from accessing host content through the file descriptors of the incoming process to, potentially, a complete container escape by leveraging memory access or syscall interception. Impact ====== A local attacker is able to break out of the container or modify host files via a crafted docker exec call. References ========== https://github.com/opencontainers/runc/commit/5d93fed3d27f1e2bab58bad13b180… https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3d… https://bugzilla.suse.com/show_bug.cgi?id=1012568 https://github.com/docker/docker/compare/v1.12.5...v1.12.6 https://www.mail-archive.com/fulldisclosure@seclists.org/msg04165.html https://security.archlinux.org/CVE-2016-9962

1 0

[ASA-201805-10] firefox: multiple issues
by Remi Gacogne 14 May '18

14 May '18

Arch Linux Security Advisory ASA-201805-10 ========================================== Severity: Critical Date : 2018-05-13 CVE-ID : CVE-2018-5150 CVE-2018-5151 CVE-2018-5152 CVE-2018-5153 CVE-2018-5154 CVE-2018-5155 CVE-2018-5157 CVE-2018-5158 CVE-2018-5159 CVE-2018-5160 CVE-2018-5163 CVE-2018-5164 CVE-2018-5166 CVE-2018-5167 CVE-2018-5168 CVE-2018-5169 CVE-2018-5172 CVE-2018-5173 CVE-2018-5175 CVE-2018-5176 CVE-2018-5177 CVE-2018-5180 CVE-2018-5181 CVE-2018-5182 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-693 Summary ======= The package firefox before version 60.0-1 is vulnerable to multiple issues including arbitrary code execution, same-origin policy bypass, access restriction bypass, content spoofing, denial of service, information disclosure and sandbox escape. Resolution ========== Upgrade to 60.0-1. # pacman -Syu "firefox>=60.0-1" The problems have been fixed upstream in version 60.0. Workaround ========== None. Description =========== - CVE-2018-5150 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 60.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-5151 (arbitrary code execution) Several memory safety bugs has been found in Firefox before 60.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-5152 (information disclosure) An information disclosure vulnerability has been found in Firefox < 60.0. WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the webRequest API. For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts. This issue does not expose synchronization traffic directly and is limited to the process of user login to the website and the data displayed to the user once logged in. - CVE-2018-5153 (information disclosure) An information disclosure vulnerability has been found in Firefox < 60.0. If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out- of-bounds read with the read memory sent to the originating server in response. - CVE-2018-5154 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 60.0, while enumerating attributes during SVG animations with clip paths. - CVE-2018-5155 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 60.0, while adjusting layout during SVG animations with text paths. - CVE-2018-5157 (same-origin policy bypass) A same-origin policy bypass vulnerability has been found in the PDF viewer of Firefox < 60.0, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third- party website. - CVE-2018-5158 (arbitrary code execution) A insufficient sanitization of Postscript calculator functions vulnerability has been found in the PDF viewer of Firefox < 60.0, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. - CVE-2018-5159 (arbitrary code execution) An integer overflow vulnerability has been found in the Skia library used in Firefox < 60.0, due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. - CVE-2018-5160 (arbitrary code execution) A uninitialized memory use vulnerability has been found in the WebRTC component of Firefox < 60.0, which can use a WrappedI420Buffer pixel buffer whose owning image object can be freed while it is still in use. This can result in the WebRTC encoder using uninitialized memory, leading to a potentially exploitable crash. - CVE-2018-5163 (sandbox escape) A sandbox escape vulnerability has been found in Firefox < 60.0. If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process' privileges, escaping the sandbox on content processes. - CVE-2018-5164 (access restriction bypass) A Content Security Policy (CSP) bypass has been found in Firefox < 60.0, where the CSP is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type. This could allow for script to run where CSP should block it, allowing for cross- site scripting (XSS) and other attacks. - CVE-2018-5166 (access restriction bypass) WebExtensions in Firefox before 60.0 can use request redirection and a filterReponseData filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission. - CVE-2018-5167 (content spoofing) The web console and JavaScript debugger in Firefox < 6.0.0 do not sanitize all output that can be hyperlinked. Both will display chrome: links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display javascript: links, which users could be tricked into clicking by malicious sites. - CVE-2018-5168 (access restriction bypass) Sites can bypass security checks on permissions to install lightweight themes in Firefox before 60.0, by manipulating the baseURI property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. - CVE-2018-5169 (access restriction bypass) If manipulated hyperlinked text with chrome: URL contained in it is dragged and dropped on the "home" icon in Firefox before 60.0, the home page can be reset to include a normally-unlinkable chrome page as one of the home page tabs. - CVE-2018-5172 (arbitrary code execution) The Live Bookmarks page and the PDF viewer in Firefox before 60.0 can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF files. This could allow a malicious site to socially engineer a user to copy and paste malicious script content that could then run with the context of either page but does not allow for privilege escalation. - CVE-2018-5173 (content spoofing) The filename appearing in the Downloads panel in Firefox before 60.0 improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. - CVE-2018-5175 (access restriction bypass) A mechanism to bypass Content Security Policy (CSP) protections on sites that have a script-src policy of 'strict-dynamic' has been found in Firefox < 60.0. If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the require.js library that is part of Firefox’s Developer Tools, and then use a known technique using that library to bypass the CSP restrictions on executing injected scripts. - CVE-2018-5176 (information disclosure) The JSON Viewer in Firefox before 60.0 displays clickable hyperlinks for strings that are parseable as URLs, including javascript: links. If a JSON file contains malicious JavaScript script embedded as javascript: links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. - CVE-2018-5177 (denial of service) A vulnerability exists in the XSLT component of Firefox before 60.0, during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. - CVE-2018-5180 (arbitrary code execution) A use-after-free vulnerability can occur during WebGL operations in Firefox before 60.0. While this results in a potentially exploitable crash, the vulnerability is limited because the memory is freed and reused in a brief window of time during the freeing of the same callstack. - CVE-2018-5181 (access restriction bypass) If a URL using the file: protocol is dragged and dropped onto an open tab of Firefox before 60.0 that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more reliably in a separate process is to open it with the noopener keyword. - CVE-2018-5182 (access restriction bypass) If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the address bar of Firefox before 60.0, the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent file: URL. Impact ====== A remote attacker can bypass various security mechanisms including the sandbox and the same-origin policy, access sensitive information and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-11 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5150 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388020%2C1433609%2C1409440… https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5151 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1445234%2C1449530%2C1437455… https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5152 https://bugzilla.mozilla.org/show_bug.cgi?id=1415644 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5153 https://bugzilla.mozilla.org/show_bug.cgi?id=1436809 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5154 https://bugzilla.mozilla.org/show_bug.cgi?id=1443092 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5155 https://bugzilla.mozilla.org/show_bug.cgi?id=1448774 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5157 https://bugzilla.mozilla.org/show_bug.cgi?id=1449898 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5158 https://bugzilla.mozilla.org/show_bug.cgi?id=1452075 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5159 https://bugzilla.mozilla.org/show_bug.cgi?id=1441941 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5160 https://bugzilla.mozilla.org/show_bug.cgi?id=1436117 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5163 https://bugzilla.mozilla.org/show_bug.cgi?id=1426353 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5164 https://bugzilla.mozilla.org/show_bug.cgi?id=1416045 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5166 https://bugzilla.mozilla.org/show_bug.cgi?id=1437325 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5167 https://bugzilla.mozilla.org/show_bug.cgi?id=1447969 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5168 https://bugzilla.mozilla.org/show_bug.cgi?id=1449548 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5169 https://bugzilla.mozilla.org/show_bug.cgi?id=1319157 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5172 https://bugzilla.mozilla.org/show_bug.cgi?id=1436482 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5173 https://bugzilla.mozilla.org/show_bug.cgi?id=1438025 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5175 https://bugzilla.mozilla.org/show_bug.cgi?id=1432358 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5176 https://bugzilla.mozilla.org/show_bug.cgi?id=1442840 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5177 https://bugzilla.mozilla.org/show_bug.cgi?id=1451908 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5180 https://bugzilla.mozilla.org/show_bug.cgi?id=1444086 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5181 https://bugzilla.mozilla.org/show_bug.cgi?id=1424107 https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5182 https://security.archlinux.org/CVE-2018-5150 https://security.archlinux.org/CVE-2018-5151 https://security.archlinux.org/CVE-2018-5152 https://security.archlinux.org/CVE-2018-5153 https://security.archlinux.org/CVE-2018-5154 https://security.archlinux.org/CVE-2018-5155 https://security.archlinux.org/CVE-2018-5157 https://security.archlinux.org/CVE-2018-5158 https://security.archlinux.org/CVE-2018-5159 https://security.archlinux.org/CVE-2018-5160 https://security.archlinux.org/CVE-2018-5163 https://security.archlinux.org/CVE-2018-5164 https://security.archlinux.org/CVE-2018-5166 https://security.archlinux.org/CVE-2018-5167 https://security.archlinux.org/CVE-2018-5168 https://security.archlinux.org/CVE-2018-5169 https://security.archlinux.org/CVE-2018-5172 https://security.archlinux.org/CVE-2018-5173 https://security.archlinux.org/CVE-2018-5175 https://security.archlinux.org/CVE-2018-5176 https://security.archlinux.org/CVE-2018-5177 https://security.archlinux.org/CVE-2018-5180 https://security.archlinux.org/CVE-2018-5181 https://security.archlinux.org/CVE-2018-5182

1 0

[ASA-201805-9] webkit2gtk: arbitrary code execution
by Remi Gacogne 14 May '18

14 May '18

Arch Linux Security Advisory ASA-201805-9 ========================================= Severity: Critical Date : 2018-05-13 CVE-ID : CVE-2018-4200 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-692 Summary ======= The package webkit2gtk before version 2.20.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.20.2-1. # pacman -Syu "webkit2gtk>=2.20.2-1" The problem has been fixed upstream in version 2.20.2. Workaround ========== None. Description =========== A memory corruption issue has been found in webkitgtk < 2.20.2, where processing maliciously crafted web content may lead to arbitrary code execution. Impact ====== A remote attacker can execute arbitrary code on the affected host via a specially crafted web content. References ========== https://webkitgtk.org/security/WSA-2018-0004.html#CVE-2018-4200 https://security.archlinux.org/CVE-2018-4200

1 0

[ASA-201805-8] llpp: multiple issues
by Remi Gacogne 14 May '18

14 May '18

Arch Linux Security Advisory ASA-201805-8 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : llpp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-690 Summary ======= The package llpp before version 27-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 27-2. # pacman -Syu "llpp>=27-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2018-5686 (denial of service) In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6187 (denial of service) In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf- write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6192 (denial of service) In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf- xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file. - CVE-2018-6544 (denial of service) pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. - CVE-2018-1000051 (arbitrary code execution) Artifex Mupdf version 1.12.0 contains a use-after-free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF. Impact ====== A remote attacker is able to crash the application or execute arbitrary code via a specially crafted PDF file. References ========== https://bugs.archlinux.org/task/57486 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af… https://bugs.ghostscript.com/show_bug.cgi?id=698908 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df4… https://bugs.ghostscript.com/show_bug.cgi?id=698916 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db… https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=fa9cd085533f68367c2… https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800… https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c225… https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036… https://security.archlinux.org/CVE-2018-5686 https://security.archlinux.org/CVE-2018-6187 https://security.archlinux.org/CVE-2018-6192 https://security.archlinux.org/CVE-2018-6544 https://security.archlinux.org/CVE-2018-1000051

1 0

[ASA-201805-7] mupdf-tools: multiple issues
by Santiago Torres-Arias 10 May '18

10 May '18

Arch Linux Security Advisory ASA-201805-7 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf-tools Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-688 Summary ======= The package mupdf-tools before version 1.13.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.13.0-1. # pacman -Syu "mupdf-tools>=1.13.0-1" The problems have been fixed upstream in version 1.13.0. Workaround ========== None. Description =========== - CVE-2018-5686 (denial of service) In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6187 (denial of service) In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf- write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6192 (denial of service) In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf- xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file. - CVE-2018-6544 (denial of service) pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. - CVE-2018-1000051 (arbitrary code execution) Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF. Impact ====== A remote attacker is able to crash the application or execute arbitrary code via a specially crafted PDF file. References ========== https://bugs.archlinux.org/task/57486 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af… https://bugs.ghostscript.com/show_bug.cgi?id=698908 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df4… https://bugs.ghostscript.com/show_bug.cgi?id=698916 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db… https://git.ghostscript.com/?p=mupdf.git;h=fa9cd085533f68367c299e058ab3fbb7… https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800… https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c225… https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036… https://security.archlinux.org/CVE-2018-5686 https://security.archlinux.org/CVE-2018-6187 https://security.archlinux.org/CVE-2018-6192 https://security.archlinux.org/CVE-2018-6544 https://security.archlinux.org/CVE-2018-1000051

1 0