May 2018 - Arch-security - lists.archlinux.org

[ASA-201805-6] libmupdf: multiple issues
by Santiago Torres-Arias 10 May '18

10 May '18

Arch Linux Security Advisory ASA-201805-6 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : libmupdf Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-689 Summary ======= The package libmupdf before version 1.13.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.13.0-1. # pacman -Syu "libmupdf>=1.13.0-1" The problems have been fixed upstream in version 1.13.0. Workaround ========== None. Description =========== - CVE-2018-5686 (denial of service) In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6187 (denial of service) In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf- write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6192 (denial of service) In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf- xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file. - CVE-2018-6544 (denial of service) pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. - CVE-2018-1000051 (arbitrary code execution) Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF. Impact ====== A remote attacker is able to crash the application or execute arbitrary code via a specially crafted PDF file. References ========== https://bugs.archlinux.org/task/57486 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af… https://bugs.ghostscript.com/show_bug.cgi?id=698908 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df4… https://bugs.ghostscript.com/show_bug.cgi?id=698916 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db… https://git.ghostscript.com/?p=mupdf.git;h=fa9cd085533f68367c299e058ab3fbb7… https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800… https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c225… https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036… https://security.archlinux.org/CVE-2018-5686 https://security.archlinux.org/CVE-2018-6187 https://security.archlinux.org/CVE-2018-6192 https://security.archlinux.org/CVE-2018-6544 https://security.archlinux.org/CVE-2018-1000051

1 0

[ASA-201805-5] mupdf-gl: multiple issues
by Santiago Torres-Arias 10 May '18

10 May '18

Arch Linux Security Advisory ASA-201805-5 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf-gl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-687 Summary ======= The package mupdf-gl before version 1.13.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.13.0-1. # pacman -Syu "mupdf-gl>=1.13.0-1" The problems have been fixed upstream in version 1.13.0. Workaround ========== None. Description =========== - CVE-2018-5686 (denial of service) In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6187 (denial of service) In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf- write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6192 (denial of service) In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf- xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file. - CVE-2018-6544 (denial of service) pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. - CVE-2018-1000051 (arbitrary code execution) Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF. Impact ====== A remote attacker is able to crash the application or execute arbitrary code via a specially crafted PDF file. References ========== https://bugs.archlinux.org/task/57486 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af… https://bugs.ghostscript.com/show_bug.cgi?id=698908 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df4… https://bugs.ghostscript.com/show_bug.cgi?id=698916 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db… https://git.ghostscript.com/?p=mupdf.git;h=fa9cd085533f68367c299e058ab3fbb7… https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800… https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c225… https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036… https://security.archlinux.org/CVE-2018-5686 https://security.archlinux.org/CVE-2018-6187 https://security.archlinux.org/CVE-2018-6192 https://security.archlinux.org/CVE-2018-6544 https://security.archlinux.org/CVE-2018-1000051

1 0

[ASA-201805-4] mupdf: multiple issues
by Santiago Torres-Arias 10 May '18

10 May '18

Arch Linux Security Advisory ASA-201805-4 ========================================= Severity: High Date : 2018-05-09 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-609 Summary ======= The package mupdf before version 1.13.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.13.0-1. # pacman -Syu "mupdf>=1.13.0-1" The problems have been fixed upstream in version 1.13.0. Workaround ========== None. Description =========== - CVE-2018-5686 (denial of service) In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6187 (denial of service) In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf- write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6192 (denial of service) In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf- xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file. - CVE-2018-6544 (denial of service) pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. - CVE-2018-1000051 (arbitrary code execution) Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF. Impact ====== A remote attacker is able to crash the application or execute arbitrary code via a specially crafted PDF file. References ========== https://bugs.archlinux.org/task/57486 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af… https://bugs.ghostscript.com/show_bug.cgi?id=698908 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df4… https://bugs.ghostscript.com/show_bug.cgi?id=698916 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db… https://git.ghostscript.com/?p=mupdf.git;h=fa9cd085533f68367c299e058ab3fbb7… https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800… https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c225… https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036… https://security.archlinux.org/CVE-2018-5686 https://security.archlinux.org/CVE-2018-6187 https://security.archlinux.org/CVE-2018-6192 https://security.archlinux.org/CVE-2018-6544 https://security.archlinux.org/CVE-2018-1000051

1 0

[ASA-201805-3] freetype2: denial of service
by Jelle van der Waa 09 May '18

09 May '18

Arch Linux Security Advisory ASA-201805-3 ========================================= Severity: Low Date : 2018-05-09 CVE-ID : CVE-2018-6942 Package : freetype2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-613 Summary ======= The package freetype2 before version 2.9.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.1-1. # pacman -Syu "freetype2>=2.9.1-1" The problem has been fixed upstream in version 2.9.1. Workaround ========== None. Description =========== An issue was discovered in FreeType 2 before 2.9.1. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to denial of service via a crafted font file. Impact ====== A remote attacker is able to cause a denial of service via a specially crafted file. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5736 https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=29c7592… https://security.archlinux.org/CVE-2018-6942

1 0

[ASA-201805-2] libraw: multiple issues
by Jelle van der Waa 09 May '18

09 May '18

Arch Linux Security Advisory ASA-201805-2 ========================================= Severity: Critical Date : 2018-05-09 CVE-ID : CVE-2018-10528 CVE-2018-10529 Package : libraw Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-681 Summary ======= The package libraw before version 0.18.10-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 0.18.10-1. # pacman -Syu "libraw>=0.18.10-1" The problems have been fixed upstream in version 0.18.10. Workaround ========== None. Description =========== - CVE-2018-10528 (arbitrary code execution) A stack-based buffer overflow has been found in LibRaw before 0.18.10, in the utf2char() function in libraw_cxx.cpp. - CVE-2018-10529 (information disclosure) An out-of-bounds read has been found in LibRaw before 0.18.10, in the X3F property table list implementation in libraw_x3f.cpp and libraw_cxx.cpp Impact ====== A remote attacker is able to execute arbitrary code or disclose information by providing a specially crafted file. References ========== https://bugs.archlinux.org/task/58393 https://github.com/LibRaw/LibRaw/issues/144 https://github.com/LibRaw/LibRaw/commit/895529fc2f2eb8bc633edd6b04b5b237eb4… https://github.com/LibRaw/LibRaw/commit/6f89e5505b1759b788f15cd14d0958b262b… https://github.com/LibRaw/LibRaw/commit/efd8cfabb93fd0396266a7607069901657c… https://github.com/LibRaw/LibRaw/commit/f0c505a3e5d47989a5f69be2d0d4f250af6… https://github.com/LibRaw/LibRaw/commit/6b08eae24034789b3543a1b66dd6af9c202… https://security.archlinux.org/CVE-2018-10528 https://security.archlinux.org/CVE-2018-10529

1 0

[ASA-201805-1] powerdns: arbitrary code execution
by Jelle van der Waa 09 May '18

09 May '18

Arch Linux Security Advisory ASA-201805-1 ========================================= Severity: High Date : 2018-05-09 CVE-ID : CVE-2018-1046 Package : powerdns Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-686 Summary ======= The package powerdns before version 4.1.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.1.2-1. # pacman -Syu "powerdns>=4.1.2-1" The problem has been fixed upstream in version 4.1.2. Workaround ========== None. Description =========== An issue has been found in the dnsreplay tool provided with PowerDNS Authoritative, where replaying a specially crafted PCAP file can trigger a stack based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the --ecs-stamp option of dnsreplay is used. Regardless of this issue, the use of dnsreplay with untrusted PCAP files is not advised. Impact ====== A local attacker is be able to cause a denial of service or execute arbitrary code via a specially crafted PCAP file. References ========== https://marc.info/?l=oss-security&m=152585376901543 https://github.com/PowerDNS/pdns/commit/f9c57c98da1b1007a51680629b667d57d9b… https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisor… https://security.archlinux.org/CVE-2018-1046

1 0