July 2018 - Arch-security - lists.archlinux.org

[ASA-201807-16] libextractor: denial of service
by Jelle van der Waa 27 Jul '18

27 Jul '18

Arch Linux Security Advisory ASA-201807-16 ========================================== Severity: Medium Date : 2018-07-26 CVE-ID : CVE-2017-17440 Package : libextractor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-541 Summary ======= The package libextractor before version 1.7-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.7-1. # pacman -Syu "libextractor>=1.7-1" The problem has been fixed upstream in version 1.7. Workaround ========== None. Description =========== GNU Libextractor 1.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted GIF, IT (Impulse Tracker), NSFE, S3M (Scream Tracker 3), SID, or XM (eXtended Module) file, as demonstrated by the EXTRACTOR_xm_extract_method function in plugins/xm_extractor.c. Impact ====== A remote attacker is able to crash the application via a specially crafted file. References ========== https://bugs.debian.org/883528#35 https://gnunet.org/git/libextractor.git/commit/?id=7cc63b001ceaf81143795321… https://security.archlinux.org/CVE-2017-17440

1 0

[ASA-201807-15] wesnoth: arbitrary code execution
by Jelle van der Waa 27 Jul '18

27 Jul '18

Arch Linux Security Advisory ASA-201807-15 ========================================== Severity: High Date : 2018-07-25 CVE-ID : CVE-2018-1999023 Package : wesnoth Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-741 Summary ======= The package wesnoth before version 1.14.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.14.4-1. # pacman -Syu "wesnoth>=1.14.4-1" The problem has been fixed upstream in version 1.14.4. Workaround ========== None. Description =========== "The Battle for Wesnoth", which allows arbitrary code execution by exploiting a vulnerability within the Lua scripting language engine which allows escaping existing sandbox measures in place and executing untrusted bytecode Impact ====== A remote attacker is able to execute arbitrary code when a user downloads game content in a multiplayer game or via a player content distribution server. References ========== https://marc.info/?l=oss-security&m=153227302330837&w=2 http://www.openwall.com/lists/oss-security/2018/07/20/1 https://github.com/wesnoth/wesnoth/commit/d911268a783467842d38eae7ac1630f1f… https://security.archlinux.org/CVE-2018-1999023

1 0

[ASA-201807-14] jenkins: multiple issues
by Jelle van der Waa 26 Jul '18

26 Jul '18

Arch Linux Security Advisory ASA-201807-14 ========================================== Severity: High Date : 2018-07-21 CVE-ID : CVE-2018-1999001 CVE-2018-1999002 CVE-2018-1999003 CVE-2018-1999004 CVE-2018-1999005 CVE-2018-1999006 CVE-2018-1999007 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-738 Summary ======= The package jenkins before version 2.133-1 is vulnerable to multiple issues including access restriction bypass, arbitrary filesystem access, cross-site scripting and information disclosure. Resolution ========== Upgrade to 2.133-1. # pacman -Syu "jenkins>=2.133-1" The problems have been fixed upstream in version 2.133. Workaround ========== None. Description =========== - CVE-2018-1999001 (access restriction bypass) Unauthenticated users could provide maliciously crafted login credentials that cause Jenkins before 2.133 to move the config.xml file from the Jenkins home directory. This configuration file contains basic configuration of Jenkins, including the selected security realm and authorization strategy. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users. This issue was caused by the fix for SECURITY-499 in the 2017-11-08 security advisory. - CVE-2018-1999002 (arbitrary filesystem access) An arbitrary file read vulnerability in the Stapler web framework used by Jenkins before 2.133 allowed unauthenticated users to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master process has access to. - CVE-2018-1999003 (access restriction bypass) The URLs handling cancellation of queued builds in Jenkins before 2.133 did not perform a permission check, allowing users with Overall/Read permission to cancel queued builds. - CVE-2018-1999004 (access restriction bypass) The URL that initiates agent launches on the Jenkins master before 2.133 did not perform a permission check, allowing users with Overall/Read permission to initiate agent launches. Doing so canceled all ongoing launches for the specified agent, so this allowed attackers to prevent an agent from launching indefinitely. - CVE-2018-1999005 (cross-site scripting) The build timeline widget shown on URLs like /view/…/builds in Jenkins before 2.133 did not properly escape display names of items. This resulted in a cross-site scripting vulnerability exploitable by users able to control item display names - CVE-2018-1999006 (information disclosure) Files indicating when a plugin JPI file was last extracted into a subdirectory of plugins/ in the Jenkins home directory were accessible via HTTP by users with Overall/Read permission before Jenkins 2.133. This allowed unauthorized users to determine the likely install date of a given plugin. - CVE-2018-1999007 (cross-site scripting) Stapler is the web framework used by Jenkins to route HTTP requests. When its debug mode is enabled, HTTP 404 error pages display diagnostic information. Those error pages did not escape parts of URLs they displayed before Jenkins 2.133, in rare cases resulting in a cross-site scripting vulnerability. Impact ====== A remote attacker is able to bypass access restrictions to gain administrative privileges, access arbitrary files, disclose information or perform cross-site scripting. References ========== https://jenkins.io/security/advisory/2018-07-18/ https://security.archlinux.org/CVE-2018-1999001 https://security.archlinux.org/CVE-2018-1999002 https://security.archlinux.org/CVE-2018-1999003 https://security.archlinux.org/CVE-2018-1999004 https://security.archlinux.org/CVE-2018-1999005 https://security.archlinux.org/CVE-2018-1999006 https://security.archlinux.org/CVE-2018-1999007

1 0

[ASA-201807-13] networkmanager-vpnc: privilege escalation
by Jelle van der Waa 21 Jul '18

21 Jul '18

Arch Linux Security Advisory ASA-201807-13 ========================================== Severity: High Date : 2018-07-20 CVE-ID : CVE-2018-10900 Package : networkmanager-vpnc Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-739 Summary ======= The package networkmanager-vpnc before version 1.2.6-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.2.6-1. # pacman -Syu "networkmanager-vpnc>=1.2.6-1" The problem has been fixed upstream in version 1.2.6. Workaround ========== None. Description =========== When initiating a VPNC connection, Network Manager spawns a new vpnc process and passes the configuration via STDIN. By injecting a \n character into a configuration parameter, an attacker can coerce Network Manager to set the Password helper option to an attacker controlled executable file. Impact ====== A local attacker is able to escalate privileges via a specially crafted configuration file. References ========== https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/commit/07ac18a32b4 https://download.gnome.org/sources/NetworkManager-vpnc/1.2/NetworkManager-v… https://marc.info/?l=oss-security&m=153207963021874 https://security.archlinux.org/CVE-2018-10900

1 0

[ASA-201807-12] apache: denial of service
by Jelle van der Waa 21 Jul '18

21 Jul '18

Arch Linux Security Advisory ASA-201807-12 ========================================== Severity: Medium Date : 2018-07-20 CVE-ID : CVE-2018-1333 CVE-2018-8011 Package : apache Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-736 Summary ======= The package apache before version 2.4.34-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.34-1. # pacman -Syu "apache>=2.4.34-1" The problems have been fixed upstream in version 2.4.34. Workaround ========== None. Description =========== - CVE-2018-1333 (denial of service) By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. - CVE-2018-8011 (denial of service) By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Impact ====== A remote attacker is able to cause a denial of service via a crafted HTTP request. References ========== https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333 https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-8011 https://security.archlinux.org/CVE-2018-1333 https://security.archlinux.org/CVE-2018-8011

1 0

[ASA-201807-11] znc: multiple issues
by Santiago Torres-Arias 20 Jul '18

20 Jul '18

Arch Linux Security Advisory ASA-201807-11 ========================================== Severity: High Date : 2018-07-19 CVE-ID : CVE-2018-14055 CVE-2018-14056 Package : znc Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-737 Summary ======= The package znc before version 1.7.1-1 is vulnerable to multiple issues including privilege escalation and directory traversal. Resolution ========== Upgrade to 1.7.1-1. # pacman -Syu "znc>=1.7.1-1" The problems have been fixed upstream in version 1.7.1. Workaround ========== None. Description =========== - CVE-2018-14055 (privilege escalation) ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate privilege, inject rogue values into znc.conf, and gain shell access. - CVE-2018-14056 (directory traversal) ZNC before 1.7.1-rc1 is prone to a path traversal flaw. A non-admin user can set web skin name to ../ to access files outside of the intended skins directories and to cause DoS. Impact ====== An authenticated non-admin user is able to read arbitrary files, crash the application, escalate privileges, or execute arbitrary commands on the host. References ========== https://wiki.znc.in/ChangeLog/1.7.1 https://github.com/znc/znc/commit/a7bfbd93812950b7444841431e8e297e62cb524e https://github.com/znc/znc/commit/d22fef8620cdd87490754f607e7153979731c69d https://marc.info/?l=oss-security&m=153190583604081 https://github.com/znc/znc/commit/a4a5aeeb17d32937d8c7d743dae9a4cc755ce773 https://marc.info/?l=oss-security&m=153190593904101 https://security.archlinux.org/CVE-2018-14055 https://security.archlinux.org/CVE-2018-14056

1 0

[ASA-201807-10] curl: arbitrary code execution
by Morten Linderud 17 Jul '18

17 Jul '18

Arch Linux Security Advisory ASA-201807-10 ========================================== Severity: High Date : 2018-07-16 CVE-ID : CVE-2018-0500 Package : curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-729 Summary ======= The package curl before version 7.61.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.61.0-1. # pacman -Syu "curl>=7.61.0-1" The problem has been fixed upstream in version 7.61.0. Workaround ========== None. Description =========== It has been discovered that curl before 7.61.0 might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. When sending data over SMTP, curl allocates a separate "scratch area" on the heap to be able to escape the uploaded data properly if the uploaded data contains data that requires it. The size of this temporary scratch area was mistakenly made to be 2 * sizeof(download_buffer) when it should have been made 2 * sizeof(upload_buffer). The upload and the download buffer sizes are identically sized by default (16KB) but since version 7.54.1, curl can resize the download buffer into a smaller buffer (as well as larger). If the download buffer size is set to a value smaller than 10923, the Curl_smtp_escape_eob() function might overflow the scratch buffer when sending contents of sufficient size and contents. The curl command line tool lowers the buffer size when --limit-rate is set to a value smaller than 16KB. Impact ====== A remote attacker is able to execute arbitrary code when sending SMTP data. References ========== https://curl.haxx.se/docs/adv_2018-70a2.html https://security.archlinux.org/CVE-2018-0500

1 0

[ASA-201807-9] libcurl-gnutls: arbitrary code execution
by Morten Linderud 17 Jul '18

17 Jul '18

Arch Linux Security Advisory ASA-201807-9 ========================================= Severity: High Date : 2018-07-16 CVE-ID : CVE-2018-0500 Package : libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-734 Summary ======= The package libcurl-gnutls before version 7.61.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.61.0-1. # pacman -Syu "libcurl-gnutls>=7.61.0-1" The problem has been fixed upstream in version 7.61.0. Workaround ========== None. Description =========== It has been discovered that curl before 7.61.0 might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. When sending data over SMTP, curl allocates a separate "scratch area" on the heap to be able to escape the uploaded data properly if the uploaded data contains data that requires it. The size of this temporary scratch area was mistakenly made to be 2 * sizeof(download_buffer) when it should have been made 2 * sizeof(upload_buffer). The upload and the download buffer sizes are identically sized by default (16KB) but since version 7.54.1, curl can resize the download buffer into a smaller buffer (as well as larger). If the download buffer size is set to a value smaller than 10923, the Curl_smtp_escape_eob() function might overflow the scratch buffer when sending contents of sufficient size and contents. The curl command line tool lowers the buffer size when --limit-rate is set to a value smaller than 16KB. Impact ====== A remote attacker is able to execute arbitrary code when sending SMTP data. References ========== https://curl.haxx.se/docs/adv_2018-70a2.html https://security.archlinux.org/CVE-2018-0500

1 0

[ASA-201807-8] libcurl-compat: arbitrary code execution
by Morten Linderud 17 Jul '18

17 Jul '18

Arch Linux Security Advisory ASA-201807-8 ========================================= Severity: High Date : 2018-07-16 CVE-ID : CVE-2018-0500 Package : libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-733 Summary ======= The package libcurl-compat before version 7.61.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.61.0-1. # pacman -Syu "libcurl-compat>=7.61.0-1" The problem has been fixed upstream in version 7.61.0. Workaround ========== None. Description =========== It has been discovered that curl before 7.61.0 might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. When sending data over SMTP, curl allocates a separate "scratch area" on the heap to be able to escape the uploaded data properly if the uploaded data contains data that requires it. The size of this temporary scratch area was mistakenly made to be 2 * sizeof(download_buffer) when it should have been made 2 * sizeof(upload_buffer). The upload and the download buffer sizes are identically sized by default (16KB) but since version 7.54.1, curl can resize the download buffer into a smaller buffer (as well as larger). If the download buffer size is set to a value smaller than 10923, the Curl_smtp_escape_eob() function might overflow the scratch buffer when sending contents of sufficient size and contents. The curl command line tool lowers the buffer size when --limit-rate is set to a value smaller than 16KB. Impact ====== A remote attacker is able to execute arbitrary code when sending SMTP data. References ========== https://curl.haxx.se/docs/adv_2018-70a2.html https://security.archlinux.org/CVE-2018-0500

1 0

[ASA-201807-7] lib32-libcurl-gnutls: arbitrary code execution
by Morten Linderud 17 Jul '18

17 Jul '18

Arch Linux Security Advisory ASA-201807-7 ========================================= Severity: High Date : 2018-07-16 CVE-ID : CVE-2018-0500 Package : lib32-libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-732 Summary ======= The package lib32-libcurl-gnutls before version 7.61.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.61.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.61.0-1" The problem has been fixed upstream in version 7.61.0. Workaround ========== None. Description =========== It has been discovered that curl before 7.61.0 might overflow a heap based memory buffer when sending data over SMTP and using a reduced read buffer. When sending data over SMTP, curl allocates a separate "scratch area" on the heap to be able to escape the uploaded data properly if the uploaded data contains data that requires it. The size of this temporary scratch area was mistakenly made to be 2 * sizeof(download_buffer) when it should have been made 2 * sizeof(upload_buffer). The upload and the download buffer sizes are identically sized by default (16KB) but since version 7.54.1, curl can resize the download buffer into a smaller buffer (as well as larger). If the download buffer size is set to a value smaller than 10923, the Curl_smtp_escape_eob() function might overflow the scratch buffer when sending contents of sufficient size and contents. The curl command line tool lowers the buffer size when --limit-rate is set to a value smaller than 16KB. Impact ====== A remote attacker is able to execute arbitrary code when sending SMTP data. References ========== https://curl.haxx.se/docs/adv_2018-70a2.html https://security.archlinux.org/CVE-2018-0500

1 0