January 2019 - Arch-security - lists.archlinux.org

[ASA-201901-8] irssi: denial of service
by Jelle van der Waa 14 Jan '19

14 Jan '19

Arch Linux Security Advisory ASA-201901-8 ========================================= Severity: Low Date : 2019-01-11 CVE-ID : CVE-2019-5882 Package : irssi Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-847 Summary ======= The package irssi before version 1.1.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.1.2-1. # pacman -Syu "irssi>=1.1.2-1" The problem has been fixed upstream in version 1.1.2. Workaround ========== If lines are never hidden (no usage of /window hidelevel), this bug will not trigger. Description =========== A use-after-free vulnerability has been found in irssi before 1.1.2, when hidden lines were expired from the scroll buffer. Impact ====== Irssi can crash when hidden lines are expired from the scroll buffer. References ========== https://marc.info/?l=oss-security&m=154711952322177 https://irssi.org/security/irssi_sa_2019_01.txt https://github.com/irssi/irssi/pull/948 https://security.archlinux.org/CVE-2019-5882

1 0

[ASA-201901-7] python2-django: content spoofing
by Jelle van der Waa 13 Jan '19

13 Jan '19

Arch Linux Security Advisory ASA-201901-7 ========================================= Severity: Medium Date : 2019-01-11 CVE-ID : CVE-2019-3498 Package : python2-django Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-838 Summary ======= The package python2-django before version 1.11.18-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 1.11.18-1. # pacman -Syu "python2-django>=1.11.18-1" The problem has been fixed upstream in version 1.11.18. Workaround ========== None. Description =========== A content spoofing issue has been found in django before 2.1.5 and 1.11.18, where an attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the django.views.defaults.page_not_found() view. Impact ====== A remote attacker can spoof content on the not found page with a maliciously crafted URL. References ========== https://www.djangoproject.com/weblog/2019/jan/04/security-releases/ https://github.com/django/django/commit/64d2396e83aedba3fcc84ca40f23fbd22f0… https://github.com/django/django/commit/1cd00fcf52d089ef0fe03beabd05d59df8e… https://security.archlinux.org/CVE-2019-3498

1 0

[ASA-201901-6] python-django: content spoofing
by Jelle van der Waa 13 Jan '19

13 Jan '19

Arch Linux Security Advisory ASA-201901-6 ========================================= Severity: Medium Date : 2019-01-11 CVE-ID : CVE-2019-3498 Package : python-django Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-839 Summary ======= The package python-django before version 2.1.5-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 2.1.5-1. # pacman -Syu "python-django>=2.1.5-1" The problem has been fixed upstream in version 2.1.5. Workaround ========== None. Description =========== A content spoofing issue has been found in django before 2.1.5 and 1.11.18, where an attacker could craft a malicious URL that could make spoofed content appear on the default page generated by the django.views.defaults.page_not_found() view. Impact ====== A remote attacker can spoof content on the not found page with a maliciously crafted URL. References ========== https://www.djangoproject.com/weblog/2019/jan/04/security-releases/ https://github.com/django/django/commit/64d2396e83aedba3fcc84ca40f23fbd22f0… https://github.com/django/django/commit/1cd00fcf52d089ef0fe03beabd05d59df8e… https://security.archlinux.org/CVE-2019-3498

1 0

[ASA-201901-5] wireshark-cli: multiple issues
by Jelle van der Waa 11 Jan '19

11 Jan '19

Arch Linux Security Advisory ASA-201901-5 ========================================= Severity: Medium Date : 2019-01-10 CVE-ID : CVE-2019-5716 CVE-2019-5717 CVE-2019-5718 CVE-2019-5719 Package : wireshark-cli Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-844 Summary ======= The package wireshark-cli before version 2.6.6-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 2.6.6-1. # pacman -Syu "wireshark-cli>=2.6.6-1" The problems have been fixed upstream in version 2.6.6. Workaround ========== None. Description =========== - CVE-2019-5716 (denial of service) An assertion failure has been found in the 6LoWPAN dissector of Wireshark versions prior to 2.6.6, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2019-5717 (denial of service) A NULL-pointer dereference has been found in the P_MUL dissector of Wireshark versions prior to 2.6.6, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2019-5718 (information disclosure) An out-of-bounds read has been found in the RTSE dissector of Wireshark versions prior to 2.6.6, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2019-5719 (denial of service) A NULL-pointer dereference has been found in the ISAKMP dissector of Wireshark versions prior to 2.6.6, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker can crash wireshark or access sensitive information via a crafted PCAP file or network packet. References ========== https://www.wireshark.org/docs/relnotes/wireshark-2.6.6.html https://www.wireshark.org/security/wnpa-sec-2019-01 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15217 https://code.wireshark.org/review/#/c/31311/ https://www.wireshark.org/security/wnpa-sec-2019-02 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15337 https://code.wireshark.org/review/#/c/30986/ https://www.wireshark.org/security/wnpa-sec-2019-03 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15373 https://code.wireshark.org/review/#/c/31439/ https://www.wireshark.org/security/wnpa-sec-2019-04 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15374 https://code.wireshark.org/review/#/c/31219/ https://security.archlinux.org/CVE-2019-5716 https://security.archlinux.org/CVE-2019-5717 https://security.archlinux.org/CVE-2019-5718 https://security.archlinux.org/CVE-2019-5719

1 0

[ASA-201901-4] systemd: multiple issues
by Jelle van der Waa 11 Jan '19

11 Jan '19

Arch Linux Security Advisory ASA-201901-4 ========================================= Severity: Medium Date : 2019-01-08 CVE-ID : CVE-2018-6954 CVE-2018-16866 Package : systemd Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-615 Summary ======= The package systemd before version 240.0-3 is vulnerable to multiple issues including arbitrary file overwrite and information disclosure. Resolution ========== Upgrade to 240.0-3. # pacman -Syu "systemd>=240.0-3" The problems have been fixed upstream in version 240.0. Workaround ========== None. Description =========== - CVE-2018-6954 (arbitrary file overwrite) systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on. - CVE-2018-16866 (information disclosure) An out-of-bounds read has been found in the journald component of systemd >= v221 and < v240, in the syslog_parse_identifier() function in journald-syslog.c. A crafted syslog message whose last character is ':' can trigger this vulnerability to leak information about the content of the memory. Impact ====== A local attacker is able to obtain ownership of arbitrary files or disclose information using a specially crafted syslog message. References ========== https://github.com/systemd/systemd/issues/7986 https://github.com/systemd/systemd/pull/8822 https://www.qualys.com/2019/01/09/system-down/system-down.txt https://www.openwall.com/lists/oss-security/2019/01/09/3 https://github.com/systemd/systemd/commit/a6aadf4ae0bae185dc4c414d492a4a781… https://github.com/systemd/systemd/commit/8595102d3ddde6d25c282f965573a6de3… https://security.archlinux.org/CVE-2018-6954 https://security.archlinux.org/CVE-2018-16866

1 0

[ASA-201901-3] elfutils: denial of service
by Santiago Torres-Arias 08 Jan '19

08 Jan '19

Arch Linux Security Advisory ASA-201901-3 ========================================= Severity: Medium Date : 2019-01-08 CVE-ID : CVE-2018-18310 CVE-2018-18520 CVE-2018-18521 Package : elfutils Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-785 Summary ======= The package elfutils before version 0.175-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.175-1. # pacman -Syu "elfutils>=0.175-1" The problems have been fixed upstream in version 0.175. Workaround ========== None. Description =========== - CVE-2018-18310 (denial of service) An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file. - CVE-2018-18520 (denial of service) An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file. - CVE-2018-18521 (denial of service) Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled. Impact ====== An attacker can crash an application using one of the elfutils libraries to parse files via a crafted ELF file. References ========== https://sourceware.org/bugzilla/show_bug.cgi?id=23752 https://sourceware.org/ml/elfutils-devel/2018-q4/msg00022.html https://sourceware.org/bugzilla/show_bug.cgi?id=23787 https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html https://sourceware.org/bugzilla/show_bug.cgi?id=23786 https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html https://security.archlinux.org/CVE-2018-18310 https://security.archlinux.org/CVE-2018-18520 https://security.archlinux.org/CVE-2018-18521

1 0

[ASA-201901-2] polkit: privilege escalation
by Santiago Torres-Arias 08 Jan '19

08 Jan '19

Arch Linux Security Advisory ASA-201901-2 ========================================= Severity: High Date : 2019-01-08 CVE-ID : CVE-2018-19788 Package : polkit Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-828 Summary ======= The package polkit before version 0.115+24+g5230646-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 0.115+24+g5230646-1. # pacman -Syu "polkit>=0.115+24+g5230646-1" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in polkit <= 0.115, where an unprivileged user with a UID > INT_MAX can successfully execute any systemctl command. Impact ====== A local, unprivileged user whose UID is larger than INT_MAX can escalate privileges. References ========== https://seclists.org/oss-sec/2018/q4/198 https://gitlab.freedesktop.org/polkit/polkit/issues/74 https://gitlab.freedesktop.org/polkit/polkit/commit/2cb40c4d5feeaa09325522b… https://security.archlinux.org/CVE-2018-19788

1 0

[ASA-201901-1] tar: denial of service
by Santiago Torres-Arias 08 Jan '19

08 Jan '19

Arch Linux Security Advisory ASA-201901-1 ========================================= Severity: Low Date : 2019-01-08 CVE-ID : CVE-2018-20482 Package : tar Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-841 Summary ======= The package tar before version 1.31-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.31-1. # pacman -Syu "tar>=1.31-1" The problem has been fixed upstream in version 1.31. Workaround ========== None. Description =========== A denial of service issue has been found in GNU Tar versions up to and including 1.30. When creating archives with the --sparse option, tar would loop endlessly if a sparse file had been truncated while being archived. Impact ====== An attacker might be able to cause a denial of service via an archive created with the --sparse option. References ========== https://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.html https://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42c https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBug https://security.archlinux.org/CVE-2018-20482

1 0