May 2019 - Arch-security - lists.archlinux.org

[ASA-201905-7] perl-email-address: denial of service
by Santiago Torres-Arias 07 May '19

07 May '19

Arch Linux Security Advisory ASA-201905-7 ========================================= Severity: Low Date : 2019-05-06 CVE-ID : CVE-2018-12558 Package : perl-email-address Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-722 Summary ======= The package perl-email-address before version 1.912-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.912-1. # pacman -Syu "perl-email-address>=1.912-1" The problem has been fixed upstream in version 1.912. Workaround ========== None. Description =========== perl-email-address 1.909 is vulnerable to Algorithm Complexity problem and can cause Denial of Service when attacker prepares specially crafted input. Impact ====== A remote attacker can cause a denial of service via specially crafted input. References ========== https://github.com/Perl-Email-Project/Email-Address/issues/19 http://www.openwall.com/lists/oss-security/2018/06/19/3 https://security.archlinux.org/CVE-2018-12558

1 0

[ASA-201905-6] dovecot: denial of service
by Santiago Torres-Arias 07 May '19

07 May '19

Arch Linux Security Advisory ASA-201905-6 ========================================= Severity: Medium Date : 2019-05-06 CVE-ID : CVE-2019-11494 CVE-2019-11499 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-954 Summary ======= The package dovecot before version 2.3.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.3.6-1. # pacman -Syu "dovecot>=2.3.6-1" The problems have been fixed upstream in version 2.3.6. Workaround ========== None. Description =========== - CVE-2019-11494 (denial of service) Submission-login crashes with signal 11 due to null pointer access when authentication is aborted by disconnecting. This can lead to denial-of service attack by persistent attacker(s). - CVE-2019-11499 (denial of service) Submission-login crashes when authentication is started over TLS secured channel and invalid authentication message is sent. This can lead to denial-of-service attack by persistent attacker(s). Impact ====== A remote attacker is able to cause a denial of service by sending invalid authentication messages or aborting the authentication process. References ========== https://dovecot.org/doc/NEWS-2.3 https://www.mail-archive.com/fulldisclosure@seclists.org/msg06126.html https://dovecot.org/pipermail/dovecot/2019-April/115757.html https://dovecot.org/pipermail/dovecot/2019-April/115758.html https://security.archlinux.org/CVE-2019-11494 https://security.archlinux.org/CVE-2019-11499

1 0

[ASA-201905-5] tcpreplay: multiple issues
by Santiago Torres-Arias 07 May '19

07 May '19

Arch Linux Security Advisory ASA-201905-5 ========================================= Severity: High Date : 2019-05-06 CVE-ID : CVE-2019-8376 CVE-2019-8377 CVE-2019-8381 Package : tcpreplay Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-902 Summary ======= The package tcpreplay before version 4.3.2-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 4.3.2-1. # pacman -Syu "tcpreplay>=4.3.2-1" The problems have been fixed upstream in version 4.3.2. Workaround ========== None. Description =========== - CVE-2019-8376 (denial of service) An issue was discovered in tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_layer4_v6() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. - CVE-2019-8377 (denial of service) An issue was discovered in tcpreplay 4.3.1. A NULL pointer dereference occurred in the function get_ipv6_l4proto() located at get.c. This can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. - CVE-2019-8381 (arbitrary code execution) An issue was discovered in tcpreplay 4.3.1. An invalid memory access occurs in do_checksum in checksum.c. It can be triggered by sending a crafted pcap file to the tcpreplay-edit binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. Impact ====== A remote attacker is able to cause a denial of service, or execute arbitrary code, with a specially crafted pcap file. References ========== https://github.com/appneta/tcpreplay/issues/537 https://research.loginsoft.com/vulnerability/null-pointer-dereference-vulne… https://github.com/appneta/tcpreplay/issues/536 https://research.loginsoft.com/vulnerability/null-pointer-dereference-vulne… https://research.loginsoft.com/bugs/invalid-memory-access-vulnerability-in-… https://github.com/appneta/tcpreplay/issues/538 https://github.com/appneta/tcpreplay/pull/548/commits/dae97cbafc5c06ebbc6b3… https://security.archlinux.org/CVE-2019-8376 https://security.archlinux.org/CVE-2019-8377 https://security.archlinux.org/CVE-2019-8381

1 0

[ASA-201905-4] linux-zen: arbitrary code execution
by Santiago Torres-Arias 07 May '19

07 May '19

Arch Linux Security Advisory ASA-201905-4 ========================================= Severity: High Date : 2019-05-06 CVE-ID : CVE-2019-11683 Package : linux-zen Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-957 Summary ======= The package linux-zen before version 5.0.12.zen2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.0.12.zen2-1. # pacman -Syu "linux-zen>=5.0.12.zen2-1" The problem has been fixed upstream in version 5.0.12.zen2. Workaround ========== None. Description =========== udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x through 5.0.11 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have unspecified other impact via UDP packets with a 0 payload, because of mishandling of padded packets, aka the "GRO packet of death" issue. Impact ====== A remote attacker is able to cause a denial of service possibly leading to remote code execution by sending UDP packets with a special payload. References ========== https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d… http://www.securityfocus.com/bid/108142 http://www.openwall.com/lists/oss-security/2019/05/05/4 http://www.openwall.com/lists/oss-security/2019/05/02/1 https://security.archlinux.org/CVE-2019-11683

1 0

[ASA-201905-3] nautilus: sandbox escape
by Santiago Torres-Arias 07 May '19

07 May '19

Arch Linux Security Advisory ASA-201905-3 ========================================= Severity: High Date : 2019-05-06 CVE-ID : CVE-2019-11461 Package : nautilus Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-956 Summary ======= The package nautilus before version 3.32.1-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 3.32.1-1. # pacman -Syu "nautilus>=3.32.1-1" The problem has been fixed upstream in version 3.32.1. Workaround ========== None. Description =========== An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063. Impact ====== A local attacker is able to escape the sandbox. References ========== https://gitlab.gnome.org/GNOME/nautilus/issues/987 https://gitlab.gnome.org/GNOME/nautilus/commit/2ddba428ef2b13d0620bd599c363… https://security.archlinux.org/CVE-2019-11461

1 0

[ASA-201905-2] linux: arbitrary code execution
by Santiago Torres-Arias 07 May '19

07 May '19

Arch Linux Security Advisory ASA-201905-2 ========================================= Severity: High Date : 2019-05-06 CVE-ID : CVE-2019-11683 Package : linux Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-955 Summary ======= The package linux before version 5.0.12.arch2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.0.12.arch2-1. # pacman -Syu "linux>=5.0.12.arch2-1" The problem has been fixed upstream in version 5.0.12.arch2. Workaround ========== None. Description =========== udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x through 5.0.11 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have unspecified other impact via UDP packets with a 0 payload, because of mishandling of padded packets, aka the "GRO packet of death" issue. Impact ====== A remote attacker is able to cause a denial of service possibly leading to remote code execution by sending UDP packets with a special payload. References ========== https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d… http://www.securityfocus.com/bid/108142 http://www.openwall.com/lists/oss-security/2019/05/05/4 http://www.openwall.com/lists/oss-security/2019/05/02/1 https://security.archlinux.org/CVE-2019-11683

1 0

[ASA-201905-1] munin: arbitrary file overwrite
by Santiago Torres-Arias 07 May '19

07 May '19

Arch Linux Security Advisory ASA-201905-1 ========================================= Severity: High Date : 2019-05-06 CVE-ID : CVE-2017-6188 Package : munin Type : arbitrary file overwrite Remote : Yes Link : https://security.archlinux.org/AVG-953 Summary ======= The package munin before version 2.0.47-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 2.0.47-1. # pacman -Syu "munin>=2.0.47-1" The problem has been fixed upstream in version 2.0.47. Workaround ========== None. Description =========== A vulnerability in munin allows attackers to overwrite any file accessible to the webserver user by setting multiple upper_limit GET parameters when CGI graphs are enabled. Impact ====== A remote attacker is able to overwrite arbitrary files on the filesystem. References ========== https://bugs.archlinux.org/task/57537 https://www.debian.org/security/2017/dsa-3794 https://github.com/munin-monitoring/munin/pull/797/commits/42ce18f24d3eae8b… https://security.archlinux.org/CVE-2017-6188

1 0