- Arch-security - lists.archlinux.org

[arch-security] [ASA-201711-3] mupdf-tools: arbitrary code execution
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-3 ========================================= Severity: High Date : 2017-11-01 CVE-ID : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587 Package : mupdf-tools Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-458 Summary ======= The package mupdf-tools before version 1.11-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.11-5. # pacman -Syu "mupdf-tools>=1.11-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-14685 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. - CVE-2017-14686 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. - CVE-2017-14687 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. - CVE-2017-15587 (arbitrary code execution) An integer overflow leading to an out-of-bounds wrte has been found in mupdf <= 1.11. The parsing of a crafted PDF might allow an attacker to write controlled data to an arbitrary location in memory when performing truncated xref checks. Impact ====== An attacker is able to execute arbitrary code on the affected host by providing a maliciously-crafted .xps or .pdf file. References ========== http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=ab1a420613dec93c686a… https://bugs.ghostscript.com/show_bug.cgi?id=698539 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=0f0fbc07d9be31f5e83e… https://bugs.ghostscript.com/show_bug.cgi?id=698540 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=2b16dbd8f73269cb15ca… https://bugs.ghostscript.com/show_bug.cgi?id=698558 https://nandynarwhals.org/CVE-2017-15587/ http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=82df2631d7d0446b206e… https://security.archlinux.org/CVE-2017-14685 https://security.archlinux.org/CVE-2017-14686 https://security.archlinux.org/CVE-2017-14687 https://security.archlinux.org/CVE-2017-15587

1 0

[arch-security] [ASA-201711-2] libmupdf: arbitrary code execution
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-2 ========================================= Severity: High Date : 2017-11-01 CVE-ID : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587 Package : libmupdf Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-458 Summary ======= The package libmupdf before version 1.11-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.11-5. # pacman -Syu "libmupdf>=1.11-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-14685 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. - CVE-2017-14686 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. - CVE-2017-14687 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. - CVE-2017-15587 (arbitrary code execution) An integer overflow leading to an out-of-bounds wrte has been found in mupdf <= 1.11. The parsing of a crafted PDF might allow an attacker to write controlled data to an arbitrary location in memory when performing truncated xref checks. Impact ====== An attacker is able to execute arbitrary code on the affected host by providing a maliciously-crafted .xps or .pdf file. References ========== http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=ab1a420613dec93c686a… https://bugs.ghostscript.com/show_bug.cgi?id=698539 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=0f0fbc07d9be31f5e83e… https://bugs.ghostscript.com/show_bug.cgi?id=698540 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=2b16dbd8f73269cb15ca… https://bugs.ghostscript.com/show_bug.cgi?id=698558 https://nandynarwhals.org/CVE-2017-15587/ http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=82df2631d7d0446b206e… https://security.archlinux.org/CVE-2017-14685 https://security.archlinux.org/CVE-2017-14686 https://security.archlinux.org/CVE-2017-14687 https://security.archlinux.org/CVE-2017-15587

1 0

[arch-security] [ASA-201711-1] mupdf-gl: arbitrary code execution
by Levente Polyak 06 Nov '17

06 Nov '17

Arch Linux Security Advisory ASA-201711-1 ========================================= Severity: High Date : 2017-11-01 CVE-ID : CVE-2017-14685 CVE-2017-14686 CVE-2017-14687 CVE-2017-15587 Package : mupdf-gl Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-458 Summary ======= The package mupdf-gl before version 1.11-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.11-5. # pacman -Syu "mupdf-gl>=1.11-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-14685 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because xps_load_links_in_glyphs in xps/xps-link.c does not verify that an xps font could be loaded. - CVE-2017-14686 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a denial of service via a crafted .xps file. This occurs because read_zip_dir_imp in fitz/unzip.c does not check whether size fields in a ZIP entry are negative numbers. - CVE-2017-14687 (arbitrary code execution) Artifex MuPDF 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. - CVE-2017-15587 (arbitrary code execution) An integer overflow leading to an out-of-bounds wrte has been found in mupdf <= 1.11. The parsing of a crafted PDF might allow an attacker to write controlled data to an arbitrary location in memory when performing truncated xref checks. Impact ====== An attacker is able to execute arbitrary code on the affected host by providing a maliciously-crafted .xps or .pdf file. References ========== http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=ab1a420613dec93c686a… https://bugs.ghostscript.com/show_bug.cgi?id=698539 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=0f0fbc07d9be31f5e83e… https://bugs.ghostscript.com/show_bug.cgi?id=698540 http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=2b16dbd8f73269cb15ca… https://bugs.ghostscript.com/show_bug.cgi?id=698558 https://nandynarwhals.org/CVE-2017-15587/ http://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=82df2631d7d0446b206e… https://security.archlinux.org/CVE-2017-14685 https://security.archlinux.org/CVE-2017-14686 https://security.archlinux.org/CVE-2017-14687 https://security.archlinux.org/CVE-2017-15587

1 0

[arch-security] [ASA-201710-34] wget: multiple issues
by Christian Rebischke 30 Oct '17

30 Oct '17

Arch Linux Security Advisory ASA-201710-34 ========================================== Severity: Critical Date : 2017-10-29 CVE-ID : CVE-2017-13089 CVE-2017-13090 CVE-2017-6508 Package : wget Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-473 Summary ======= The package wget before version 1.19.2-1 is vulnerable to multiple issues including arbitrary code execution and content spoofing. Resolution ========== Upgrade to 1.19.2-1. # pacman -Syu "wget>=1.19.2-1" The problems have been fixed upstream in version 1.19.2. Workaround ========== None. Description =========== - CVE-2017-13089 (arbitrary code execution) A stack-based buffer overflow has been found in the HTTP protocol handling code of wget < 1.19.2, when processing chunked, encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. - CVE-2017-13090 (arbitrary code execution) A heap-based buffer overflow has been found in the HTTP protocol handling code of wget < 1.19.2, when processing chunked encoded HTTP responses. By tricking an unsuspecting user into connecting to a malicious HTTP server, an attacker could exploit this flaw to potentially execute arbitrary code. - CVE-2017-6508 (content spoofing) A CRLF injection flaw was found in the way wget < 1.19.2 handled URLs. A remote attacker could use this flaw to inject arbitrary HTTP headers in requests, via CRLF sequences in the host sub-component of a URL, by tricking a user running wget into processing crafted URLs. Impact ====== By tricking an unsuspecting user into connecting to a malicious host a remote attacker is able to execute arbitrary code or spoof returned data. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1505444 https://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734e… https://bugzilla.redhat.com/show_bug.cgi?id=1505445 https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce4147… http://lists.gnu.org/archive/html/bug-wget/2017-03/msg00018.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-6508 http://git.savannah.gnu.org/cgit/wget.git/commit/?id=4d729e322fae359a1aefaa… https://security.archlinux.org/CVE-2017-13089 https://security.archlinux.org/CVE-2017-13090 https://security.archlinux.org/CVE-2017-6508

1 0

[arch-security] [ASA-201710-33] apr-util: denial of service
by Remi Gacogne 27 Oct '17

27 Oct '17

Arch Linux Security Advisory ASA-201710-33 ========================================== Severity: Low Date : 2017-10-27 CVE-ID : CVE-2017-12618 Package : apr-util Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-468 Summary ======= The package apr-util before version 1.6.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.6.1-1. # pacman -Syu "apr-util>=1.6.1-1" The problem has been fixed upstream in version 1.6.1. Workaround ========== None. Description =========== APR-util 1.6.0 and prior failed to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service. Impact ====== A local attacker with write access to the database can cause a denial of service. References ========== https://mail-archives.apache.org/mod_mbox/apr-dev/201710.mbox/%3CCACsi252PO… https://security.archlinux.org/CVE-2017-12618

1 0

[arch-security] [ASA-201710-32] apr: information disclosure
by Remi Gacogne 27 Oct '17

27 Oct '17

Arch Linux Security Advisory ASA-201710-32 ========================================== Severity: Medium Date : 2017-10-27 CVE-ID : CVE-2017-12613 Package : apr Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-469 Summary ======= The package apr before version 1.6.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.6.3-1. # pacman -Syu "apr>=1.6.3-1" The problem has been fixed upstream in version 1.6.3. Workaround ========== None. Description =========== When apr_exp_time*() or apr_os_exp_time*() functions are invoked with an invalid month field value in APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input. Impact ====== A remote attacker can access sensitive information or cause a denial of service by submitting specially crafted input. References ========== https://mail-archives.apache.org/mod_mbox/apr-dev/201710.mbox/%3CCACsi252PO… https://security.archlinux.org/CVE-2017-12613

1 0

[arch-security] [ASA-201710-31] chromium: arbitrary code execution
by Remi Gacogne 27 Oct '17

27 Oct '17

Arch Linux Security Advisory ASA-201710-31 ========================================== Severity: Critical Date : 2017-10-27 CVE-ID : CVE-2017-15396 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-472 Summary ======= The package chromium before version 62.0.3202.75-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 62.0.3202.75-1. # pacman -Syu "chromium>=62.0.3202.75-1" The problem has been fixed upstream in version 62.0.3202.75. Workaround ========== None. Description =========== A stack overflow has been found in the V8 component of the chromium browser < 62.0.3202.75. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-des… https://crbug.com/770452 https://security.archlinux.org/CVE-2017-15396

1 0

[arch-security] [ASA-201710-30] irssi: multiple issues
by Remi Gacogne 22 Oct '17

22 Oct '17

Arch Linux Security Advisory ASA-201710-30 ========================================== Severity: High Date : 2017-10-22 CVE-ID : CVE-2017-15227 CVE-2017-15228 CVE-2017-15721 CVE-2017-15722 CVE-2017-15723 Package : irssi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-461 Summary ======= The package irssi before version 1.0.5-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.0.5-1. # pacman -Syu "irssi>=1.0.5-1" The problems have been fixed upstream in version 1.0.5. Workaround ========== None. Description =========== - CVE-2017-15227 (arbitrary code execution) While waiting for the channel synchronization, Irssi < 1.0.5 may incorrectly fail to remove destroyed channels from the query list, resulting in use-after-free conditions when updating the state later on. To be exploited, this issue requires a broken IRCd or control over the IRCd. - CVE-2017-15228 (denial of service) When installing themes with unterminated colour formatting sequences, Irssi < 1.0.5 may access data beyond the end of the string. - CVE-2017-15721 (denial of service) Certain incorrectly formatted DCC CTCP messages could cause NULL- pointer dereference in Irssi < 1.0.5. This is a separate, but similar issue to CVE-2017-9468. To be exploited, this issue requires a broken IRCd or control over the IRCd. - CVE-2017-15722 (denial of service) In certain cases Irssi may fail to verify that a Safe channel ID is long enough, causing reads beyond the end of the string. To be exploited, this issue requires a broken IRCd or control over the IRCd. - CVE-2017-15723 (denial of service) Overlong nicks or targets may result in a NULL-pointer dereference in Irssi >= 0.8.17 and < 1.0.5 while splitting the message. Most IRC servers typically have length limits in place that would prevent this issue. Impact ====== A remote attacker can cause a denial of service by sending crafted IRC messages, or tricking the user into installing a crafted theme. A remote attacker in control of the IRCd to which the user is connected, or in position of man-in-the-middle, might be able to execute arbitrary code on the affected host. References ========== https://irssi.org/security/irssi_sa_2017_10.txt https://github.com/irssi/irssi/commit/49ace3251b79a9e97c6e4d0bc640f9143dc71… https://github.com/irssi/irssi/commit/2edd816e7db13b4ac0b20df9bf7fe55ee7718… https://github.com/irssi/irssi/commit/00c80cb6fcca40cfc421fe3fc181115ac4907… https://github.com/irssi/irssi/commit/9f0dc4766c7aa80e34aa2cde94323fb49971a… https://github.com/irssi/irssi/commit/45dfe2ba3889c5dc23a9bea3214f158cc651a… https://github.com/irssi/irssi/commit/0840eaec7bf56740029aae614e393f8cf76f6… https://security.archlinux.org/CVE-2017-15227 https://security.archlinux.org/CVE-2017-15228 https://security.archlinux.org/CVE-2017-15721 https://security.archlinux.org/CVE-2017-15722 https://security.archlinux.org/CVE-2017-15723

1 0

[arch-security] [ASA-201710-29] xorg-server: arbitrary code execution
by Remi Gacogne 21 Oct '17

21 Oct '17

Arch Linux Security Advisory ASA-201710-29 ========================================== Severity: High Date : 2017-10-21 CVE-ID : CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12183 Package : xorg-server Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-443 Summary ======= The package xorg-server before version 1.19.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.19.5-1. # pacman -Syu "xorg-server>=1.19.5-1" The problems have been fixed upstream in version 1.19.5. Workaround ========== None. Description =========== - CVE-2017-12176 (arbitrary code execution) A security issue has been found in xorg-server, due to a missing validation of the extra length in ProcEstablishConnection(). - CVE-2017-12177 (arbitrary code execution) A security issue has been found in the double buffer extension component of xorg-server, due to a missing validation of the length of a variable-length request in ProcDbeGetVisualInfo(). - CVE-2017-12178 (arbitrary code execution) A security issue has been found in the Xi component of xorg-server, due to an invalid length check in ProcXIChangeHierarchy. - CVE-2017-12183 (arbitrary code execution) A security issue has been found in the xfixes component of xorg-server, where buffer lengths were not correctly validated. Impact ====== An attacker able to connect to an X server, either locally or remotely, can cause a denial of service by crashing the server, or execute arbitrary code on the affected host. References ========== https://lists.x.org/archives/xorg-devel/2017-October/054871.html https://cgit.freedesktop.org/xorg/xserver/commit/?id=b747da5e25be944337a9cd… https://cgit.freedesktop.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234… https://cgit.freedesktop.org/xorg/xserver/commit/?id=859b08d523307eebde7724… https://cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc9… https://security.archlinux.org/CVE-2017-12176 https://security.archlinux.org/CVE-2017-12177 https://security.archlinux.org/CVE-2017-12178 https://security.archlinux.org/CVE-2017-12183

1 0

[arch-security] [ASA-201710-28] musl: arbitrary code execution
by Remi Gacogne 21 Oct '17

21 Oct '17

Arch Linux Security Advisory ASA-201710-28 ========================================== Severity: Critical Date : 2017-10-21 CVE-ID : CVE-2017-15650 Package : musl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-457 Summary ======= The package musl before version 1.1.17-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.1.17-1. # pacman -Syu "musl>=1.1.17-1" The problem has been fixed upstream in version 1.1.17. Workaround ========== Using a local, trusted DNS resolver mitigates the issue. Description =========== A stack-based buffer overflow has been found in the DNS response parsing code of musl libc <= 1.1.16. When an application makes a request via getaddrinfo for both IPv4 and IPv6 results (AF_UNSPEC), an attacker who controls or can spoof the nameservers configured in resolv.conf can reply to both the A and AAAA queries with A results. Since A records are smaller than AAAA records, it's possible to fit more addresses than the precomputed bound, and a buffer overflow occurs. Impact ====== A remote attacker who controls or can spoof the nameservers configured in resolv.conf can execute arbitrary code on the affected host. References ========== http://seclists.org/oss-sec/2017/q4/107 https://git.musl-libc.org/cgit/musl/commit/?id=45ca5d3fcb6f874bf5ba55d0e965… https://security.archlinux.org/CVE-2017-15650

1 0