- Arch-security - lists.archlinux.org

[arch-security] [ASA-201710-27] chromium: multiple issues
by Remi Gacogne 19 Oct '17

19 Oct '17

Arch Linux Security Advisory ASA-201710-27 ========================================== Severity: Critical Date : 2017-10-19 CVE-ID : CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127 CVE-2017-5128 CVE-2017-5129 CVE-2017-5130 CVE-2017-5131 CVE-2017-5132 CVE-2017-5133 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-456 Summary ======= The package chromium before version 62.0.3202.62-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, access restriction bypass, content spoofing, information disclosure and denial of service. Resolution ========== Upgrade to 62.0.3202.62-1. # pacman -Syu "chromium>=62.0.3202.62-1" The problems have been fixed upstream in version 62.0.3202.62. Workaround ========== None. Description =========== - CVE-2017-15386 (content spoofing) A UI spoofing issue has been found in the Blink component of the Chromium browser < 62.0.3202.62. - CVE-2017-15387 (access restriction bypass) A content security bypass has been found in the Chromium browser < 62.0.3202.62. - CVE-2017-15388 (information disclosure) An out-of-bounds read has been found in the Skia component of the Chromium browser < 62.0.3202.62. - CVE-2017-15389 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser < 62.0.3202.62. - CVE-2017-15390 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the Chromium browser < 62.0.3202.62. - CVE-2017-15391 (access restriction bypass) An extension limitation bypass has been found in the Extensions component of the Chromium browser < 62.0.3202.62. - CVE-2017-15392 (access restriction bypass) An incorrect registry key handling issue has been found in the PlatformIntegration component of the Chromium browser < 62.0.3202.62. - CVE-2017-15393 (information disclosure) A referrer leak has been found in the Devtools component of the Chromium browser < 62.0.3202.62. - CVE-2017-15394 (content spoofing) A URL spoofing flaw has been found in the extensions UI of the Chromium browser < 62.0.3202.62. - CVE-2017-15395 (denial of service) A null-pointer dereference flaw has been found in the ImageCapture component of the Chromium browser < 62.0.3202.62. - CVE-2017-5124 (cross-site scripting) A universal XSS flaw has been found in the MHTML component of the Chromium browser < 62.0.3202.62. - CVE-2017-5125 (arbitrary code execution) A heap overflow security issue has been found in the Skia component of the Chromium browser < 62.0.3202.62. - CVE-2017-5126 (arbitrary code execution) A use-after-free security issue has been found in the PDFium component of the Chromium browser < 62.0.3202.62. - CVE-2017-5127 (arbitrary code execution) A use-after-free security issue has been found in the PDFium component of the Chromium browser < 62.0.3202.62. - CVE-2017-5128 (arbitrary code execution) A heap overflow security issue has been found in the WebGL component of the Chromium browser < 62.0.3202.62. - CVE-2017-5129 (arbitrary code execution) A use-after-free security issue has been found in the WebAudio component of the Chromium browser < 62.0.3202.62. - CVE-2017-5130 (arbitrary code execution) A heap overflow security issue has been found in libxml2. - CVE-2017-5131 (arbitrary code execution) An out-of-bounds write has been found in the Skia component of the Chromium browser < 62.0.3202.62. - CVE-2017-5132 (arbitrary code execution) An incorrect stack manipulation security issue has been found in the WebAssembly component of the Chromium browser < 62.0.3202.62. - CVE-2017-5133 (arbitrary code execution) An out-of-bounds write has been found in the Skia component of the Chromium browser < 62.0.3202.62. Impact ====== A remote attacker can bypass security measures, trick the user by spoofing parts of the UI, cause a denial of service or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-des… https://crbug.com/752003 https://crbug.com/756040 https://crbug.com/756563 https://crbug.com/739621 https://crbug.com/750239 https://crbug.com/598265 https://crbug.com/714401 https://crbug.com/732751 https://crbug.com/745580 https://crbug.com/759457 https://crbug.com/762930 https://crbug.com/749147 https://crbug.com/760455 https://crbug.com/765384 https://crbug.com/765469 https://crbug.com/765495 https://crbug.com/722079 https://crbug.com/744109 https://crbug.com/718858 https://crbug.com/762106 https://security.archlinux.org/CVE-2017-15386 https://security.archlinux.org/CVE-2017-15387 https://security.archlinux.org/CVE-2017-15388 https://security.archlinux.org/CVE-2017-15389 https://security.archlinux.org/CVE-2017-15390 https://security.archlinux.org/CVE-2017-15391 https://security.archlinux.org/CVE-2017-15392 https://security.archlinux.org/CVE-2017-15393 https://security.archlinux.org/CVE-2017-15394 https://security.archlinux.org/CVE-2017-15395 https://security.archlinux.org/CVE-2017-5124 https://security.archlinux.org/CVE-2017-5125 https://security.archlinux.org/CVE-2017-5126 https://security.archlinux.org/CVE-2017-5127 https://security.archlinux.org/CVE-2017-5128 https://security.archlinux.org/CVE-2017-5129 https://security.archlinux.org/CVE-2017-5130 https://security.archlinux.org/CVE-2017-5131 https://security.archlinux.org/CVE-2017-5132 https://security.archlinux.org/CVE-2017-5133

1 0

[arch-security] [ASA-201710-26] linux: privilege escalation
by Santiago Torres-Arias 17 Oct '17

17 Oct '17

Arch Linux Security Advisory ASA-201710-26 ========================================== Severity: High Date : 2017-10-17 CVE-ID : CVE-2017-5123 Package : linux Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-444 Summary ======= The package linux before version 4.13.7-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.13.7-1. # pacman -Syu "linux>=4.13.7-1" The problem has been fixed upstream in version 4.13.7. Workaround ========== None. Description =========== It was discovered that when the waitid() syscall in Linux kernel v4.13 was refactored, it accidentally stopped checking that the incoming argument was pointing to userspace. This allowed local attackers to write directly to kernel memory, which could lead to privilege escalation. Impact ====== A local attacker is able to escalate privileges on the affected host. References ========== http://www.openwall.com/lists/oss-security/2017/10/12/18 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2017-5123

1 0

[arch-security] [ASA-201710-25] linux-hardened: privilege escalation
by Santiago Torres-Arias 17 Oct '17

17 Oct '17

Arch Linux Security Advisory ASA-201710-25 ========================================== Severity: High Date : 2017-10-16 CVE-ID : CVE-2017-5123 Package : linux-hardened Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-446 Summary ======= The package linux-hardened before version 4.13.7.a-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.13.7.a-1. # pacman -Syu "linux-hardened>=4.13.7.a-1" The problem has been fixed upstream in version 4.13.7.a. Workaround ========== None. Description =========== It was discovered that when the waitid() syscall in Linux kernel v4.13 was refactored, it accidentally stopped checking that the incoming argument was pointing to userspace. This allowed local attackers to write directly to kernel memory, which could lead to privilege escalation. Impact ====== A local attacker is able to escalate privileges on the affected host. References ========== http://www.openwall.com/lists/oss-security/2017/10/12/18 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2017-5123

1 0

[arch-security] [ASA-201710-24] linux-zen: privilege escalation
by Santiago Torres-Arias 17 Oct '17

17 Oct '17

Arch Linux Security Advisory ASA-201710-24 ========================================== Severity: High Date : 2017-10-16 CVE-ID : CVE-2017-5123 Package : linux-zen Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-445 Summary ======= The package linux-zen before version 4.13.7-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.13.7-1. # pacman -Syu "linux-zen>=4.13.7-1" The problem has been fixed upstream in version 4.13.7. Workaround ========== None. Description =========== It was discovered that when the waitid() syscall in Linux kernel v4.13 was refactored, it accidentally stopped checking that the incoming argument was pointing to userspace. This allowed local attackers to write directly to kernel memory, which could lead to privilege escalation. Impact ====== A local attacker is able to escalate privileges on the affected host. References ========== https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2017-5123

1 0

[arch-security] [ASA-201710-23] hostapd: man-in-the-middle
by Levente Polyak 16 Oct '17

16 Oct '17

Arch Linux Security Advisory ASA-201710-23 ========================================== Severity: High Date : 2017-10-16 CVE-ID : CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13082 CVE-2017-13087 CVE-2017-13088 Package : hostapd Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-448 Summary ======= The package hostapd before version 2.6-6 is vulnerable to man-in-the- middle. Resolution ========== Upgrade to 2.6-6. # pacman -Syu "hostapd>=2.6-6" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-13077 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake. - CVE-2017-13078 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) in the 4-way handshake. - CVE-2017-13079 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) in the 4-way handshake. - CVE-2017-13080 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) in the group key handshake. - CVE-2017-13081 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) in the group key handshake. - CVE-2017-13082 (man-in-the-middle) A vulnerability has been discovered that allows accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key (PTK) while processing it. - CVE-2017-13087 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. - CVE-2017-13088 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. Impact ====== A remote attacker within physical proximity to the target WiFi network is able to decrypt all data that the victim transmits, inject arbitrary packets to hijack TCP connection or replay unicast and group-addressed frames. References ========== https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-message… https://papers.mathyvanhoef.com/ccs2017.pdf https://www.kb.cert.org/vuls/id/228519 https://www.krackattacks.com/ https://w1.fi/cgit/hostap/commit/?id=53bb18cc8b7a4da72e47e4b3752d0d2135cffb… https://w1.fi/cgit/hostap/commit/?id=0adc9b28b39d414d5febfff752f6a1576f785c… https://w1.fi/cgit/hostap/commit/?id=cb5132bb35698cc0c743e34fe0e845dfc4c3e4… https://w1.fi/cgit/hostap/commit/?id=0e3bd7ac684a2289aa613347e2f3ad54ad6a94… https://w1.fi/cgit/hostap/commit/?id=e760851176c77ae6de19821bb1d5bf3ae2cb51… https://w1.fi/cgit/hostap/commit/?id=2a9c5217b18be9462a5329626e2f95cc7dd8d4… https://w1.fi/cgit/hostap/commit/?id=87e2db16bafcbc60b8d0016175814a73c1e8ed… https://security.archlinux.org/CVE-2017-13077 https://security.archlinux.org/CVE-2017-13078 https://security.archlinux.org/CVE-2017-13079 https://security.archlinux.org/CVE-2017-13080 https://security.archlinux.org/CVE-2017-13081 https://security.archlinux.org/CVE-2017-13082 https://security.archlinux.org/CVE-2017-13087 https://security.archlinux.org/CVE-2017-13088

1 0

[arch-security] [ASA-201710-22] wpa_supplicant: man-in-the-middle
by Levente Polyak 16 Oct '17

16 Oct '17

Arch Linux Security Advisory ASA-201710-22 ========================================== Severity: High Date : 2017-10-16 CVE-ID : CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13082 CVE-2017-13087 CVE-2017-13088 Package : wpa_supplicant Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-447 Summary ======= The package wpa_supplicant before version 1:2.6-11 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 1:2.6-11. # pacman -Syu "wpa_supplicant>=1:2.6-11" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-13077 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the pairwise encryption key (PTK-TK) in the 4-way handshake. - CVE-2017-13078 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) in the 4-way handshake. - CVE-2017-13079 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) in the 4-way handshake. - CVE-2017-13080 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) in the group key handshake. - CVE-2017-13081 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) in the group key handshake. - CVE-2017-13082 (man-in-the-middle) A vulnerability has been discovered that allows accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key (PTK) while processing it. - CVE-2017-13087 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. - CVE-2017-13088 (man-in-the-middle) A vulnerability has been discovered that allows reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame. Impact ====== A remote attacker within physical proximity to the target WiFi network is able to decrypt all data that the victim transmits, inject arbitrary packets to hijack TCP connection or replay unicast and group-addressed frames. References ========== https://w1.fi/security/2017-1/wpa-packet-number-reuse-with-replayed-message… https://papers.mathyvanhoef.com/ccs2017.pdf https://www.kb.cert.org/vuls/id/228519 https://www.krackattacks.com/ https://w1.fi/cgit/hostap/commit/?id=53bb18cc8b7a4da72e47e4b3752d0d2135cffb… https://w1.fi/cgit/hostap/commit/?id=0adc9b28b39d414d5febfff752f6a1576f785c… https://w1.fi/cgit/hostap/commit/?id=cb5132bb35698cc0c743e34fe0e845dfc4c3e4… https://w1.fi/cgit/hostap/commit/?id=0e3bd7ac684a2289aa613347e2f3ad54ad6a94… https://w1.fi/cgit/hostap/commit/?id=e760851176c77ae6de19821bb1d5bf3ae2cb51… https://w1.fi/cgit/hostap/commit/?id=2a9c5217b18be9462a5329626e2f95cc7dd8d4… https://w1.fi/cgit/hostap/commit/?id=87e2db16bafcbc60b8d0016175814a73c1e8ed… https://security.archlinux.org/CVE-2017-13077 https://security.archlinux.org/CVE-2017-13078 https://security.archlinux.org/CVE-2017-13079 https://security.archlinux.org/CVE-2017-13080 https://security.archlinux.org/CVE-2017-13081 https://security.archlinux.org/CVE-2017-13082 https://security.archlinux.org/CVE-2017-13087 https://security.archlinux.org/CVE-2017-13088

1 0

[arch-security] [ASA-201710-21] lib32-flashplugin: arbitrary code execution
by Remi Gacogne 16 Oct '17

16 Oct '17

Arch Linux Security Advisory ASA-201710-21 ========================================== Severity: Critical Date : 2017-10-16 CVE-ID : CVE-2017-11292 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-450 Summary ======= The package lib32-flashplugin before version 27.0.0.170-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 27.0.0.170-1. # pacman -Syu "lib32-flashplugin>=27.0.0.170-1" The problem has been fixed upstream in version 27.0.0.170. Workaround ========== None. Description =========== A type confusion vulnerability has been found in Adobe Flash Player <= 27.0.0.159, leading to arbitrary code execution. Impact ====== A remote attacker can execute arbitrary code on the affected host. Adobe is aware of a report that an exploit exists in the wild, and is being used in limited, targeted attacks against users running Windows. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-32.html https://security.archlinux.org/CVE-2017-11292

1 0

[arch-security] [ASA-201710-20] flashplugin: arbitrary code execution
by Remi Gacogne 16 Oct '17

16 Oct '17

Arch Linux Security Advisory ASA-201710-20 ========================================== Severity: Critical Date : 2017-10-16 CVE-ID : CVE-2017-11292 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-449 Summary ======= The package flashplugin before version 27.0.0.170-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 27.0.0.170-1. # pacman -Syu "flashplugin>=27.0.0.170-1" The problem has been fixed upstream in version 27.0.0.170. Workaround ========== None. Description =========== A type confusion vulnerability has been found in Adobe Flash Player <= 27.0.0.159, leading to arbitrary code execution. Impact ====== A remote attacker can execute arbitrary code on the affected host. Adobe is aware of a report that an exploit exists in the wild, and is being used in limited, targeted attacks against users running Windows. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-32.html https://security.archlinux.org/CVE-2017-11292

1 0

[arch-security] [ASA-201710-19] thunderbird: multiple issues
by Remi Gacogne 13 Oct '17

13 Oct '17

Arch Linux Security Advisory ASA-201710-19 ========================================== Severity: Critical Date : 2017-10-12 CVE-ID : CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7814 CVE-2017-7818 CVE-2017-7819 CVE-2017-7823 CVE-2017-7824 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-441 Summary ======= The package thunderbird before version 52.4.0-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass and cross-site scripting. Resolution ========== Upgrade to 52.4.0-1. # pacman -Syu "thunderbird>=52.4.0-1" The problems have been fixed upstream in version 52.4.0. Workaround ========== None. Description =========== - CVE-2017-7793 (arbitrary code execution) A use-after-free vulnerability can occur in the Fetch API of Thunderbird < 52.4, when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash. - CVE-2017-7805 (arbitrary code execution) A security issue has been found in Thunderbird < 52.4. During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. - CVE-2017-7810 (arbitrary code execution) Mozilla developers and community members Christoph Diehl, Jan de Mooij, Jason Kratzer, Randell Jesup, Tom Ritter, Tyson Smith, and Sebastian Hengst reported memory safety bugs present in Firefox <= 55, Firefox ESR <= 52.3, and Thunderbird <= 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2017-7814 (access restriction bypass) A security issue has been found in Thunderbird < 52.4. File downloads encoded with blob: and data: URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. - CVE-2017-7818 (arbitrary code execution) A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM, in Thunderbird < 52.4. This results in a potentially exploitable crash. - CVE-2017-7819 (arbitrary code execution) A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory, in Thunderbird < 52.4. This results in a potentially exploitable crash. - CVE-2017-7823 (cross-site scripting) The content security policy (CSP) sandbox directive in Thunderbird < 52.4 did not create a unique origin for the document, causing it to behave as if the allow-same-origin keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. - CVE-2017-7824 (arbitrary code execution) A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content in Thunderbird < 52.4. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. Impact ====== A remote attacker can bypass security measures like the phishing and malware protection or a content security policy, and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-23 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7793 https://bugzilla.mozilla.org/show_bug.cgi?id=1371889 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7805 https://bugzilla.mozilla.org/show_bug.cgi?id=1377618 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7810 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1386787%2C1389974%2C1371657… https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7814 https://bugzilla.mozilla.org/show_bug.cgi?id=1376036 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7818 https://bugzilla.mozilla.org/show_bug.cgi?id=1363723 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7819 https://bugzilla.mozilla.org/show_bug.cgi?id=1380292 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7823 https://bugzilla.mozilla.org/show_bug.cgi?id=1396320 https://www.mozilla.org/en-US/security/advisories/mfsa2017-23/#CVE-2017-7824 https://bugzilla.mozilla.org/show_bug.cgi?id=1398381 https://security.archlinux.org/CVE-2017-7793 https://security.archlinux.org/CVE-2017-7805 https://security.archlinux.org/CVE-2017-7810 https://security.archlinux.org/CVE-2017-7814 https://security.archlinux.org/CVE-2017-7818 https://security.archlinux.org/CVE-2017-7819 https://security.archlinux.org/CVE-2017-7823 https://security.archlinux.org/CVE-2017-7824

1 0

[arch-security] [ASA-201710-18] pcre2: denial of service
by Levente Polyak 13 Oct '17

13 Oct '17

Arch Linux Security Advisory ASA-201710-18 ========================================== Severity: Medium Date : 2017-10-12 CVE-ID : CVE-2017-7186 Package : pcre2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-223 Summary ======= The package pcre2 before version 10.30-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.30-1. # pacman -Syu "pcre2>=10.30-1" The problem has been fixed upstream in version 10.30. Workaround ========== None. Description =========== libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup. Impact ====== A remote attacker is able to crash the application by triggering an invalid Unicode property lookup. References ========== https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date https://bugs.exim.org/show_bug.cgi?id=2052 https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-matc… https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&so… https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=… https://security.archlinux.org/CVE-2017-7186

1 0