- Arch-security - lists.archlinux.org

[arch-security] [ASA-201709-18] libraw: multiple issues
by Levente Polyak 25 Sep '17

25 Sep '17

Arch Linux Security Advisory ASA-201709-18 ========================================== Severity: High Date : 2017-09-22 CVE-ID : CVE-2017-13735 CVE-2017-14265 Package : libraw Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-410 Summary ======= The package libraw before version 0.18.5-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.18.5-1. # pacman -Syu "libraw>=0.18.5-1" The problems have been fixed upstream in version 0.18.5. Workaround ========== None. Description =========== - CVE-2017-13735 (denial of service) There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2 leading to denial of service. - CVE-2017-14265 (arbitrary code execution) A stack-based buffer overflow was discovered in xtrans_interpolate in internal/dcraw_common.cpp in LibRaw before 0.18.3 leading to denial of service or arbitrary code execution. Impact ====== An attacker is able to crash the application or execute arbitrary code by tricking the user into opening or processing a specially crafted image file. References ========== https://github.com/LibRaw/LibRaw/issues/96 https://bugzilla.redhat.com/show_bug.cgi?id=1483988 https://github.com/LibRaw/LibRaw/issues/99 https://security.archlinux.org/CVE-2017-13735 https://security.archlinux.org/CVE-2017-14265

1 0

[arch-security] [ASA-201709-17] tomcat7: information disclosure
by Levente Polyak 21 Sep '17

21 Sep '17

Arch Linux Security Advisory ASA-201709-17 ========================================== Severity: Medium Date : 2017-09-19 CVE-ID : CVE-2017-12616 Package : tomcat7 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-408 Summary ======= The package tomcat7 before version 7.0.81-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.0.81-1. # pacman -Syu "tomcat7>=7.0.81-1" The problem has been fixed upstream in version 7.0.81. Workaround ========== None. Description =========== It has been discovered that tomcat version 7.0.80 and before are vulnerable to information disclosure. When using a VirtualDirContext it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. Impact ====== A remote attacker is able to view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request. References ========== http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81 https://mail-archives.apache.org/mod_mbox/tomcat-announce/201709.mbox/%3C0b… http://svn.apache.org/viewvc?view=revision&revision=1804729 https://security.archlinux.org/CVE-2017-12616

1 0

[arch-security] [ASA-201709-16] ettercap: multiple issues
by Jelle van der Waa 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-16 ========================================== Severity: High Date : 2017-09-18 CVE-ID : CVE-2017-6430 CVE-2017-8366 Package : ettercap Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-212 Summary ======= The package ettercap before version 0.8.2-5 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.8.2-5. # pacman -Syu "ettercap>=0.8.2-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-6430 (denial of service) The compile_tree function in ef_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows attackers to cause a denial of service (out-of-bounds read) via a crafted filter. - CVE-2017-8366 (arbitrary code execution) The strescape function in ec_strings.c in Ettercap 0.8.2 allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code via a crafted filter that is mishandled by etterfilter. Impact ====== An attacker is able to crash the application or execute arbitrary code by tricking the user to open a specially crafted filter. References ========== https://github.com/Ettercap/ettercap/issues/782 https://github.com/Ettercap/ettercap/commit/7f50c57b2101fe75592c8dc9960883b… https://github.com/Ettercap/ettercap/issues/792 https://github.com/Ettercap/ettercap/issues/789 https://github.com/Ettercap/ettercap/commit/1083d604930ebb9f350126b83802ecd… https://security.archlinux.org/CVE-2017-6430 https://security.archlinux.org/CVE-2017-8366

1 0

[arch-security] [ASA-201709-15] apache: information disclosure
by Levente Polyak 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-15 ========================================== Severity: High Date : 2017-09-18 CVE-ID : CVE-2017-9798 Package : apache Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-404 Summary ======= The package apache before version 2.4.27-2 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.4.27-2. # pacman -Syu "apache>=2.4.27-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== An use after free vulnerability has been discovered in Apache HTTP 2.4.27 that causes a corrupted Allow header to be constructed in response to HTTP OPTIONS requests. This can leak pieces of arbitrary memory from the server process that may contain secrets. The memory pieces change after multiple requests, so for a vulnerable host an arbitrary number of memory chunks can be leaked. The bug appears if a webmaster tries to use the "Limit" directive with an invalid HTTP method. Impact ====== A remote attacker is able to leak memory and potentially obtain sensitive information from the server process. References ========== https://bz.apache.org/bugzilla/show_bug.cgi?id=61207 https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1… http://www.openwall.com/lists/oss-security/2017/09/18/2 https://github.com/hannob/optionsbleed https://security.archlinux.org/CVE-2017-9798

1 0

[arch-security] [ASA-201709-14] lib32-libgcrypt: private key recovery
by Levente Polyak 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-14 ========================================== Severity: Medium Date : 2017-09-18 CVE-ID : CVE-2017-0379 Package : lib32-libgcrypt Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-403 Summary ======= The package lib32-libgcrypt before version 1.8.1-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1.8.1-1. # pacman -Syu "lib32-libgcrypt>=1.8.1-1" The problem has been fixed upstream in version 1.8.1. Workaround ========== None. Description =========== Libgcrypt before 1.8.1 does not properly consider Curve25519 side- channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c. On multi user systems or on boxes with virtual machines this attack may be used to steal private keys. Impact ====== On a multi user system or on boxes with virtual machines a local attacker may be able to perform a side-channel attack to steal private keys. References ========== https://lists.gnupg.org/pipermail/gnupg-announce/2017q3/000414.html https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=bf7… https://eprint.iacr.org/2017/806 https://security.archlinux.org/CVE-2017-0379

1 0

[arch-security] [ASA-201709-13] libgcrypt: private key recovery
by Levente Polyak 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-13 ========================================== Severity: Medium Date : 2017-09-18 CVE-ID : CVE-2017-0379 Package : libgcrypt Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-402 Summary ======= The package libgcrypt before version 1.8.1-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1.8.1-1. # pacman -Syu "libgcrypt>=1.8.1-1" The problem has been fixed upstream in version 1.8.1. Workaround ========== None. Description =========== Libgcrypt before 1.8.1 does not properly consider Curve25519 side- channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c. On multi user systems or on boxes with virtual machines this attack may be used to steal private keys. Impact ====== On a multi user system or on boxes with virtual machines a local attacker may be able to perform a side-channel attack to steal private keys. References ========== https://lists.gnupg.org/pipermail/gnupg-announce/2017q3/000414.html https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=bf7… https://eprint.iacr.org/2017/806 https://security.archlinux.org/CVE-2017-0379

1 0

[arch-security] [ASA-201709-12] linux-zen: arbitrary code execution
by Levente Polyak 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-12 ========================================== Severity: High Date : 2017-09-18 CVE-ID : CVE-2017-1000251 Package : linux-zen Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-394 Summary ======= The package linux-zen before version 4.13.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.13.2-1. # pacman -Syu "linux-zen>=4.13.2-1" The problem has been fixed upstream in version 4.13.2. Workaround ========== None. Description =========== A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although it is unlikely. On systems without the stack protection feature, an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. Impact ====== An unauthenticated attacker able to initiate a connection via Bluetooth is able to crash the system or possibly execute arbitrary code. References ========== https://bugs.archlinux.org/task/55601 https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 https://www.armis.com/blueborne/ https://security.archlinux.org/CVE-2017-1000251

1 0

[arch-security] [ASA-201709-11] newsbeuter: arbitrary command execution
by Levente Polyak 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-11 ========================================== Severity: High Date : 2017-09-16 CVE-ID : CVE-2017-12904 CVE-2017-14500 Package : newsbeuter Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-401 Summary ======= The package newsbeuter before version 2.9-8 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2.9-8. # pacman -Syu "newsbeuter>=2.9-8" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-12904 (arbitrary command execution) Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted shell command execution by crafting an RSS item that includes shell code in its title and/or URL. When the user bookmarks such item the shell code will be executed. - CVE-2017-14500 (arbitrary command execution) Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted shell command execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp. When the user plays the file in Podbeuter, the shell code will be executed. Impact ====== A remote attacker can execute arbitrary commands on the affected host by tricking a user into bookmarking a specially crafted RSS item or by playing a podcast file that includes shell metacharacters in its filename. References ========== https://github.com/akrennmair/newsbeuter/issues/591 https://github.com/akrennmair/newsbeuter/commit/3b84203448f077dff6f83ba986f… https://github.com/akrennmair/newsbeuter/commit/d1460189f6f810ca9a3687af7bc… https://groups.google.com/forum/#!topic/newsbeuter/iFqSE7Vz-DE https://github.com/akrennmair/newsbeuter/issues/598 https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798… https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c… https://security.archlinux.org/CVE-2017-12904 https://security.archlinux.org/CVE-2017-14500

1 0

[arch-security] [ASA-201709-10] ffmpeg: denial of service
by Levente Polyak 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-10 ========================================== Severity: Medium Date : 2017-09-15 CVE-ID : CVE-2017-14054 CVE-2017-14055 CVE-2017-14056 CVE-2017-14057 CVE-2017-14058 CVE-2017-14059 CVE-2017-14169 CVE-2017-14170 CVE-2017-14171 CVE-2017-14222 CVE-2017-14223 CVE-2017-14225 Package : ffmpeg Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-400 Summary ======= The package ffmpeg before version 1:3.3.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1:3.3.4-1. # pacman -Syu "ffmpeg>=1:3.3.4-1" The problems have been fixed upstream in version 3.3.4. Workaround ========== None. Description =========== - CVE-2017-14054 (denial of service) In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop. - CVE-2017-14055 (denial of service) In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14056 (denial of service) In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops. - CVE-2017-14057 (denial of service) In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops. - CVE-2017-14058 (denial of service) In FFmpeg 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop). - CVE-2017-14059 (denial of service) In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14169 (denial of service) In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value. - CVE-2017-14170 (denial of service) In libavformat/mxfdec.c in FFmpeg 3.3.3, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file. - CVE-2017-14171 (denial of service) In libavformat/nsvdec.c in FFmpeg 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop. - CVE-2017-14222 (denial of service) In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "item_count" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14223 (denial of service) In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14225 (denial of service) The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.) Impact ====== A remote attacker is able to crash the application while watching a HLS stream. Furthermore an attacker is able to crash the application by tricking the user into opening a specially crafted video file. References ========== https://github.com/FFmpeg/FFmpeg/commit/124eb202e70678539544f6268efc98131f1… https://github.com/FFmpeg/FFmpeg/commit/4f05e2e2dc1a89f38cd9f0960a6561083d7… https://github.com/FFmpeg/FFmpeg/commit/96f24d1bee7fe7bac08e2b7c74db1a046c9… https://github.com/FFmpeg/FFmpeg/commit/7f9ec5593e04827249e7aeb466da06a98a0… https://github.com/FFmpeg/FFmpeg/commit/7ec414892ddcad88313848494b6fc5f437c… https://github.com/FFmpeg/FFmpeg/commit/7e80b63ecd259d69d383623e75b318bf2bd… https://github.com/FFmpeg/FFmpeg/commit/9d00fb9d70ee8c0cc7002b89318c5be00f1… https://github.com/FFmpeg/FFmpeg/commit/900f39692ca0337a98a7cf047e4e2611071… https://github.com/FFmpeg/FFmpeg/commit/c24bcb553650b91e9eff15ef6e54ca73de2… https://github.com/FFmpeg/FFmpeg/commit/9cb4eb772839c5e1de2855d126bf74ff16d… https://github.com/FFmpeg/FFmpeg/commit/afc9c683ed9db01edb357bc8c19edad4282… https://github.com/FFmpeg/FFmpeg/commit/837cb4325b712ff1aab531bf41668933f61… https://security.archlinux.org/CVE-2017-14054 https://security.archlinux.org/CVE-2017-14055 https://security.archlinux.org/CVE-2017-14056 https://security.archlinux.org/CVE-2017-14057 https://security.archlinux.org/CVE-2017-14058 https://security.archlinux.org/CVE-2017-14059 https://security.archlinux.org/CVE-2017-14169 https://security.archlinux.org/CVE-2017-14170 https://security.archlinux.org/CVE-2017-14171 https://security.archlinux.org/CVE-2017-14222 https://security.archlinux.org/CVE-2017-14223 https://security.archlinux.org/CVE-2017-14225

1 0

[arch-security] [ASA-201709-9] linux: arbitrary code execution
by Levente Polyak 15 Sep '17

15 Sep '17

Arch Linux Security Advisory ASA-201709-9 ========================================= Severity: High Date : 2017-09-15 CVE-ID : CVE-2017-1000251 Package : linux Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-392 Summary ======= The package linux before version 4.12.13-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.12.13-1. # pacman -Syu "linux>=4.12.13-1" The problem has been fixed upstream in version 4.12.13. Workaround ========== None. Description =========== A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although it is unlikely. On systems without the stack protection feature, an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. Impact ====== An unauthenticated attacker able to initiate a connection via Bluetooth is able to crash the system or possibly execute arbitrary code. References ========== https://bugs.archlinux.org/task/55601 https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 https://www.armis.com/blueborne/ https://security.archlinux.org/CVE-2017-1000251

1 0