- Arch-security - lists.archlinux.org

[arch-security] [ASA-201709-8] linux-lts: arbitrary code execution
by Levente Polyak 14 Sep '17

14 Sep '17

Arch Linux Security Advisory ASA-201709-8 ========================================= Severity: High Date : 2017-09-14 CVE-ID : CVE-2017-1000251 Package : linux-lts Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-393 Summary ======= The package linux-lts before version 4.9.49-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.9.49-2. # pacman -Syu "linux-lts>=4.9.49-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although it is unlikely. On systems without the stack protection feature, an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. Impact ====== An unauthenticated attacker able to initiate a connection via Bluetooth is able to crash the system or possibly execute arbitrary code. References ========== https://bugs.archlinux.org/task/55601 https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 https://www.armis.com/blueborne/ https://security.archlinux.org/CVE-2017-1000251

1 0

[arch-security] [ASA-201709-7] lib32-flashplugin: arbitrary code execution
by Levente Polyak 14 Sep '17

14 Sep '17

Arch Linux Security Advisory ASA-201709-7 ========================================= Severity: Critical Date : 2017-09-13 CVE-ID : CVE-2017-11281 CVE-2017-11282 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-399 Summary ======= The package lib32-flashplugin before version 27.0.0.130-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 27.0.0.130-1. # pacman -Syu "lib32-flashplugin>=27.0.0.130-1" The problems have been fixed upstream in version 27.0.0.130. Workaround ========== None. Description =========== - CVE-2017-11281 (arbitrary code execution) A memory corruption issue has been found in Adobe Flash player version 26.0.0.151 and earlier, leading to remote code execution. - CVE-2017-11282 (arbitrary code execution) A memory corruption issue has been found in Adobe Flash player version 26.0.0.151 and earlier, leading to remote code execution. Impact ====== A remote attacker is able to execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-28.html https://security.archlinux.org/CVE-2017-11281 https://security.archlinux.org/CVE-2017-11282

1 0

[arch-security] [ASA-201709-6] flashplugin: arbitrary code execution
by Levente Polyak 14 Sep '17

14 Sep '17

Arch Linux Security Advisory ASA-201709-6 ========================================= Severity: Critical Date : 2017-09-13 CVE-ID : CVE-2017-11281 CVE-2017-11282 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-398 Summary ======= The package flashplugin before version 27.0.0.130-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 27.0.0.130-1. # pacman -Syu "flashplugin>=27.0.0.130-1" The problems have been fixed upstream in version 27.0.0.130. Workaround ========== None. Description =========== - CVE-2017-11281 (arbitrary code execution) A memory corruption issue has been found in Adobe Flash player version 26.0.0.151 and earlier, leading to remote code execution. - CVE-2017-11282 (arbitrary code execution) A memory corruption issue has been found in Adobe Flash player version 26.0.0.151 and earlier, leading to remote code execution. Impact ====== A remote attacker is able to execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-28.html https://security.archlinux.org/CVE-2017-11281 https://security.archlinux.org/CVE-2017-11282

1 0

[arch-security] [ASA-201709-5] tcpdump: multiple issues
by Levente Polyak 13 Sep '17

13 Sep '17

Arch Linux Security Advisory ASA-201709-5 ========================================= Severity: Critical Date : 2017-09-13 CVE-ID : CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 CVE-2017-12893 CVE-2017-12894 CVE-2017-12895 CVE-2017-12896 CVE-2017-12897 CVE-2017-12898 CVE-2017-12899 CVE-2017-12900 CVE-2017-12901 CVE-2017-12902 CVE-2017-12985 CVE-2017-12986 CVE-2017-12987 CVE-2017-12988 CVE-2017-12989 CVE-2017-12990 CVE-2017-12991 CVE-2017-12992 CVE-2017-12993 CVE-2017-12994 CVE-2017-12995 CVE-2017-12996 CVE-2017-12997 CVE-2017-12998 CVE-2017-12999 CVE-2017-13000 CVE-2017-13001 CVE-2017-13002 CVE-2017-13003 CVE-2017-13004 CVE-2017-13005 CVE-2017-13006 CVE-2017-13007 CVE-2017-13008 CVE-2017-13009 CVE-2017-13010 CVE-2017-13011 CVE-2017-13012 CVE-2017-13013 CVE-2017-13014 CVE-2017-13015 CVE-2017-13016 CVE-2017-13017 CVE-2017-13018 CVE-2017-13019 CVE-2017-13020 CVE-2017-13021 CVE-2017-13022 CVE-2017-13023 CVE-2017-13024 CVE-2017-13025 CVE-2017-13026 CVE-2017-13027 CVE-2017-13028 CVE-2017-13029 CVE-2017-13030 CVE-2017-13031 CVE-2017-13032 CVE-2017-13033 CVE-2017-13034 CVE-2017-13035 CVE-2017-13036 CVE-2017-13037 CVE-2017-13038 CVE-2017-13039 CVE-2017-13040 CVE-2017-13041 CVE-2017-13042 CVE-2017-13043 CVE-2017-13044 CVE-2017-13045 CVE-2017-13046 CVE-2017-13047 CVE-2017-13048 CVE-2017-13049 CVE-2017-13050 CVE-2017-13051 CVE-2017-13052 CVE-2017-13053 CVE-2017-13054 CVE-2017-13055 CVE-2017-13687 CVE-2017-13688 CVE-2017-13689 CVE-2017-13690 CVE-2017-13725 Package : tcpdump Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-361 Summary ======= The package tcpdump before version 4.9.2-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 4.9.2-1. # pacman -Syu "tcpdump>=4.9.2-1" The problems have been fixed upstream in version 4.9.2. Workaround ========== None. Description =========== - CVE-2017-11541 (denial of service) A heap-based out-of-bounds read vulnerability was discovered in tcpdump <= 4.9.1, in the lldp_print function in print-lldp.c, related to util- print.c. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash when attempting to print a summary of the packet data. - CVE-2017-11542 (denial of service) A heap-based out-of-bounds read vulnerability was discovered in tcpdump <= 4.9.1, in the pimv1_print function in print-pim.c. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash when attempting to print a summary of the packet data. - CVE-2017-11543 (arbitrary code execution) An out-of-bounds write vulnerability was discovered in tcpdump's handling of LINKTYPE_SLIP in the sliplink_print function in print-sl.c. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash or possibly execute arbitrary code when attempting to print a summary of the packet data. - CVE-2017-12893 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of SMB/CIFS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12894 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's parsers when calling lookup_bytestring in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12895 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ICMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12896 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISAKMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12897 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO CLNS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12898 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of NFS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12899 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of DECnet in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12900 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's parsers when calling tok2strbuf in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12901 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of EIGRP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12902 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Zephyr in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12985 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12986 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 routing headers in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12987 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IEEE 802.11 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12988 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of telnet in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12989 (denial of service) An infinite loop vulnerability was discovered in tcpdump's handling of RESP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to enter an infinite loop while processing the packet data leading to denial of service. - CVE-2017-12990 (denial of service) An infinite loop vulnerability was discovered in tcpdump's handling of ISAKMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to enter an infinite loop while processing the packet data leading to denial of service. - CVE-2017-12991 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12992 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RIPng in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12993 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Juniper in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12994 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12995 (denial of service) An infinite loop vulnerability was discovered in tcpdump's handling of DNS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to enter an infinite loop while processing the packet data leading to denial of service. - CVE-2017-12996 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PIMv2 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12997 (denial of service) An infinite loop vulnerability was discovered in tcpdump's handling of LLDP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to enter an infinite loop while processing the packet data leading to denial of service. - CVE-2017-12998 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12999 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13000 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IEEE 802.15.4 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13001 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of NFS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13002 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of AODV in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13003 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of LMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13004 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Juniper in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13005 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of NFS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13006 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of L2TP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13007 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Apple PKTAP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13008 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IEEE 802.11 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13009 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 mobility in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13010 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BEEP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13011 (arbitrary code execution) An out-of-bounds write vulnerability was discovered in tcpdump's parsers when calling bittok2str_internal. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash or possibly execute arbitrary code while processing the packet data. - CVE-2017-13012 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ICMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13013 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ARP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13014 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of White Board in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13015 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of EAP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13016 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO ES-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13017 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of DHCPv6 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13018 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PGM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13019 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PGM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13020 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of VTP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13021 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ICMPv6 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13022 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13023 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 mobility in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13024 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 mobility in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13025 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 mobility in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13026 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13027 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of LLDP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13028 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BOOTP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13029 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PPP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13030 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PIM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13031 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 fragmentation header in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13032 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RADIUS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13033 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of VTP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13034 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PGM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13035 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13036 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of OSPFv3 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13037 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13038 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PPP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13039 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISAKMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13040 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of MPTCP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13041 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ICMPv6 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13042 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of HNCP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13043 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13044 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of HNCP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13045 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of VQP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13046 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13047 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO ES-IP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13048 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RSVP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13049 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Rx in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13050 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RPKI-Router in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13051 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RSVP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13052 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of CFM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13053 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13054 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of LLDP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13055 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13687 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Cisco HDLC in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13688 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of OLSR in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13689 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IKEv1 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13690 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IKEv2 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13725 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 routing headers in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. Impact ====== A remote attacker is able to crash the application or execute arbitrary code by tricking the user to open a specially crafted pcap file or by sending specially crafted packets to the network. References ========== http://www.tcpdump.org/tcpdump-changes.txt https://github.com/hackerlib/hackerlib-vul/tree/master/tcpdump-vul/heap-buf… https://github.com/the-tcpdump-group/tcpdump/commit/21d702a136c5c16882e368a… https://github.com/hackerlib/hackerlib-vul/tree/master/tcpdump-vul/heap-buf… https://github.com/the-tcpdump-group/tcpdump/commit/bed48062a64fca524156d76… https://github.com/the-tcpdump-group/tcpdump/commit/7039327875525278d17edee… https://github.com/hackerlib/hackerlib-vul/tree/master/tcpdump-vul/global-o… https://github.com/the-tcpdump-group/tcpdump/commit/6f5ba2b651cd9d4b7fa8ee5… https://github.com/the-tcpdump-group/tcpdump/commit/730fc35968c5433b9e2a829… https://github.com/the-tcpdump-group/tcpdump/commit/2b62d1dda41590db29368ec… https://github.com/the-tcpdump-group/tcpdump/commit/4e430c6b0d8b7e77c7abca7… https://github.com/the-tcpdump-group/tcpdump/commit/f76e7feb41a4327d2b09784… https://github.com/the-tcpdump-group/tcpdump/commit/1dcd10aceabbc03bf571ea3… https://github.com/the-tcpdump-group/tcpdump/commit/19d25dd8781620cd41bf178… https://github.com/the-tcpdump-group/tcpdump/commit/f96003b21e2abfbba59b926… https://github.com/the-tcpdump-group/tcpdump/commit/c6e0531b5def26ecf912e8d… https://github.com/the-tcpdump-group/tcpdump/commit/0318fa8b61bd6c837641129… https://github.com/the-tcpdump-group/tcpdump/commit/de981e6070d168b58ec1bb0… https://github.com/the-tcpdump-group/tcpdump/commit/6ec0c6fa63412c7a07a5bcb… https://github.com/the-tcpdump-group/tcpdump/commit/d17507ffa3e9742199b02a6… https://github.com/the-tcpdump-group/tcpdump/commit/66df248b49095c261138b5a… https://github.com/the-tcpdump-group/tcpdump/commit/7ac73d6cd41e9d4ac0ca7e6… https://github.com/the-tcpdump-group/tcpdump/commit/2ecb9d2c67d9119250c5481… https://github.com/the-tcpdump-group/tcpdump/commit/99798bd9a41bd3d03fdc1e9… https://github.com/the-tcpdump-group/tcpdump/commit/8934a7d6307267d301182f1… https://github.com/the-tcpdump-group/tcpdump/commit/db24063b01cba8e9d4d88b7… https://github.com/the-tcpdump-group/tcpdump/commit/c2ef693866beae071a24b45… https://github.com/the-tcpdump-group/tcpdump/commit/50a44b6b8e4f7c127440dbd… https://github.com/the-tcpdump-group/tcpdump/commit/e942fb84fbe3a73a98a00d2… https://github.com/the-tcpdump-group/tcpdump/commit/b534e304568585707c4a924… https://github.com/the-tcpdump-group/tcpdump/commit/ffde45acf3348f8353fb406… https://github.com/the-tcpdump-group/tcpdump/commit/3a76fd7c95fced2c2f8c814… https://github.com/the-tcpdump-group/tcpdump/commit/6fca58f5f9c96749a575f52… https://github.com/the-tcpdump-group/tcpdump/commit/34cec721d39c76be1e0a600… https://github.com/the-tcpdump-group/tcpdump/commit/979dcefd7b259e9e233f77f… https://github.com/the-tcpdump-group/tcpdump/commit/3b32029db354cbc87512786… https://github.com/the-tcpdump-group/tcpdump/commit/8512734883227c11568bb35… https://github.com/the-tcpdump-group/tcpdump/commit/a7e5f58f402e6919ec444a5… https://github.com/the-tcpdump-group/tcpdump/commit/9be4e0b5938b705e7e36cfc… https://github.com/the-tcpdump-group/tcpdump/commit/7a923447fd49a069a0fd3b6… https://github.com/the-tcpdump-group/tcpdump/commit/cbddb98484ea8ec1deece35… https://github.com/the-tcpdump-group/tcpdump/commit/a25211918f2e790c67d859d… https://github.com/the-tcpdump-group/tcpdump/commit/35d146b7a66496d72cdeb95… https://github.com/the-tcpdump-group/tcpdump/commit/42073d54c53a496be40ae84… https://github.com/the-tcpdump-group/tcpdump/commit/b45a9a167ca6a3ef2752ae9… https://github.com/the-tcpdump-group/tcpdump/commit/cc4a7391c616be7a64ed657… https://github.com/the-tcpdump-group/tcpdump/commit/ca336198e8bebccc18502de… https://github.com/the-tcpdump-group/tcpdump/commit/5edf405d7ed9fc92f4f43e8… https://github.com/the-tcpdump-group/tcpdump/commit/db8c799f6dfc68765c9451f… https://github.com/the-tcpdump-group/tcpdump/commit/877b66b398518d9501513e0… https://github.com/the-tcpdump-group/tcpdump/commit/9f0730bee3eb65d07b49fd4… https://github.com/the-tcpdump-group/tcpdump/commit/8509ef02eceb2bbb479cea1… https://github.com/the-tcpdump-group/tcpdump/commit/13ab8d18617d616c7d34353… https://github.com/the-tcpdump-group/tcpdump/commit/cc356512f512e7fa423b367… https://github.com/the-tcpdump-group/tcpdump/commit/985122081165753c7442bd7… https://github.com/the-tcpdump-group/tcpdump/commit/c177cb3800a9a68d79b2812… https://github.com/the-tcpdump-group/tcpdump/commit/11b426ee05eb62ed1032185… https://github.com/the-tcpdump-group/tcpdump/commit/26a6799b9ca80508c05cac7… https://github.com/the-tcpdump-group/tcpdump/commit/4601c685e7fd19c3724d5e4… https://github.com/the-tcpdump-group/tcpdump/commit/d692d67332bcc90540088ad… https://github.com/the-tcpdump-group/tcpdump/commit/c5dd7bef5e54da5996dc471… https://github.com/the-tcpdump-group/tcpdump/commit/67c7126062d59729cd421bb… https://github.com/the-tcpdump-group/tcpdump/commit/eee0b04bcfdae319c242b0b… https://github.com/the-tcpdump-group/tcpdump/commit/b8e559afaeb8fe0604a1f8e… https://github.com/the-tcpdump-group/tcpdump/commit/2e1f6d9320afa83abc1ff71… https://github.com/the-tcpdump-group/tcpdump/commit/7d3aba9f06899d0128ef46e… https://github.com/the-tcpdump-group/tcpdump/commit/5338aac7b8b880b0c5e0c15… https://github.com/the-tcpdump-group/tcpdump/commit/b20e1639dbac84b3fcb3938… https://github.com/the-tcpdump-group/tcpdump/commit/a77ff09c46560bc895dea11… https://github.com/the-tcpdump-group/tcpdump/commit/66e22961b30547e9a8daa1f… https://github.com/the-tcpdump-group/tcpdump/commit/29e5470e6ab84badbc31f45… https://github.com/the-tcpdump-group/tcpdump/commit/7029d15f148ef24bb7c6668… https://github.com/the-tcpdump-group/tcpdump/commit/5dc1860d8267b1e0cb78c9f… https://github.com/the-tcpdump-group/tcpdump/commit/2d669862df7cd17f5391290… https://github.com/the-tcpdump-group/tcpdump/commit/1bc78d795cd5cad55254986… https://github.com/the-tcpdump-group/tcpdump/commit/ae83295915d08a854de27a8… https://github.com/the-tcpdump-group/tcpdump/commit/da6f1a677bfa4476abaeaf9… https://github.com/the-tcpdump-group/tcpdump/commit/571a6f33f47e7a2394fa08f… https://github.com/the-tcpdump-group/tcpdump/commit/88b2dac837e81cf56dce05e… https://github.com/the-tcpdump-group/tcpdump/commit/2c2cfbd2b771ac888bc5c4a… https://github.com/the-tcpdump-group/tcpdump/commit/7335163a6ef82d46ff18f3e… https://github.com/the-tcpdump-group/tcpdump/commit/e0a5a02b0fc1900a69d6c37… https://github.com/the-tcpdump-group/tcpdump/commit/4c3aee4bb0294c232d56b6d… https://github.com/the-tcpdump-group/tcpdump/commit/f4b9e24c7384d882a7f434c… https://github.com/the-tcpdump-group/tcpdump/commit/39582c04cc5e34054b2936b… https://github.com/the-tcpdump-group/tcpdump/commit/d515b4b4a300479cdf1a6e0… https://github.com/the-tcpdump-group/tcpdump/commit/c2f6833dddecf2d5fb89c9c… https://github.com/the-tcpdump-group/tcpdump/commit/3b36ec4e713dea9266db119… https://github.com/the-tcpdump-group/tcpdump/commit/d10a0f980fe8f9407ab1ffb… https://github.com/the-tcpdump-group/tcpdump/commit/331530a4076c69bbd2e3214… https://github.com/the-tcpdump-group/tcpdump/commit/3c8a2b0e91d8d8947e89384… https://github.com/the-tcpdump-group/tcpdump/commit/aa0858100096a3490edf930… https://github.com/the-tcpdump-group/tcpdump/commit/83c64fce3a5226b080e535f… https://github.com/the-tcpdump-group/tcpdump/commit/289c672020280529fd382f3… https://github.com/the-tcpdump-group/tcpdump/commit/5d340a5ca6e420a70297cdb… https://github.com/the-tcpdump-group/tcpdump/commit/bd4e697ebd6c8457efa8f28… https://github.com/the-tcpdump-group/tcpdump/commit/e6511cc1a950fe1566b2236… https://github.com/the-tcpdump-group/tcpdump/commit/5d0d76e88ee2d3236d7e032… https://github.com/the-tcpdump-group/tcpdump/commit/866c60236c41cea1e1654c8… https://github.com/the-tcpdump-group/tcpdump/commit/a1eefe986065846b6c69dbc… https://github.com/the-tcpdump-group/tcpdump/commit/0cb1b8a434b599b8d636db0… https://github.com/the-tcpdump-group/tcpdump/commit/061e7371a944588f231cb1b… https://github.com/the-tcpdump-group/tcpdump/commit/8dca25d26c7ca2caf613826… https://github.com/the-tcpdump-group/tcpdump/commit/c7c515ee03c285cc5137632… https://github.com/the-tcpdump-group/tcpdump/commit/3c4d7c0ee30a30e5abff3d6… https://security.archlinux.org/CVE-2017-11541 https://security.archlinux.org/CVE-2017-11542 https://security.archlinux.org/CVE-2017-11543 https://security.archlinux.org/CVE-2017-12893 https://security.archlinux.org/CVE-2017-12894 https://security.archlinux.org/CVE-2017-12895 https://security.archlinux.org/CVE-2017-12896 https://security.archlinux.org/CVE-2017-12897 https://security.archlinux.org/CVE-2017-12898 https://security.archlinux.org/CVE-2017-12899 https://security.archlinux.org/CVE-2017-12900 https://security.archlinux.org/CVE-2017-12901 https://security.archlinux.org/CVE-2017-12902 https://security.archlinux.org/CVE-2017-12985 https://security.archlinux.org/CVE-2017-12986 https://security.archlinux.org/CVE-2017-12987 https://security.archlinux.org/CVE-2017-12988 https://security.archlinux.org/CVE-2017-12989 https://security.archlinux.org/CVE-2017-12990 https://security.archlinux.org/CVE-2017-12991 https://security.archlinux.org/CVE-2017-12992 https://security.archlinux.org/CVE-2017-12993 https://security.archlinux.org/CVE-2017-12994 https://security.archlinux.org/CVE-2017-12995 https://security.archlinux.org/CVE-2017-12996 https://security.archlinux.org/CVE-2017-12997 https://security.archlinux.org/CVE-2017-12998 https://security.archlinux.org/CVE-2017-12999 https://security.archlinux.org/CVE-2017-13000 https://security.archlinux.org/CVE-2017-13001 https://security.archlinux.org/CVE-2017-13002 https://security.archlinux.org/CVE-2017-13003 https://security.archlinux.org/CVE-2017-13004 https://security.archlinux.org/CVE-2017-13005 https://security.archlinux.org/CVE-2017-13006 https://security.archlinux.org/CVE-2017-13007 https://security.archlinux.org/CVE-2017-13008 https://security.archlinux.org/CVE-2017-13009 https://security.archlinux.org/CVE-2017-13010 https://security.archlinux.org/CVE-2017-13011 https://security.archlinux.org/CVE-2017-13012 https://security.archlinux.org/CVE-2017-13013 https://security.archlinux.org/CVE-2017-13014 https://security.archlinux.org/CVE-2017-13015 https://security.archlinux.org/CVE-2017-13016 https://security.archlinux.org/CVE-2017-13017 https://security.archlinux.org/CVE-2017-13018 https://security.archlinux.org/CVE-2017-13019 https://security.archlinux.org/CVE-2017-13020 https://security.archlinux.org/CVE-2017-13021 https://security.archlinux.org/CVE-2017-13022 https://security.archlinux.org/CVE-2017-13023 https://security.archlinux.org/CVE-2017-13024 https://security.archlinux.org/CVE-2017-13025 https://security.archlinux.org/CVE-2017-13026 https://security.archlinux.org/CVE-2017-13027 https://security.archlinux.org/CVE-2017-13028 https://security.archlinux.org/CVE-2017-13029 https://security.archlinux.org/CVE-2017-13030 https://security.archlinux.org/CVE-2017-13031 https://security.archlinux.org/CVE-2017-13032 https://security.archlinux.org/CVE-2017-13033 https://security.archlinux.org/CVE-2017-13034 https://security.archlinux.org/CVE-2017-13035 https://security.archlinux.org/CVE-2017-13036 https://security.archlinux.org/CVE-2017-13037 https://security.archlinux.org/CVE-2017-13038 https://security.archlinux.org/CVE-2017-13039 https://security.archlinux.org/CVE-2017-13040 https://security.archlinux.org/CVE-2017-13041 https://security.archlinux.org/CVE-2017-13042 https://security.archlinux.org/CVE-2017-13043 https://security.archlinux.org/CVE-2017-13044 https://security.archlinux.org/CVE-2017-13045 https://security.archlinux.org/CVE-2017-13046 https://security.archlinux.org/CVE-2017-13047 https://security.archlinux.org/CVE-2017-13048 https://security.archlinux.org/CVE-2017-13049 https://security.archlinux.org/CVE-2017-13050 https://security.archlinux.org/CVE-2017-13051 https://security.archlinux.org/CVE-2017-13052 https://security.archlinux.org/CVE-2017-13053 https://security.archlinux.org/CVE-2017-13054 https://security.archlinux.org/CVE-2017-13055 https://security.archlinux.org/CVE-2017-13687 https://security.archlinux.org/CVE-2017-13688 https://security.archlinux.org/CVE-2017-13689 https://security.archlinux.org/CVE-2017-13690 https://security.archlinux.org/CVE-2017-13725

1 0

[arch-security] [ASA-201709-4] linux-hardened: arbitrary code execution
by Levente Polyak 13 Sep '17

13 Sep '17

Arch Linux Security Advisory ASA-201709-4 ========================================= Severity: High Date : 2017-09-13 CVE-ID : CVE-2017-1000251 Package : linux-hardened Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-395 Summary ======= The package linux-hardened before version 4.13.1.b-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.13.1.b-1. # pacman -Syu "linux-hardened>=4.13.1.b-1" The problem has been fixed upstream in version 4.13.1.b. Workaround ========== None. Description =========== A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although it is unlikely. On systems without the stack protection feature, an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. Impact ====== An unauthenticated attacker able to initiate a connection via Bluetooth is able to crash the system or possibly execute arbitrary code. References ========== https://bugs.archlinux.org/task/55602 https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 https://www.armis.com/blueborne/ https://security.archlinux.org/CVE-2017-1000251

1 0

[arch-security] [ASA-201709-3] bluez: information disclosure
by Levente Polyak 12 Sep '17

12 Sep '17

Arch Linux Security Advisory ASA-201709-3 ========================================= Severity: High Date : 2017-09-12 CVE-ID : CVE-2017-1000250 Package : bluez Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-396 Summary ======= The package bluez before version 5.46-2 is vulnerable to information disclosure. Resolution ========== Upgrade to 5.46-2. # pacman -Syu "bluez>=5.46-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== An information-disclosure flaw was found in the bluetoothd implementation of the Service Discovery Protocol (SDP). A specially crafted Bluetooth device could, without prior pairing or user interaction, retrieve portions of the bluetoothd process memory, including potentially sensitive information such as Bluetooth encryption keys. Impact ====== A remote attacker is able to use a specially crafted Bluetooth device to obtain sensitive information such as Bluetooth encryption keys. References ========== https://bugs.archlinux.org/task/55603 https://www.armis.com/blueborne/ http://pkgs.fedoraproject.org/cgit/rpms/bluez.git/plain/0010-Out-of-bounds-… https://security.archlinux.org/CVE-2017-1000250

1 0

[arch-security] [ASA-201709-2] postgresql: multiple issues
by Levente Polyak 06 Sep '17

06 Sep '17

Arch Linux Security Advisory ASA-201709-2 ========================================= Severity: High Date : 2017-09-06 CVE-ID : CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 Package : postgresql Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-381 Summary ======= The package postgresql before version 9.6.4-1 is vulnerable to multiple issues including information disclosure, access restriction bypass and authentication bypass. Resolution ========== Upgrade to 9.6.4-1. # pacman -Syu "postgresql>=9.6.4-1" The problems have been fixed upstream in version 9.6.4. Workaround ========== None. Description =========== - CVE-2017-7546 (authentication bypass) It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. - CVE-2017-7547 (information disclosure) An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on foreign servers. A remote authenticated attacker could potentially use this flaw to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. - CVE-2017-7548 (access restriction bypass) An authorization flaw was found in the way PostgreSQL handled large objects. A remote authenticated attacker with no privileges on a large object could potentially use this flaw to overwrite the entire content of the object, thus resulting in denial of service. Impact ====== A remote unauthenticated attacker is be able to gain access to database accounts with empty passwords. Additionally a remote authenticated user may be able to perform a denial of service attack or retrieve passwords from the user mappings. References ========== https://www.postgresql.org/about/news/1772/ https://github.com/postgres/postgres/commit/d5d46d99ba47f https://github.com/postgres/postgres/commit/b6e39ca92eeee4 https://github.com/postgres/postgres/commit/f1cda6d6cbb2 https://security.archlinux.org/CVE-2017-7546 https://security.archlinux.org/CVE-2017-7547 https://security.archlinux.org/CVE-2017-7548

1 0

[arch-security] [ASA-201709-1] chromium: multiple issues
by Remi Gacogne 06 Sep '17

06 Sep '17

Arch Linux Security Advisory ASA-201709-1 ========================================= Severity: Critical Date : 2017-09-06 CVE-ID : CVE-2017-5111 CVE-2017-5112 CVE-2017-5113 CVE-2017-5114 CVE-2017-5115 CVE-2017-5116 CVE-2017-5117 CVE-2017-5118 CVE-2017-5119 CVE-2017-5120 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-391 Summary ======= The package chromium before version 61.0.3163.79-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure and silent downgrade. Resolution ========== Upgrade to 61.0.3163.79-1. # pacman -Syu "chromium>=61.0.3163.79-1" The problems have been fixed upstream in version 61.0.3163.79. Workaround ========== None. Description =========== - CVE-2017-5111 (arbitrary code execution) A use-after-free vulnerability has been found in the PDFium component of the Chromium browser < 61.0.3163.79. - CVE-2017-5112 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the WebGL component of the Chromium browser < 61.0.3163.79. - CVE-2017-5113 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the Skia component of the Chromium browser < 61.0.3163.79. - CVE-2017-5114 (arbitrary code execution) A memory lifecycle vulnerability has been found in the PDFium component of the Chromium browser < 61.0.3163.79. - CVE-2017-5115 (arbitrary code execution) A type confusion vulnerability has been found in the V8 component of the Chromium browser < 61.0.3163.79. - CVE-2017-5116 (arbitrary code execution) A type confusion vulnerability has been found in the V8 component of the Chromium browser < 61.0.3163.79. - CVE-2017-5117 (information disclosure) A use of initialized value issue has been found in the Skia component of the Chromium browser < 61.0.3163.79. - CVE-2017-5118 (access restriction bypass) A content security policy bypass vulnerability has been found in the Blink component of the Chromium browser < 61.0.3163.79. - CVE-2017-5119 (information disclosure) A use of initialized value issue has been found in the Skia component of the Chromium browser < 61.0.3163.79. - CVE-2017-5120 (silent downgrade) A potential issue leading to HTTPS downgrade during redirect navigation has been found in the Chromium browser < 61.0.3163.79. Impact ====== A remote attacker can access sensitive information, bypass the content security policy, force a downgrade from HTTPS to HTTP and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=737023 https://bugs.chromium.org/p/chromium/issues/detail?id=740603 https://bugs.chromium.org/p/chromium/issues/detail?id=747043 https://bugs.chromium.org/p/chromium/issues/detail?id=752829 https://bugs.chromium.org/p/chromium/issues/detail?id=744584 https://bugs.chromium.org/p/chromium/issues/detail?id=759624 https://bugs.chromium.org/p/chromium/issues/detail?id=739190 https://bugs.chromium.org/p/chromium/issues/detail?id=747847 https://bugs.chromium.org/p/chromium/issues/detail?id=725127 https://bugs.chromium.org/p/chromium/issues/detail?id=718676 https://security.archlinux.org/CVE-2017-5111 https://security.archlinux.org/CVE-2017-5112 https://security.archlinux.org/CVE-2017-5113 https://security.archlinux.org/CVE-2017-5114 https://security.archlinux.org/CVE-2017-5115 https://security.archlinux.org/CVE-2017-5116 https://security.archlinux.org/CVE-2017-5117 https://security.archlinux.org/CVE-2017-5118 https://security.archlinux.org/CVE-2017-5119 https://security.archlinux.org/CVE-2017-5120

1 0

[arch-security] [ASA-201708-18] thunderbird: multiple issues
by Levente Polyak 23 Aug '17

23 Aug '17

Arch Linux Security Advisory ASA-201708-18 ========================================== Severity: Critical Date : 2017-08-23 CVE-ID : CVE-2017-7753 CVE-2017-7779 CVE-2017-7784 CVE-2017-7785 CVE-2017-7786 CVE-2017-7787 CVE-2017-7791 CVE-2017-7792 CVE-2017-7800 CVE-2017-7801 CVE-2017-7802 CVE-2017-7803 CVE-2017-7807 CVE-2017-7809 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-385 Summary ======= The package thunderbird before version 52.3.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, information disclosure, same-origin policy bypass and access restriction bypass. Resolution ========== Upgrade to 52.3.0-1. # pacman -Syu "thunderbird>=52.3.0-1" The problems have been fixed upstream in version 52.3.0. Workaround ========== None. Description =========== - CVE-2017-7753 (information disclosure) An out-of-bounds read has been found in firefox < 55.0 and thunderbird < 52.3, when applying style rules to pseudo-elements, such as ::first- line, using cached style data. - CVE-2017-7779 (arbitrary code execution) Several memory safety bugs have been found in firefox < 55.0 and thunderbird < 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2017-7784 (arbitrary code execution) A use-after-free issue has been found in firefox < 55.0 and thunderbird < 52.3, when reading an image observer during frame reconstruction after the observer has been freed. This results in a potentially exploitable crash. - CVE-2017-7785 (arbitrary code execution) A buffer overflow has been found in firefox < 55.0 and thunderbird < 52.3, when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. This results in a potentially exploitable crash. - CVE-2017-7786 (arbitrary code execution) A buffer overflow has been found in firefox < 55.0 and thunderbird < 52.3, when the image renderer attempts to paint non-displayable SVG elements. This results in a potentially exploitable crash. - CVE-2017-7787 (same-origin policy bypass) Same-origin policy protections can be bypassed in firefox < 55.0 and thunderbird < 52.3, on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page and leading to information disclosure. - CVE-2017-7791 (content spoofing) A content spoofing issue has been found in firefox < 55.0 and thunderbird < 52.3. On pages containing an iframe, the data: protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content. - CVE-2017-7792 (arbitrary code execution) A buffer overflow has been found in firefox < 55.0 and thunderbird < 52.3, when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID). This results in a potentially exploitable crash. - CVE-2017-7800 (arbitrary code execution) A use-after-free issue has been found in firefox < 55.0 and thunderbird < 52.3, in WebSockets, when the object holding the connection is freed before the disconnection operation is finished. This results in an exploitable crash. - CVE-2017-7801 (arbitrary code execution) A use-after-free issue has been found in firefox < 55.0 and thunderbird < 52.3, while re-computing layout for a marquee element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. - CVE-2017-7802 (arbitrary code execution) A use-after-free vulnerability has been found in firefox < 55.0 and thunderbird < 52.3, when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed. - CVE-2017-7803 (access restriction bypass) A security issue has been found in firefox < 55.0 and thunderbird < 52.3. When a page’s content security policy (CSP) header contains a sandbox directive, other directives are ignored. This results in the incorrect enforcement of CSP. - CVE-2017-7807 (content spoofing) A domain hijacking flaw has been found in firefox < 55.0 and thunderbird < 52.3. A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain. This has been addressed by requiring fallback files be inside the manifest directory. - CVE-2017-7809 (arbitrary code execution) A use-after-free issue has been found in firefox < 55.0 and thunderbird < 52.3, when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This results in a potentially exploitable crash. Impact ====== A remote attacker can access sensitive information, bypass security restrictions, crash the application or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7753 https://bugzilla.mozilla.org/show_bug.cgi?id=1353312 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7779 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1354443%2C1368576%2C1366903… https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7784 https://bugzilla.mozilla.org/show_bug.cgi?id=1376087 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7785 https://bugzilla.mozilla.org/show_bug.cgi?id=1356985 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7786 https://bugzilla.mozilla.org/show_bug.cgi?id=1365189 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7787 https://bugzilla.mozilla.org/show_bug.cgi?id=1322896 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7791 https://bugzilla.mozilla.org/show_bug.cgi?id=1365875 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7792 https://bugzilla.mozilla.org/show_bug.cgi?id=1368652 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7800 https://bugzilla.mozilla.org/show_bug.cgi?id=1374047 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7801 https://bugzilla.mozilla.org/show_bug.cgi?id=1371259 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7802 https://bugzilla.mozilla.org/show_bug.cgi?id=1378147 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7803 https://bugzilla.mozilla.org/show_bug.cgi?id=1377426 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7807 https://bugzilla.mozilla.org/show_bug.cgi?id=1376459 https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7809 https://bugzilla.mozilla.org/show_bug.cgi?id=1380284 https://security.archlinux.org/CVE-2017-7753 https://security.archlinux.org/CVE-2017-7779 https://security.archlinux.org/CVE-2017-7784 https://security.archlinux.org/CVE-2017-7785 https://security.archlinux.org/CVE-2017-7786 https://security.archlinux.org/CVE-2017-7787 https://security.archlinux.org/CVE-2017-7791 https://security.archlinux.org/CVE-2017-7792 https://security.archlinux.org/CVE-2017-7800 https://security.archlinux.org/CVE-2017-7801 https://security.archlinux.org/CVE-2017-7802 https://security.archlinux.org/CVE-2017-7803 https://security.archlinux.org/CVE-2017-7807 https://security.archlinux.org/CVE-2017-7809

1 0

[arch-security] [ASA-201708-17] salt: directory traversal
by Levente Polyak 23 Aug '17

23 Aug '17

Arch Linux Security Advisory ASA-201708-17 ========================================== Severity: Medium Date : 2017-08-23 CVE-ID : CVE-2017-12791 Package : salt Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-383 Summary ======= The package salt before version 2017.7.1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 2017.7.1-1. # pacman -Syu "salt>=2017.7.1-1" The problem has been fixed upstream in version 2017.7.1. Workaround ========== None. Description =========== It has been discovered that maliciously crafted minion IDs can cause unwanted directory traversals on the salt-master. The flaw is within the minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory traversal. Impact ====== An unauthenticated attacker is able to craft a malicious minion ID to cause a directory traversal on the salt-master. References ========== https://groups.google.com/forum/#!topic/salt-announce/3e5bNantdJk https://security.archlinux.org/CVE-2017-12791

1 0