- Arch-security - lists.archlinux.org

[arch-security] [ASA-201708-16] curl: information disclosure
by Santiago Torres-Arias 22 Aug '17

22 Aug '17

Arch Linux Security Advisory ASA-201708-16 ========================================== Severity: Medium Date : 2017-08-22 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101 Package : curl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-370 Summary ======= The package curl before version 7.55-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.55-1. # pacman -Syu "curl>=7.55-1" The problems have been fixed upstream in version 7.55. Workaround ========== None. Description =========== - CVE-2017-1000099 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTTP-like headers. The code doing this would send the wrong buffer to the user (stdout or the application's provide callback), which could lead to other private data from the heap to get inadvertently displayed. The wrong buffer was an uninitialized memory area allocated on the heap and if it turned out to not contain any zero byte, it would continue and display the data following that buffer in memory. - CVE-2017-1000100 (information disclosure) An information disclosure issue has been found in curl < 7.55.0. When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. - CVE-2017-1000101 (information disclosure) A heap-based read buffer overflow has been found in curl < 7.55.0. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be http://ur%20[0-60000000000000000000. This flaw only affects the curl command line tool, not the libcurl library. Impact ====== An attacker is able to read sensitive information by asking curl to retrieve a maliciously crafted URL. References ========== https://curl.haxx.se/docs/adv_20170809C.html https://curl.haxx.se/CVE-2017-1000099.patch https://curl.haxx.se/docs/adv_20170809B.html https://curl.haxx.se/CVE-2017-1000100.patch https://curl.haxx.se/docs/adv_20170809A.html https://curl.haxx.se/CVE-2017-1000101.patch https://security.archlinux.org/CVE-2017-1000099 https://security.archlinux.org/CVE-2017-1000100 https://security.archlinux.org/CVE-2017-1000101

1 0

[arch-security] [ASA-201708-15] newsbeuter: arbitrary code execution
by Jelle van der Waa 21 Aug '17

21 Aug '17

Arch Linux Security Advisory ASA-201708-15 ========================================== Severity: High Date : 2017-08-20 CVE-ID : CVE-2017-12904 Package : newsbeuter Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-384 Summary ======= The package newsbeuter before version 2.9-7 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.9-7. # pacman -Syu "newsbeuter>=2.9-7" The problem has been fixed upstream but no release is available yet. Workaround ========== Don't bookmark items. Description =========== An attacker can craft an RSS item with shell code in the title and/or URL. When such an item is bookmarked, the shell will execute that code. The vulnerability is triggered when bookmark-cmd is called. Impact ====== A remote attacker can execute an arbitrary command on the affected host by tricking a user into bookmarking a specially crafted RSS item. References ========== https://github.com/akrennmair/newsbeuter/issues/591 https://groups.google.com/forum/#!topic/newsbeuter/iFqSE7Vz-DE https://security.archlinux.org/CVE-2017-12904

1 0

[arch-security] [ASA-201708-14] subversion: arbitrary command execution
by Remi Gacogne 15 Aug '17

15 Aug '17

Arch Linux Security Advisory ASA-201708-14 ========================================== Severity: Critical Date : 2017-08-15 CVE-ID : CVE-2017-9800 Package : subversion Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-379 Summary ======= The package subversion before version 1.9.7-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 1.9.7-1. # pacman -Syu "subversion>=1.9.7-1" The problem has been fixed upstream in version 1.9.7. Workaround ========== None. Description =========== A security issue has been found in subversion < 1.9.7. A Subversion client sometimes connects to URLs provided by the repository. This happens in two primary cases: during 'checkout', 'export', 'update', and 'switch', when the tree being downloaded contains svn:externals properties; and when using 'svnsync sync' with one URL argument. A maliciously constructed svn+ssh:// URL would cause Subversion clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://. Impact ====== A remote attacker can execute arbitrary command on the affected host by tricking a user into executing a subversion command. References ========== http://subversion.apache.org/security/CVE-2017-9800-advisory.txt https://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/%… https://security.archlinux.org/CVE-2017-9800

1 0

[arch-security] [ASA-201708-13] strongswan: denial of service
by Christian Rebischke 15 Aug '17

15 Aug '17

Arch Linux Security Advisory ASA-201708-13 ========================================== Severity: Low Date : 2017-08-14 CVE-ID : CVE-2017-11185 Package : strongswan Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-382 Summary ======= The package strongswan before version 5.5.3-4 is vulnerable to denial of service. Resolution ========== Upgrade to 5.5.3-4. # pacman -Syu "strongswan>=5.5.3-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Fixed a DoS vulnerability in the gmp plugin that was caused by insufficient input validation when verifying RSA signatures, which requires decryption with the operation m^e mod n, where m is the signature, and e and n are the exponent and modulus of the public key. The value m is an integer between 0 and n-1, however, the gmp plugin did not verify this. So if m equals n the calculation results in 0, in which case mpz_export() returns NULL. This result wasn't handled properly causing a null-pointer dereference. Impact ====== The attacker is able to crash the application via a specially crafted RSA signature. References ========== https://wiki.strongswan.org/versions/66 https://www.strongswan.org/blog/2017/08/14/strongswan-vulnerability-(cve-20… https://security.archlinux.org/CVE-2017-11185

1 0

[arch-security] [ASA-201708-12] spice: arbitrary code execution
by Remi Gacogne 15 Aug '17

15 Aug '17

Arch Linux Security Advisory ASA-201708-12 ========================================== Severity: High Date : 2017-08-14 CVE-ID : CVE-2017-7506 Package : spice Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-349 Summary ======= The package spice before version 0.12.8+8+ga957a90b-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.12.8+8+ga957a90b-1. # pacman -Syu "spice>=0.12.8+8+ga957a90b-1" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Two security issues have been found in spice <= 0.12.8, allowing a remote, authenticated user to get access to memory content by sending a number of monitors bigger than the number of items, and to trigger an integer overflow of the buffer_size variable, leading to a potentially exploitable buffer overflow. Impact ====== A remote, authenticated attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/54808 https://bugzilla.redhat.com/show_bug.cgi?id=1452606 https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=f1e7ec03e26ab6b8… https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=ec6229c79abe05d7… https://cgit.freedesktop.org/spice/spice/commit/?h=0.12&id=a957a90baf2c62d3… https://security.archlinux.org/CVE-2017-7506

1 0

[arch-security] [ASA-201708-11] xorg-server: multiple issues
by Remi Gacogne 15 Aug '17

15 Aug '17

Arch Linux Security Advisory ASA-201708-11 ========================================== Severity: High Date : 2017-08-14 CVE-ID : CVE-2017-10971 CVE-2017-10972 Package : xorg-server Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-341 Summary ======= The package xorg-server before version 1.19.3-3 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 1.19.3-3. # pacman -Syu "xorg-server>=1.19.3-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-10971 (arbitrary code execution) In the X.Org X server on v.1.19.3, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events. - CVE-2017-10972 (information disclosure) Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server on v1.19.3 and before allowed authenticated malicious users to access potentially privileged data from the X server. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://bugzilla.suse.com/show_bug.cgi?id=1035283 https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b1… https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992e… https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b1364869… https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc… https://security.archlinux.org/CVE-2017-10971 https://security.archlinux.org/CVE-2017-10972

1 0

[arch-security] [ASA-201708-10] libytnef: arbitrary code execution
by Remi Gacogne 15 Aug '17

15 Aug '17

Arch Linux Security Advisory ASA-201708-10 ========================================== Severity: High Date : 2017-08-14 CVE-ID : CVE-2017-9058 Package : libytnef Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-275 Summary ======= The package libytnef before version 1.9.2-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.9.2-2. # pacman -Syu "libytnef>=1.9.2-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-buffer-overflow vulnerability has been found in the libytnef in the lib/ytnef.c module. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted tnef file. References ========== https://github.com/bingosxs/fuzzdata/blob/master/ytnef-1.9/TNEFFreeMapiProp… https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=862556 https://security.archlinux.org/CVE-2017-9058

1 0

[arch-security] [ASA-201708-9] audiofile: multiple issues
by Remi Gacogne 15 Aug '17

15 Aug '17

Arch Linux Security Advisory ASA-201708-9 ========================================= Severity: High Date : 2017-08-14 CVE-ID : CVE-2017-6827 CVE-2017-6828 CVE-2017-6829 CVE-2017-6830 CVE-2017-6831 CVE-2017-6832 CVE-2017-6833 CVE-2017-6834 CVE-2017-6835 CVE-2017-6836 CVE-2017-6837 CVE-2017-6838 CVE-2017-6839 Package : audiofile Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-205 Summary ======= The package audiofile before version 0.3.6-4 is vulnerable to multiple issues including arbitrary code execution, arbitrary command execution and denial of service. Resolution ========== Upgrade to 0.3.6-4. # pacman -Syu "audiofile>=0.3.6-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-6827 (arbitrary code execution) Heap-based buffer overflow in msdapcmInitializeCoefficients (msadcpcm.cpp) could lead to arbitrary code execution. - CVE-2017-6828 (arbitrary code execution) Heap-based buffer overflow in readValue (filehandle.cpp) could lead to arbitrary code execution. - CVE-2017-6829 (arbitrary code execution) Global buffer overflow in decodesample (ima.cpp) that could lead to arbitrary code execution - CVE-2017-6830 (arbitrary code execution) Heap-based buffer overflow in alaw2linear_buf that could lead to arbitrary code execution. - CVE-2017-6831 (arbitrary code execution) Heap-based buffer overflow in IMA::decodeBlockWAVE (IMA.cpp) that could lead to arbitrary code execution. - CVE-2017-6832 (arbitrary code execution) Heap-based buffer overflow in MSADPCM::decodeBlock (MSADPCM.cpp) that could lead to arbitrary code execution. - CVE-2017-6833 (denial of service) Divide-by-zero triggers a crash in BlockCodec::runPull (BlockCodec.cpp) - CVE-2017-6834 (arbitrary code execution) Heap-based buffer overflow in ulaw2linear_buf (G711.cpp) - CVE-2017-6835 (denial of service) Divide-by-zero triggers crash in BlockCodec::reset1 (BlockCodec.cpp) - CVE-2017-6836 (arbitrary command execution) audiofile: heap-based buffer overflow in Expand3To4Module::run (SimpleModule.h) - CVE-2017-6837 (denial of service) Integer overflow triggering an assertion on the WAVE module using sfconvert. - CVE-2017-6838 (denial of service) Integer overflow with the sfconvert command. - CVE-2017-6839 (denial of service) Integer overflow in sfconvert with the MSADPCM module. Impact ====== An attacker can cause a denial of service, or execute arbitrary code or command on the affected host via a crafted audio file. References ========== https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflo… https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflo… https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in… https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflo… https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflo… https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflo… https://blogs.gentoo.org/ago/2017/02/20/audiofile-divide-by-zero-in-blockco… https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflo… https://blogs.gentoo.org/ago/2017/02/20/audiofile-divide-by-zero-in-blockco… https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflo… https://blogs.gentoo.org/ago/2017/02/20/audiofile-multiple-ubsan-crashes/ https://security.archlinux.org/CVE-2017-6827 https://security.archlinux.org/CVE-2017-6828 https://security.archlinux.org/CVE-2017-6829 https://security.archlinux.org/CVE-2017-6830 https://security.archlinux.org/CVE-2017-6831 https://security.archlinux.org/CVE-2017-6832 https://security.archlinux.org/CVE-2017-6833 https://security.archlinux.org/CVE-2017-6834 https://security.archlinux.org/CVE-2017-6835 https://security.archlinux.org/CVE-2017-6836 https://security.archlinux.org/CVE-2017-6837 https://security.archlinux.org/CVE-2017-6838 https://security.archlinux.org/CVE-2017-6839

1 0

[arch-security] [ASA-201708-8] jdk7-openjdk: multiple issues
by Remi Gacogne 14 Aug '17

14 Aug '17

Arch Linux Security Advisory ASA-201708-8 ========================================= Severity: Critical Date : 2017-08-12 CVE-ID : CVE-2017-10053 CVE-2017-10067 CVE-2017-10074 CVE-2017-10081 CVE-2017-10087 CVE-2017-10089 CVE-2017-10090 CVE-2017-10096 CVE-2017-10101 CVE-2017-10102 CVE-2017-10107 CVE-2017-10108 CVE-2017-10109 CVE-2017-10110 CVE-2017-10111 CVE-2017-10115 CVE-2017-10116 CVE-2017-10118 CVE-2017-10135 CVE-2017-10176 CVE-2017-3509 CVE-2017-3511 CVE-2017-3526 CVE-2017-3533 CVE-2017-3539 CVE-2017-3544 Package : jdk7-openjdk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-380 Summary ======= The package jdk7-openjdk before version 7.u151_2.6.11-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, authentication bypass, denial of service, privilege escalation, private key recovery and content spoofing. Resolution ========== Upgrade to 7.u151_2.6.11-1. # pacman -Syu "jdk7-openjdk>=7.u151_2.6.11-1" The problems have been fixed upstream in version 7.u151_2.6.11. Workaround ========== None. Description =========== - CVE-2017-10053 (denial of service) It was discovered that the JPEGImageReader implementation in the 2D component of OpenJDK would, in certain cases, read all image data even if that was not used later. A specially crafted image could cause a Java application to temporarily use an excessive amount of CPU and memory. - CVE-2017-10067 (authentication bypass) It was discovered that the JAR (Java ARchive) verifier in the Security component of OpenJDK did not correctly handle files inside archives with missing digest. An attacker could possibly use this flaw to manipulate content of a singed JAR, bypassing intended verification. - CVE-2017-10074 (arbitrary code execution) It was discovered that the Hotspot component of OpenJDK did not properly check for integer overflows when generating range check loop predicates. An untrusted Java application or applet could use this flaw to corrupt JVM memory and cause it to crash or, possibly, execute arbitrary code, bypassing Java sandbox restrictions. - CVE-2017-10081 (access restriction bypass) A flaw was found in the way the Hotspot component of OpenJDK processed extraneous brackets in function signatures. An untrusted Java application or applet could use this flaw to bypass Java certain sandbox restrictions. - CVE-2017-10087 (access restriction bypass) It was discovered that the implementation of the ThreadPoolExecutor class in the java.util.concurrent package of the Libraries component of OpenJDK failed to properly perform access control checks. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2017-10089 (access restriction bypass) It was discovered that the implementation of the ServiceRegistry class in the ImageIO component of OpenJDK failed to properly perform access control checks. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2017-10090 (access restriction bypass) It was discovered that the implementation of the AsynchronousChannelGroupImpl class in the java.nio.channels package of the Libraries component of OpenJDK failed to properly perform access control checks. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2017-10096 (access restriction bypass) It was discovered that the implementation of the TransformerException class in the JAXP component of OpenJDK failed to properly perform access control checks, related to handling of the DTM exceptions. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2017-10101 (access restriction bypass) It was discovered that the JAXP component of OpenJDK failed to restrict access to certain internal classes. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2017-10102 (arbitrary code execution) It was discovered that the DCG (Distributed Garbage Collector) implementation in the RMI component of OpenJDK failed to correctly handle references. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. - CVE-2017-10107 (access restriction bypass) It was discovered that the implementation of the ActivationID class in the RMI component of OpenJDK failed to properly perform access control checks. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2017-10108 (denial of service) It was discovered that the implementation of the BasicAttribute class in OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. A specially-crafted serialized input stream could cause JVM to consume an excessive amount of memory. - CVE-2017-10109 (access restriction bypass) It was discovered that the implementation of the CodeSource class in OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form. An untrusted Java application or applet could use this flaw to cause JVM to allocate an excessive amount of memory, bypassing certain Java sandbox restrictions. - CVE-2017-10110 (access restriction bypass) It was discovered that the implementation of the ImageWatched class in the AWT component of OpenJDK failed to properly perform access control checks. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2017-10111 (arbitrary code execution) It was discovered that the LambdaFormEditor class in the Libraries component of OpenJDK did not correctly perform bounds checks in the permuteArgumentsForm() function. An untrusted Java application or applet could use this flaw to corrupt JVM memory and cause it to crash or, possibly, execute arbitrary code, bypassing Java sandbox restrictions. The problem is triggered when using MethodHandle.permuteArguments(). - CVE-2017-10115 (private key recovery) A covert timing channel flaw was found in the DSA implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application generate DSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel. - CVE-2017-10116 (privilege escalation) It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers. - CVE-2017-10118 (private key recovery) A covert timing channel flaw was found in the ECDSA implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application generate ECDSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel. - CVE-2017-10135 (private key recovery) A covert timing channel flaw was found in the PKCS#8 implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application repeatedly compare PKCS#8 key against an attacker controlled value could possibly use this flaw to determine the key via a timing side channel. - CVE-2017-10176 (private key recovery) It was discovered that the Elliptic Curve (EC) cryptography implementation in the Security component of OpenJDK did not perform computations for certain points correctly. An attacker able to interact with a Java application using EC cryptography could possibly use this flaw to obtain information about the used key. - CVE-2017-3509 (privilege escalation) It was discovered that the HTTP client implementation in the Networking component of OpenJDK could cache and re-use an NTLM authenticated connection in a different security context. A remote attacker could possibly use this flaw to make a Java application perform HTTP requests authenticated with credentials of a different user. - CVE-2017-3511 (privilege escalation) An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges. - CVE-2017-3526 (denial of service) It was found that the JAXP component of OpenJDK failed to correctly enforce parse tree size limits when parsing XML document. An attacker able to make a Java application parse a specially crafted XML document could use this flaw to make it consume an excessive amount of CPU and memory. - CVE-2017-3533 (access restriction bypass) A newline injection flaw was discovered in the FTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate FTP connections established by a Java application. - CVE-2017-3539 (access restriction bypass) It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. - CVE-2017-3544 (content spoofing) A newline injection flaw was discovered in the SMTP client implementation in the Networking component in OpenJDK. A remote attacker could possibly use this flaw to manipulate SMTP connections established by a Java application. Impact ====== A remote attacker can bypass access restrictions, crash the program, access sensitive information and execute arbitrary code on the affected host. References ========== http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/686e47e14565 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/c729ab3b13ae http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/37ba410ffd43 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/09eae0bade20 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/e95a13de2d36 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/d7bd49ad8f0a http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/51631f9fa8d8 http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/rev/510b8c8dfdd6 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/b3e7354e6ae8 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/070e24b47ae0 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/97ea41335486 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/936085d9aff0 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/56e0ab47dbec http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/78a83e6e0fe8 http://hg.openjdk.java.net/jdk9/dev/jdk/rev/9003926e4a8a http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/3c8ea47635b6 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/73dd1557f0ef http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/996632997de8 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/079cd6c5de27 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/d99101781d7e http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/bea5b22daf5d http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/af0e709d28f9 http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/rev/756b7a2f20cc http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/81ddd5fc5a4e http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/1f2ff3f1882a http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/f672cb804684 https://security.archlinux.org/CVE-2017-10053 https://security.archlinux.org/CVE-2017-10067 https://security.archlinux.org/CVE-2017-10074 https://security.archlinux.org/CVE-2017-10081 https://security.archlinux.org/CVE-2017-10087 https://security.archlinux.org/CVE-2017-10089 https://security.archlinux.org/CVE-2017-10090 https://security.archlinux.org/CVE-2017-10096 https://security.archlinux.org/CVE-2017-10101 https://security.archlinux.org/CVE-2017-10102 https://security.archlinux.org/CVE-2017-10107 https://security.archlinux.org/CVE-2017-10108 https://security.archlinux.org/CVE-2017-10109 https://security.archlinux.org/CVE-2017-10110 https://security.archlinux.org/CVE-2017-10111 https://security.archlinux.org/CVE-2017-10115 https://security.archlinux.org/CVE-2017-10116 https://security.archlinux.org/CVE-2017-10118 https://security.archlinux.org/CVE-2017-10135 https://security.archlinux.org/CVE-2017-10176 https://security.archlinux.org/CVE-2017-3509 https://security.archlinux.org/CVE-2017-3511 https://security.archlinux.org/CVE-2017-3526 https://security.archlinux.org/CVE-2017-3533 https://security.archlinux.org/CVE-2017-3539 https://security.archlinux.org/CVE-2017-3544

1 0

[arch-security] [ASA-201708-7] mercurial: multiple issues
by Remi Gacogne 14 Aug '17

14 Aug '17

Arch Linux Security Advisory ASA-201708-7 ========================================= Severity: Critical Date : 2017-08-12 CVE-ID : CVE-2017-1000115 CVE-2017-1000116 Package : mercurial Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-378 Summary ======= The package mercurial before version 4.2.3-1 is vulnerable to multiple issues including arbitrary command execution and arbitrary filesystem access. Resolution ========== Upgrade to 4.2.3-1. # pacman -Syu "mercurial>=4.2.3-1" The problems have been fixed upstream in version 4.2.3. Workaround ========== None. Description =========== - CVE-2017-1000115 (arbitrary filesystem access) Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository. - CVE-2017-1000116 (arbitrary command execution) Mercurial < 4.3 was not sanitizing hostnames passed to ssh, allowing shell injection attacks on clients by specifying a hostname starting with -oProxyCommand. This is also present in Git (CVE-2017-1000117) and Subversion (CVE-2017-9800), so please patch those tools as well if you have them installed. Impact ====== A remote attacker can execute arbitrary command on the affected host by tricking a user into executing a hg command. A remote attacker can use crafted commits mixing symlinks and regular files to get access to files outside the repository. References ========== https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.282017-08-10.29 https://security.archlinux.org/CVE-2017-1000115 https://security.archlinux.org/CVE-2017-1000116

1 0