- Arch-security - lists.archlinux.org

[arch-security] [ASA-201709-11] newsbeuter: arbitrary command execution
by Levente Polyak 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-11 ========================================== Severity: High Date : 2017-09-16 CVE-ID : CVE-2017-12904 CVE-2017-14500 Package : newsbeuter Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-401 Summary ======= The package newsbeuter before version 2.9-8 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2.9-8. # pacman -Syu "newsbeuter>=2.9-8" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-12904 (arbitrary command execution) Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted shell command execution by crafting an RSS item that includes shell code in its title and/or URL. When the user bookmarks such item the shell code will be executed. - CVE-2017-14500 (arbitrary command execution) Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted shell command execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp. When the user plays the file in Podbeuter, the shell code will be executed. Impact ====== A remote attacker can execute arbitrary commands on the affected host by tricking a user into bookmarking a specially crafted RSS item or by playing a podcast file that includes shell metacharacters in its filename. References ========== https://github.com/akrennmair/newsbeuter/issues/591 https://github.com/akrennmair/newsbeuter/commit/3b84203448f077dff6f83ba986f… https://github.com/akrennmair/newsbeuter/commit/d1460189f6f810ca9a3687af7bc… https://groups.google.com/forum/#!topic/newsbeuter/iFqSE7Vz-DE https://github.com/akrennmair/newsbeuter/issues/598 https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798… https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c… https://security.archlinux.org/CVE-2017-12904 https://security.archlinux.org/CVE-2017-14500

1 0

[arch-security] [ASA-201709-10] ffmpeg: denial of service
by Levente Polyak 18 Sep '17

18 Sep '17

Arch Linux Security Advisory ASA-201709-10 ========================================== Severity: Medium Date : 2017-09-15 CVE-ID : CVE-2017-14054 CVE-2017-14055 CVE-2017-14056 CVE-2017-14057 CVE-2017-14058 CVE-2017-14059 CVE-2017-14169 CVE-2017-14170 CVE-2017-14171 CVE-2017-14222 CVE-2017-14223 CVE-2017-14225 Package : ffmpeg Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-400 Summary ======= The package ffmpeg before version 1:3.3.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1:3.3.4-1. # pacman -Syu "ffmpeg>=1:3.3.4-1" The problems have been fixed upstream in version 3.3.4. Workaround ========== None. Description =========== - CVE-2017-14054 (denial of service) In libavformat/rmdec.c in FFmpeg 3.3.3, a DoS in ivr_read_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted IVR file, which claims a large "len" field in the header but does not contain sufficient backing data, is provided, the first type==4 loop would consume huge CPU resources, since there is no EOF check inside the loop. - CVE-2017-14055 (denial of service) In libavformat/mvdec.c in FFmpeg 3.3.3, a DoS in mv_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MV file, which claims a large "nb_frames" field in the header but does not contain sufficient backing data, is provided, the loop over the frames would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14056 (denial of service) In libavformat/rl2.c in FFmpeg 3.3.3, a DoS in rl2_read_header() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted RL2 file, which claims a large "frame_count" field in the header but does not contain sufficient backing data, is provided, the loops (for offset and size tables) would consume huge CPU and memory resources, since there is no EOF check inside these loops. - CVE-2017-14057 (denial of service) In FFmpeg 3.3.3, a DoS in asf_read_marker() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted ASF file, which claims a large "name_len" or "count" field in the header but does not contain sufficient backing data, is provided, the loops over the name and markers would consume huge CPU and memory resources, since there is no EOF check inside these loops. - CVE-2017-14058 (denial of service) In FFmpeg 3.3.3, the read_data function in libavformat/hls.c does not restrict reload attempts for an insufficient list, which allows remote attackers to cause a denial of service (infinite loop). - CVE-2017-14059 (denial of service) In FFmpeg 3.3.3, a DoS in cine_read_header() due to lack of an EOF check might cause huge CPU and memory consumption. When a crafted CINE file, which claims a large "duration" field in the header but does not contain sufficient backing data, is provided, the image-offset parsing loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14169 (denial of service) In the mxf_read_primer_pack function in libavformat/mxfdec.c in FFmpeg 3.3.3, an integer signedness error might occur when a crafted file, which claims a large "item_num" field such as 0xffffffff, is provided. As a result, the variable "item_num" turns negative, bypassing the check for a large value. - CVE-2017-14170 (denial of service) In libavformat/mxfdec.c in FFmpeg 3.3.3, a DoS in mxf_read_index_entry_array() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted MXF file, which claims a large "nb_index_entries" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU resources, since there is no EOF check inside the loop. Moreover, this big loop can be invoked multiple times if there is more than one applicable data segment in the crafted MXF file. - CVE-2017-14171 (denial of service) In libavformat/nsvdec.c in FFmpeg 3.3.3, a DoS in nsv_parse_NSVf_header() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted NSV file, which claims a large "table_entries_used" field in the header but does not contain sufficient backing data, is provided, the loop over 'table_entries_used' would consume huge CPU resources, since there is no EOF check inside the loop. - CVE-2017-14222 (denial of service) In libavformat/mov.c in FFmpeg 3.3.3, a DoS in read_tfra() due to lack of an EOF (End of File) check might cause huge CPU and memory consumption. When a crafted MOV file, which claims a large "item_count" field in the header but does not contain sufficient backing data, is provided, the loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14223 (denial of service) In libavformat/asfdec_f.c in FFmpeg 3.3.3, a DoS in asf_build_simple_index() due to lack of an EOF (End of File) check might cause huge CPU consumption. When a crafted ASF file, which claims a large "ict" field in the header but does not contain sufficient backing data, is provided, the for loop would consume huge CPU and memory resources, since there is no EOF check inside the loop. - CVE-2017-14225 (denial of service) The av_color_primaries_name function in libavutil/pixdesc.c in FFmpeg 3.3.3 may return a NULL pointer depending on a value contained in a file, but callers do not anticipate this, as demonstrated by the avcodec_string function in libavcodec/utils.c, leading to a NULL pointer dereference. (It is also conceivable that there is security relevance for a NULL pointer dereference in av_color_primaries_name calls within the ffprobe command-line program.) Impact ====== A remote attacker is able to crash the application while watching a HLS stream. Furthermore an attacker is able to crash the application by tricking the user into opening a specially crafted video file. References ========== https://github.com/FFmpeg/FFmpeg/commit/124eb202e70678539544f6268efc98131f1… https://github.com/FFmpeg/FFmpeg/commit/4f05e2e2dc1a89f38cd9f0960a6561083d7… https://github.com/FFmpeg/FFmpeg/commit/96f24d1bee7fe7bac08e2b7c74db1a046c9… https://github.com/FFmpeg/FFmpeg/commit/7f9ec5593e04827249e7aeb466da06a98a0… https://github.com/FFmpeg/FFmpeg/commit/7ec414892ddcad88313848494b6fc5f437c… https://github.com/FFmpeg/FFmpeg/commit/7e80b63ecd259d69d383623e75b318bf2bd… https://github.com/FFmpeg/FFmpeg/commit/9d00fb9d70ee8c0cc7002b89318c5be00f1… https://github.com/FFmpeg/FFmpeg/commit/900f39692ca0337a98a7cf047e4e2611071… https://github.com/FFmpeg/FFmpeg/commit/c24bcb553650b91e9eff15ef6e54ca73de2… https://github.com/FFmpeg/FFmpeg/commit/9cb4eb772839c5e1de2855d126bf74ff16d… https://github.com/FFmpeg/FFmpeg/commit/afc9c683ed9db01edb357bc8c19edad4282… https://github.com/FFmpeg/FFmpeg/commit/837cb4325b712ff1aab531bf41668933f61… https://security.archlinux.org/CVE-2017-14054 https://security.archlinux.org/CVE-2017-14055 https://security.archlinux.org/CVE-2017-14056 https://security.archlinux.org/CVE-2017-14057 https://security.archlinux.org/CVE-2017-14058 https://security.archlinux.org/CVE-2017-14059 https://security.archlinux.org/CVE-2017-14169 https://security.archlinux.org/CVE-2017-14170 https://security.archlinux.org/CVE-2017-14171 https://security.archlinux.org/CVE-2017-14222 https://security.archlinux.org/CVE-2017-14223 https://security.archlinux.org/CVE-2017-14225

1 0

[arch-security] [ASA-201709-9] linux: arbitrary code execution
by Levente Polyak 15 Sep '17

15 Sep '17

Arch Linux Security Advisory ASA-201709-9 ========================================= Severity: High Date : 2017-09-15 CVE-ID : CVE-2017-1000251 Package : linux Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-392 Summary ======= The package linux before version 4.12.13-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.12.13-1. # pacman -Syu "linux>=4.12.13-1" The problem has been fixed upstream in version 4.12.13. Workaround ========== None. Description =========== A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although it is unlikely. On systems without the stack protection feature, an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. Impact ====== An unauthenticated attacker able to initiate a connection via Bluetooth is able to crash the system or possibly execute arbitrary code. References ========== https://bugs.archlinux.org/task/55601 https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 https://www.armis.com/blueborne/ https://security.archlinux.org/CVE-2017-1000251

1 0

[arch-security] [ASA-201709-8] linux-lts: arbitrary code execution
by Levente Polyak 14 Sep '17

14 Sep '17

Arch Linux Security Advisory ASA-201709-8 ========================================= Severity: High Date : 2017-09-14 CVE-ID : CVE-2017-1000251 Package : linux-lts Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-393 Summary ======= The package linux-lts before version 4.9.49-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.9.49-2. # pacman -Syu "linux-lts>=4.9.49-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although it is unlikely. On systems without the stack protection feature, an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. Impact ====== An unauthenticated attacker able to initiate a connection via Bluetooth is able to crash the system or possibly execute arbitrary code. References ========== https://bugs.archlinux.org/task/55601 https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 https://www.armis.com/blueborne/ https://security.archlinux.org/CVE-2017-1000251

1 0

[arch-security] [ASA-201709-7] lib32-flashplugin: arbitrary code execution
by Levente Polyak 14 Sep '17

14 Sep '17

Arch Linux Security Advisory ASA-201709-7 ========================================= Severity: Critical Date : 2017-09-13 CVE-ID : CVE-2017-11281 CVE-2017-11282 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-399 Summary ======= The package lib32-flashplugin before version 27.0.0.130-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 27.0.0.130-1. # pacman -Syu "lib32-flashplugin>=27.0.0.130-1" The problems have been fixed upstream in version 27.0.0.130. Workaround ========== None. Description =========== - CVE-2017-11281 (arbitrary code execution) A memory corruption issue has been found in Adobe Flash player version 26.0.0.151 and earlier, leading to remote code execution. - CVE-2017-11282 (arbitrary code execution) A memory corruption issue has been found in Adobe Flash player version 26.0.0.151 and earlier, leading to remote code execution. Impact ====== A remote attacker is able to execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-28.html https://security.archlinux.org/CVE-2017-11281 https://security.archlinux.org/CVE-2017-11282

1 0

[arch-security] [ASA-201709-6] flashplugin: arbitrary code execution
by Levente Polyak 14 Sep '17

14 Sep '17

Arch Linux Security Advisory ASA-201709-6 ========================================= Severity: Critical Date : 2017-09-13 CVE-ID : CVE-2017-11281 CVE-2017-11282 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-398 Summary ======= The package flashplugin before version 27.0.0.130-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 27.0.0.130-1. # pacman -Syu "flashplugin>=27.0.0.130-1" The problems have been fixed upstream in version 27.0.0.130. Workaround ========== None. Description =========== - CVE-2017-11281 (arbitrary code execution) A memory corruption issue has been found in Adobe Flash player version 26.0.0.151 and earlier, leading to remote code execution. - CVE-2017-11282 (arbitrary code execution) A memory corruption issue has been found in Adobe Flash player version 26.0.0.151 and earlier, leading to remote code execution. Impact ====== A remote attacker is able to execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-28.html https://security.archlinux.org/CVE-2017-11281 https://security.archlinux.org/CVE-2017-11282

1 0

[arch-security] [ASA-201709-5] tcpdump: multiple issues
by Levente Polyak 13 Sep '17

13 Sep '17

Arch Linux Security Advisory ASA-201709-5 ========================================= Severity: Critical Date : 2017-09-13 CVE-ID : CVE-2017-11541 CVE-2017-11542 CVE-2017-11543 CVE-2017-12893 CVE-2017-12894 CVE-2017-12895 CVE-2017-12896 CVE-2017-12897 CVE-2017-12898 CVE-2017-12899 CVE-2017-12900 CVE-2017-12901 CVE-2017-12902 CVE-2017-12985 CVE-2017-12986 CVE-2017-12987 CVE-2017-12988 CVE-2017-12989 CVE-2017-12990 CVE-2017-12991 CVE-2017-12992 CVE-2017-12993 CVE-2017-12994 CVE-2017-12995 CVE-2017-12996 CVE-2017-12997 CVE-2017-12998 CVE-2017-12999 CVE-2017-13000 CVE-2017-13001 CVE-2017-13002 CVE-2017-13003 CVE-2017-13004 CVE-2017-13005 CVE-2017-13006 CVE-2017-13007 CVE-2017-13008 CVE-2017-13009 CVE-2017-13010 CVE-2017-13011 CVE-2017-13012 CVE-2017-13013 CVE-2017-13014 CVE-2017-13015 CVE-2017-13016 CVE-2017-13017 CVE-2017-13018 CVE-2017-13019 CVE-2017-13020 CVE-2017-13021 CVE-2017-13022 CVE-2017-13023 CVE-2017-13024 CVE-2017-13025 CVE-2017-13026 CVE-2017-13027 CVE-2017-13028 CVE-2017-13029 CVE-2017-13030 CVE-2017-13031 CVE-2017-13032 CVE-2017-13033 CVE-2017-13034 CVE-2017-13035 CVE-2017-13036 CVE-2017-13037 CVE-2017-13038 CVE-2017-13039 CVE-2017-13040 CVE-2017-13041 CVE-2017-13042 CVE-2017-13043 CVE-2017-13044 CVE-2017-13045 CVE-2017-13046 CVE-2017-13047 CVE-2017-13048 CVE-2017-13049 CVE-2017-13050 CVE-2017-13051 CVE-2017-13052 CVE-2017-13053 CVE-2017-13054 CVE-2017-13055 CVE-2017-13687 CVE-2017-13688 CVE-2017-13689 CVE-2017-13690 CVE-2017-13725 Package : tcpdump Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-361 Summary ======= The package tcpdump before version 4.9.2-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 4.9.2-1. # pacman -Syu "tcpdump>=4.9.2-1" The problems have been fixed upstream in version 4.9.2. Workaround ========== None. Description =========== - CVE-2017-11541 (denial of service) A heap-based out-of-bounds read vulnerability was discovered in tcpdump <= 4.9.1, in the lldp_print function in print-lldp.c, related to util- print.c. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash when attempting to print a summary of the packet data. - CVE-2017-11542 (denial of service) A heap-based out-of-bounds read vulnerability was discovered in tcpdump <= 4.9.1, in the pimv1_print function in print-pim.c. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash when attempting to print a summary of the packet data. - CVE-2017-11543 (arbitrary code execution) An out-of-bounds write vulnerability was discovered in tcpdump's handling of LINKTYPE_SLIP in the sliplink_print function in print-sl.c. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash or possibly execute arbitrary code when attempting to print a summary of the packet data. - CVE-2017-12893 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of SMB/CIFS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12894 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's parsers when calling lookup_bytestring in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12895 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ICMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12896 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISAKMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12897 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO CLNS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12898 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of NFS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12899 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of DECnet in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12900 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's parsers when calling tok2strbuf in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12901 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of EIGRP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12902 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Zephyr in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12985 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12986 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 routing headers in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12987 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IEEE 802.11 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12988 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of telnet in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12989 (denial of service) An infinite loop vulnerability was discovered in tcpdump's handling of RESP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to enter an infinite loop while processing the packet data leading to denial of service. - CVE-2017-12990 (denial of service) An infinite loop vulnerability was discovered in tcpdump's handling of ISAKMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to enter an infinite loop while processing the packet data leading to denial of service. - CVE-2017-12991 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12992 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RIPng in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12993 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Juniper in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12994 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12995 (denial of service) An infinite loop vulnerability was discovered in tcpdump's handling of DNS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to enter an infinite loop while processing the packet data leading to denial of service. - CVE-2017-12996 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PIMv2 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12997 (denial of service) An infinite loop vulnerability was discovered in tcpdump's handling of LLDP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to enter an infinite loop while processing the packet data leading to denial of service. - CVE-2017-12998 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-12999 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13000 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IEEE 802.15.4 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13001 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of NFS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13002 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of AODV in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13003 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of LMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13004 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Juniper in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13005 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of NFS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13006 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of L2TP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13007 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Apple PKTAP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13008 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IEEE 802.11 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13009 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 mobility in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13010 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BEEP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13011 (arbitrary code execution) An out-of-bounds write vulnerability was discovered in tcpdump's parsers when calling bittok2str_internal. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash or possibly execute arbitrary code while processing the packet data. - CVE-2017-13012 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ICMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13013 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ARP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13014 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of White Board in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13015 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of EAP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13016 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO ES-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13017 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of DHCPv6 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13018 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PGM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13019 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PGM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13020 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of VTP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13021 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ICMPv6 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13022 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13023 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 mobility in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13024 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 mobility in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13025 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 mobility in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13026 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13027 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of LLDP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13028 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BOOTP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13029 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PPP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13030 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PIM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13031 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 fragmentation header in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13032 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RADIUS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13033 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of VTP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13034 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PGM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13035 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13036 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of OSPFv3 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13037 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13038 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of PPP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13039 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISAKMP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13040 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of MPTCP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13041 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ICMPv6 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13042 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of HNCP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13043 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13044 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of HNCP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13045 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of VQP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13046 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13047 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO ES-IP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13048 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RSVP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13049 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Rx in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13050 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RPKI-Router in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13051 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of RSVP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13052 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of CFM in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13053 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of BGP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13054 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of LLDP in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13055 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of ISO IS-IS in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13687 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of Cisco HDLC in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13688 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of OLSR in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13689 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IKEv1 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13690 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IKEv2 in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. - CVE-2017-13725 (denial of service) An out-of-bounds read vulnerability was discovered in tcpdump's handling of IPv6 routing headers in tcpdump <= 4.9.1. An attacker could craft a malicious pcap file or send specially crafted packets to the network that would cause tcpdump to crash while processing the packet data. Impact ====== A remote attacker is able to crash the application or execute arbitrary code by tricking the user to open a specially crafted pcap file or by sending specially crafted packets to the network. References ========== http://www.tcpdump.org/tcpdump-changes.txt https://github.com/hackerlib/hackerlib-vul/tree/master/tcpdump-vul/heap-buf… https://github.com/the-tcpdump-group/tcpdump/commit/21d702a136c5c16882e368a… https://github.com/hackerlib/hackerlib-vul/tree/master/tcpdump-vul/heap-buf… https://github.com/the-tcpdump-group/tcpdump/commit/bed48062a64fca524156d76… https://github.com/the-tcpdump-group/tcpdump/commit/7039327875525278d17edee… https://github.com/hackerlib/hackerlib-vul/tree/master/tcpdump-vul/global-o… https://github.com/the-tcpdump-group/tcpdump/commit/6f5ba2b651cd9d4b7fa8ee5… https://github.com/the-tcpdump-group/tcpdump/commit/730fc35968c5433b9e2a829… https://github.com/the-tcpdump-group/tcpdump/commit/2b62d1dda41590db29368ec… https://github.com/the-tcpdump-group/tcpdump/commit/4e430c6b0d8b7e77c7abca7… https://github.com/the-tcpdump-group/tcpdump/commit/f76e7feb41a4327d2b09784… https://github.com/the-tcpdump-group/tcpdump/commit/1dcd10aceabbc03bf571ea3… https://github.com/the-tcpdump-group/tcpdump/commit/19d25dd8781620cd41bf178… https://github.com/the-tcpdump-group/tcpdump/commit/f96003b21e2abfbba59b926… https://github.com/the-tcpdump-group/tcpdump/commit/c6e0531b5def26ecf912e8d… https://github.com/the-tcpdump-group/tcpdump/commit/0318fa8b61bd6c837641129… https://github.com/the-tcpdump-group/tcpdump/commit/de981e6070d168b58ec1bb0… https://github.com/the-tcpdump-group/tcpdump/commit/6ec0c6fa63412c7a07a5bcb… https://github.com/the-tcpdump-group/tcpdump/commit/d17507ffa3e9742199b02a6… https://github.com/the-tcpdump-group/tcpdump/commit/66df248b49095c261138b5a… https://github.com/the-tcpdump-group/tcpdump/commit/7ac73d6cd41e9d4ac0ca7e6… https://github.com/the-tcpdump-group/tcpdump/commit/2ecb9d2c67d9119250c5481… https://github.com/the-tcpdump-group/tcpdump/commit/99798bd9a41bd3d03fdc1e9… https://github.com/the-tcpdump-group/tcpdump/commit/8934a7d6307267d301182f1… https://github.com/the-tcpdump-group/tcpdump/commit/db24063b01cba8e9d4d88b7… https://github.com/the-tcpdump-group/tcpdump/commit/c2ef693866beae071a24b45… https://github.com/the-tcpdump-group/tcpdump/commit/50a44b6b8e4f7c127440dbd… https://github.com/the-tcpdump-group/tcpdump/commit/e942fb84fbe3a73a98a00d2… https://github.com/the-tcpdump-group/tcpdump/commit/b534e304568585707c4a924… https://github.com/the-tcpdump-group/tcpdump/commit/ffde45acf3348f8353fb406… https://github.com/the-tcpdump-group/tcpdump/commit/3a76fd7c95fced2c2f8c814… https://github.com/the-tcpdump-group/tcpdump/commit/6fca58f5f9c96749a575f52… https://github.com/the-tcpdump-group/tcpdump/commit/34cec721d39c76be1e0a600… https://github.com/the-tcpdump-group/tcpdump/commit/979dcefd7b259e9e233f77f… https://github.com/the-tcpdump-group/tcpdump/commit/3b32029db354cbc87512786… https://github.com/the-tcpdump-group/tcpdump/commit/8512734883227c11568bb35… https://github.com/the-tcpdump-group/tcpdump/commit/a7e5f58f402e6919ec444a5… https://github.com/the-tcpdump-group/tcpdump/commit/9be4e0b5938b705e7e36cfc… https://github.com/the-tcpdump-group/tcpdump/commit/7a923447fd49a069a0fd3b6… https://github.com/the-tcpdump-group/tcpdump/commit/cbddb98484ea8ec1deece35… https://github.com/the-tcpdump-group/tcpdump/commit/a25211918f2e790c67d859d… https://github.com/the-tcpdump-group/tcpdump/commit/35d146b7a66496d72cdeb95… https://github.com/the-tcpdump-group/tcpdump/commit/42073d54c53a496be40ae84… https://github.com/the-tcpdump-group/tcpdump/commit/b45a9a167ca6a3ef2752ae9… https://github.com/the-tcpdump-group/tcpdump/commit/cc4a7391c616be7a64ed657… https://github.com/the-tcpdump-group/tcpdump/commit/ca336198e8bebccc18502de… https://github.com/the-tcpdump-group/tcpdump/commit/5edf405d7ed9fc92f4f43e8… https://github.com/the-tcpdump-group/tcpdump/commit/db8c799f6dfc68765c9451f… https://github.com/the-tcpdump-group/tcpdump/commit/877b66b398518d9501513e0… https://github.com/the-tcpdump-group/tcpdump/commit/9f0730bee3eb65d07b49fd4… https://github.com/the-tcpdump-group/tcpdump/commit/8509ef02eceb2bbb479cea1… https://github.com/the-tcpdump-group/tcpdump/commit/13ab8d18617d616c7d34353… https://github.com/the-tcpdump-group/tcpdump/commit/cc356512f512e7fa423b367… https://github.com/the-tcpdump-group/tcpdump/commit/985122081165753c7442bd7… https://github.com/the-tcpdump-group/tcpdump/commit/c177cb3800a9a68d79b2812… https://github.com/the-tcpdump-group/tcpdump/commit/11b426ee05eb62ed1032185… https://github.com/the-tcpdump-group/tcpdump/commit/26a6799b9ca80508c05cac7… https://github.com/the-tcpdump-group/tcpdump/commit/4601c685e7fd19c3724d5e4… https://github.com/the-tcpdump-group/tcpdump/commit/d692d67332bcc90540088ad… https://github.com/the-tcpdump-group/tcpdump/commit/c5dd7bef5e54da5996dc471… https://github.com/the-tcpdump-group/tcpdump/commit/67c7126062d59729cd421bb… https://github.com/the-tcpdump-group/tcpdump/commit/eee0b04bcfdae319c242b0b… https://github.com/the-tcpdump-group/tcpdump/commit/b8e559afaeb8fe0604a1f8e… https://github.com/the-tcpdump-group/tcpdump/commit/2e1f6d9320afa83abc1ff71… https://github.com/the-tcpdump-group/tcpdump/commit/7d3aba9f06899d0128ef46e… https://github.com/the-tcpdump-group/tcpdump/commit/5338aac7b8b880b0c5e0c15… https://github.com/the-tcpdump-group/tcpdump/commit/b20e1639dbac84b3fcb3938… https://github.com/the-tcpdump-group/tcpdump/commit/a77ff09c46560bc895dea11… https://github.com/the-tcpdump-group/tcpdump/commit/66e22961b30547e9a8daa1f… https://github.com/the-tcpdump-group/tcpdump/commit/29e5470e6ab84badbc31f45… https://github.com/the-tcpdump-group/tcpdump/commit/7029d15f148ef24bb7c6668… https://github.com/the-tcpdump-group/tcpdump/commit/5dc1860d8267b1e0cb78c9f… https://github.com/the-tcpdump-group/tcpdump/commit/2d669862df7cd17f5391290… https://github.com/the-tcpdump-group/tcpdump/commit/1bc78d795cd5cad55254986… https://github.com/the-tcpdump-group/tcpdump/commit/ae83295915d08a854de27a8… https://github.com/the-tcpdump-group/tcpdump/commit/da6f1a677bfa4476abaeaf9… https://github.com/the-tcpdump-group/tcpdump/commit/571a6f33f47e7a2394fa08f… https://github.com/the-tcpdump-group/tcpdump/commit/88b2dac837e81cf56dce05e… https://github.com/the-tcpdump-group/tcpdump/commit/2c2cfbd2b771ac888bc5c4a… https://github.com/the-tcpdump-group/tcpdump/commit/7335163a6ef82d46ff18f3e… https://github.com/the-tcpdump-group/tcpdump/commit/e0a5a02b0fc1900a69d6c37… https://github.com/the-tcpdump-group/tcpdump/commit/4c3aee4bb0294c232d56b6d… https://github.com/the-tcpdump-group/tcpdump/commit/f4b9e24c7384d882a7f434c… https://github.com/the-tcpdump-group/tcpdump/commit/39582c04cc5e34054b2936b… https://github.com/the-tcpdump-group/tcpdump/commit/d515b4b4a300479cdf1a6e0… https://github.com/the-tcpdump-group/tcpdump/commit/c2f6833dddecf2d5fb89c9c… https://github.com/the-tcpdump-group/tcpdump/commit/3b36ec4e713dea9266db119… https://github.com/the-tcpdump-group/tcpdump/commit/d10a0f980fe8f9407ab1ffb… https://github.com/the-tcpdump-group/tcpdump/commit/331530a4076c69bbd2e3214… https://github.com/the-tcpdump-group/tcpdump/commit/3c8a2b0e91d8d8947e89384… https://github.com/the-tcpdump-group/tcpdump/commit/aa0858100096a3490edf930… https://github.com/the-tcpdump-group/tcpdump/commit/83c64fce3a5226b080e535f… https://github.com/the-tcpdump-group/tcpdump/commit/289c672020280529fd382f3… https://github.com/the-tcpdump-group/tcpdump/commit/5d340a5ca6e420a70297cdb… https://github.com/the-tcpdump-group/tcpdump/commit/bd4e697ebd6c8457efa8f28… https://github.com/the-tcpdump-group/tcpdump/commit/e6511cc1a950fe1566b2236… https://github.com/the-tcpdump-group/tcpdump/commit/5d0d76e88ee2d3236d7e032… https://github.com/the-tcpdump-group/tcpdump/commit/866c60236c41cea1e1654c8… https://github.com/the-tcpdump-group/tcpdump/commit/a1eefe986065846b6c69dbc… https://github.com/the-tcpdump-group/tcpdump/commit/0cb1b8a434b599b8d636db0… https://github.com/the-tcpdump-group/tcpdump/commit/061e7371a944588f231cb1b… https://github.com/the-tcpdump-group/tcpdump/commit/8dca25d26c7ca2caf613826… https://github.com/the-tcpdump-group/tcpdump/commit/c7c515ee03c285cc5137632… https://github.com/the-tcpdump-group/tcpdump/commit/3c4d7c0ee30a30e5abff3d6… https://security.archlinux.org/CVE-2017-11541 https://security.archlinux.org/CVE-2017-11542 https://security.archlinux.org/CVE-2017-11543 https://security.archlinux.org/CVE-2017-12893 https://security.archlinux.org/CVE-2017-12894 https://security.archlinux.org/CVE-2017-12895 https://security.archlinux.org/CVE-2017-12896 https://security.archlinux.org/CVE-2017-12897 https://security.archlinux.org/CVE-2017-12898 https://security.archlinux.org/CVE-2017-12899 https://security.archlinux.org/CVE-2017-12900 https://security.archlinux.org/CVE-2017-12901 https://security.archlinux.org/CVE-2017-12902 https://security.archlinux.org/CVE-2017-12985 https://security.archlinux.org/CVE-2017-12986 https://security.archlinux.org/CVE-2017-12987 https://security.archlinux.org/CVE-2017-12988 https://security.archlinux.org/CVE-2017-12989 https://security.archlinux.org/CVE-2017-12990 https://security.archlinux.org/CVE-2017-12991 https://security.archlinux.org/CVE-2017-12992 https://security.archlinux.org/CVE-2017-12993 https://security.archlinux.org/CVE-2017-12994 https://security.archlinux.org/CVE-2017-12995 https://security.archlinux.org/CVE-2017-12996 https://security.archlinux.org/CVE-2017-12997 https://security.archlinux.org/CVE-2017-12998 https://security.archlinux.org/CVE-2017-12999 https://security.archlinux.org/CVE-2017-13000 https://security.archlinux.org/CVE-2017-13001 https://security.archlinux.org/CVE-2017-13002 https://security.archlinux.org/CVE-2017-13003 https://security.archlinux.org/CVE-2017-13004 https://security.archlinux.org/CVE-2017-13005 https://security.archlinux.org/CVE-2017-13006 https://security.archlinux.org/CVE-2017-13007 https://security.archlinux.org/CVE-2017-13008 https://security.archlinux.org/CVE-2017-13009 https://security.archlinux.org/CVE-2017-13010 https://security.archlinux.org/CVE-2017-13011 https://security.archlinux.org/CVE-2017-13012 https://security.archlinux.org/CVE-2017-13013 https://security.archlinux.org/CVE-2017-13014 https://security.archlinux.org/CVE-2017-13015 https://security.archlinux.org/CVE-2017-13016 https://security.archlinux.org/CVE-2017-13017 https://security.archlinux.org/CVE-2017-13018 https://security.archlinux.org/CVE-2017-13019 https://security.archlinux.org/CVE-2017-13020 https://security.archlinux.org/CVE-2017-13021 https://security.archlinux.org/CVE-2017-13022 https://security.archlinux.org/CVE-2017-13023 https://security.archlinux.org/CVE-2017-13024 https://security.archlinux.org/CVE-2017-13025 https://security.archlinux.org/CVE-2017-13026 https://security.archlinux.org/CVE-2017-13027 https://security.archlinux.org/CVE-2017-13028 https://security.archlinux.org/CVE-2017-13029 https://security.archlinux.org/CVE-2017-13030 https://security.archlinux.org/CVE-2017-13031 https://security.archlinux.org/CVE-2017-13032 https://security.archlinux.org/CVE-2017-13033 https://security.archlinux.org/CVE-2017-13034 https://security.archlinux.org/CVE-2017-13035 https://security.archlinux.org/CVE-2017-13036 https://security.archlinux.org/CVE-2017-13037 https://security.archlinux.org/CVE-2017-13038 https://security.archlinux.org/CVE-2017-13039 https://security.archlinux.org/CVE-2017-13040 https://security.archlinux.org/CVE-2017-13041 https://security.archlinux.org/CVE-2017-13042 https://security.archlinux.org/CVE-2017-13043 https://security.archlinux.org/CVE-2017-13044 https://security.archlinux.org/CVE-2017-13045 https://security.archlinux.org/CVE-2017-13046 https://security.archlinux.org/CVE-2017-13047 https://security.archlinux.org/CVE-2017-13048 https://security.archlinux.org/CVE-2017-13049 https://security.archlinux.org/CVE-2017-13050 https://security.archlinux.org/CVE-2017-13051 https://security.archlinux.org/CVE-2017-13052 https://security.archlinux.org/CVE-2017-13053 https://security.archlinux.org/CVE-2017-13054 https://security.archlinux.org/CVE-2017-13055 https://security.archlinux.org/CVE-2017-13687 https://security.archlinux.org/CVE-2017-13688 https://security.archlinux.org/CVE-2017-13689 https://security.archlinux.org/CVE-2017-13690 https://security.archlinux.org/CVE-2017-13725

1 0

[arch-security] [ASA-201709-4] linux-hardened: arbitrary code execution
by Levente Polyak 13 Sep '17

13 Sep '17

Arch Linux Security Advisory ASA-201709-4 ========================================= Severity: High Date : 2017-09-13 CVE-ID : CVE-2017-1000251 Package : linux-hardened Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-395 Summary ======= The package linux-hardened before version 4.13.1.b-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.13.1.b-1. # pacman -Syu "linux-hardened>=4.13.1.b-1" The problem has been fixed upstream in version 4.13.1.b. Workaround ========== None. Description =========== A stack buffer overflow flaw was found in the way the Bluetooth subsystem of the Linux kernel processed pending L2CAP configuration responses from a client. On systems with the stack protection feature enabled in the kernel (CONFIG_CC_STACKPROTECTOR=y, which is enabled on all architectures), an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to crash the system. Due to the nature of the stack protection feature, code execution cannot be fully ruled out, although it is unlikely. On systems without the stack protection feature, an unauthenticated attacker able to initiate a connection to a system via Bluetooth could use this flaw to remotely execute arbitrary code on the system with ring 0 (kernel) privileges. Impact ====== An unauthenticated attacker able to initiate a connection via Bluetooth is able to crash the system or possibly execute arbitrary code. References ========== https://bugs.archlinux.org/task/55602 https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 https://www.armis.com/blueborne/ https://security.archlinux.org/CVE-2017-1000251

1 0

[arch-security] [ASA-201709-3] bluez: information disclosure
by Levente Polyak 13 Sep '17

13 Sep '17

Arch Linux Security Advisory ASA-201709-3 ========================================= Severity: High Date : 2017-09-12 CVE-ID : CVE-2017-1000250 Package : bluez Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-396 Summary ======= The package bluez before version 5.46-2 is vulnerable to information disclosure. Resolution ========== Upgrade to 5.46-2. # pacman -Syu "bluez>=5.46-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== An information-disclosure flaw was found in the bluetoothd implementation of the Service Discovery Protocol (SDP). A specially crafted Bluetooth device could, without prior pairing or user interaction, retrieve portions of the bluetoothd process memory, including potentially sensitive information such as Bluetooth encryption keys. Impact ====== A remote attacker is able to use a specially crafted Bluetooth device to obtain sensitive information such as Bluetooth encryption keys. References ========== https://bugs.archlinux.org/task/55603 https://www.armis.com/blueborne/ http://pkgs.fedoraproject.org/cgit/rpms/bluez.git/plain/0010-Out-of-bounds-… https://security.archlinux.org/CVE-2017-1000250

1 0

[arch-security] [ASA-201709-2] postgresql: multiple issues
by Levente Polyak 06 Sep '17

06 Sep '17

Arch Linux Security Advisory ASA-201709-2 ========================================= Severity: High Date : 2017-09-06 CVE-ID : CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 Package : postgresql Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-381 Summary ======= The package postgresql before version 9.6.4-1 is vulnerable to multiple issues including information disclosure, access restriction bypass and authentication bypass. Resolution ========== Upgrade to 9.6.4-1. # pacman -Syu "postgresql>=9.6.4-1" The problems have been fixed upstream in version 9.6.4. Workaround ========== None. Description =========== - CVE-2017-7546 (authentication bypass) It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. - CVE-2017-7547 (information disclosure) An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on foreign servers. A remote authenticated attacker could potentially use this flaw to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. - CVE-2017-7548 (access restriction bypass) An authorization flaw was found in the way PostgreSQL handled large objects. A remote authenticated attacker with no privileges on a large object could potentially use this flaw to overwrite the entire content of the object, thus resulting in denial of service. Impact ====== A remote unauthenticated attacker is be able to gain access to database accounts with empty passwords. Additionally a remote authenticated user may be able to perform a denial of service attack or retrieve passwords from the user mappings. References ========== https://www.postgresql.org/about/news/1772/ https://github.com/postgres/postgres/commit/d5d46d99ba47f https://github.com/postgres/postgres/commit/b6e39ca92eeee4 https://github.com/postgres/postgres/commit/f1cda6d6cbb2 https://security.archlinux.org/CVE-2017-7546 https://security.archlinux.org/CVE-2017-7547 https://security.archlinux.org/CVE-2017-7548

1 0