- Arch-security - lists.archlinux.org

[arch-security] [ASA-201707-25] webkit2gtk: multiple issues
by Remi Gacogne 26 Jul '17

26 Jul '17

Arch Linux Security Advisory ASA-201707-25 ========================================== Severity: Critical Date : 2017-07-26 CVE-ID : CVE-2017-7018 CVE-2017-7030 CVE-2017-7034 CVE-2017-7037 CVE-2017-7039 CVE-2017-7046 CVE-2017-7048 CVE-2017-7055 CVE-2017-7056 CVE-2017-7061 CVE-2017-7064 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-362 Summary ======= The package webkit2gtk before version 2.16.6-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2.16.6-1. # pacman -Syu "webkit2gtk>=2.16.6-1" The problems have been fixed upstream in version 2.16.6. Workaround ========== None. Description =========== - CVE-2017-7018 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7030 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7034 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7037 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7039 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7046 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7048 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7055 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7056 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7061 (arbitrary code execution) Several memory corruption issues have been found in WebKitGTK+ <= 2.16.5, leading to arbitrary code execution when processing maliciously crafted web contents. - CVE-2017-7064 (information disclosure) An information disclosure issue has been found in WebKitGTK+ <= 2.16.5, where an application may be able to read restricted memory. Impact ====== A remote attacker might be able to access sensitive information or execute arbitrary code on the affected host. References ========== https://webkitgtk.org/security/WSA-2017-0006.html https://security.archlinux.org/CVE-2017-7018 https://security.archlinux.org/CVE-2017-7030 https://security.archlinux.org/CVE-2017-7034 https://security.archlinux.org/CVE-2017-7037 https://security.archlinux.org/CVE-2017-7039 https://security.archlinux.org/CVE-2017-7046 https://security.archlinux.org/CVE-2017-7048 https://security.archlinux.org/CVE-2017-7055 https://security.archlinux.org/CVE-2017-7056 https://security.archlinux.org/CVE-2017-7061 https://security.archlinux.org/CVE-2017-7064

1 0

[arch-security] [ASA-201707-24] rkhunter: arbitrary code execution
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-24 ========================================== Severity: High Date : 2017-07-18 CVE-ID : CVE-2017-7480 Package : rkhunter Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-334 Summary ======= The package rkhunter before version 1.4.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.4.4-1. # pacman -Syu "rkhunter>=1.4.4-1" The problem has been fixed upstream in version 1.4.4. Workaround ========== None. Description =========== rkhunter downloads updates over a plain HTTP link with a version certificate that can be faked. A potential man-in-the-middle attack can lead to the execution of arbitrary code. Impact ====== A remote attacker in position of man-in-the-middle is able to execute arbitrary code by injecting a malicious update. References ========== http://openwall.com/lists/oss-security/2017/06/29/2 https://security.archlinux.org/CVE-2017-7480

1 0

[arch-security] [ASA-201707-23] freeradius: multiple issues
by Remi Gacogne 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-23 ========================================== Severity: Critical Date : 2017-07-18 CVE-ID : CVE-2017-10978 CVE-2017-10983 CVE-2017-10984 CVE-2017-10985 CVE-2017-10986 CVE-2017-10987 Package : freeradius Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-357 Summary ======= The package freeradius before version 3.0.15-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 3.0.15-1. # pacman -Syu "freeradius>=3.0.15-1" The problems have been fixed upstream in version 3.0.15. Workaround ========== None. Description =========== - CVE-2017-10978 (denial of service) A security issue has been found in freeradius <= 3.0.15, where the make_secret() function does not properly check for output buffer size before writing data. A remote attacker with the ability to send packets which are accepted by the server can perform a read or write overflow of up to 16 octets, causing a denial of service. - CVE-2017-10983 (denial of service) A security issue has been found in freeradius <= 3.0.15, where the fr_dhcp_decode() function performed a strcmp() on binary data in an internal data structure, instead of checking the length of the option and doing a memcmp. A remote attacker with the ability to send packets which are accepted by the server can make the server read its memory until it reaches a zero byte or crashes, causing a denial of service. - CVE-2017-10984 (arbitrary code execution) A security issue has been found in freeradius <= 3.0.15, where the data2vp_wimax() function checks for WiMAX attributes which are too small, but it does not check for WiMAX attributes which are too large. As a result, the server can be convinced to read past the end of an attribute, and to write past the end of memory allocated via malloc(). A remote attacker with the ability to send packets which are accepted by the server can cause a write overflow, possibly leading to remote code execution. - CVE-2017-10985 (denial of service) A security issue has been found in freeradius <= 3.0.15, where the server could go into an infinite loop and exhaust memory when it receives zero-length attributes marked 'concat' in the dictionaries. - CVE-2017-10986 (denial of service) A security issue has been found in freeradius <= 3.0.15, where the dhcp_attr2vp() function, when decoding "string" options in an array, could be convinced to call memchr() with a length argument of -1. This could result in an over-read until the first zero octet was found, or a page fault occurred. - CVE-2017-10987 (denial of service) A security issue has been found in freeradius <= 3.0.15, where the fr_dhcp_decode_suboptions() function does not properly check if sub- options overflow the packet. Impact ====== A remote attacker with the ability to send packets which are accepted by the server can cause a denial of service or execute arbitrary code on the affected host via a crafted packet. References ========== http://freeradius.org/security/fuzzer-2017.html http://freeradius.org/security/fuzzer-2017.html#FR-GV-201 https://github.com/FreeRADIUS/freeradius-server/commit/38ee90f2a5a28dc5887a… https://github.com/FreeRADIUS/freeradius-server/commit/fc8662d7e827f630d515… http://freeradius.org/security/fuzzer-2017.html#FR-GV-206 https://github.com/FreeRADIUS/freeradius-server/commit/5759b20af99af6d30924… http://freeradius.org/security/fuzzer-2017.html#FR-GV-301 https://github.com/FreeRADIUS/freeradius-server/commit/931850e5d2f65193520c… http://freeradius.org/security/fuzzer-2017.html#FR-GV-302 https://github.com/FreeRADIUS/freeradius-server/commit/6726c16549b131ed39f6… http://freeradius.org/security/fuzzer-2017.html#FR-GV-303 https://github.com/FreeRADIUS/freeradius-server/commit/21e2e95751bfb54c0fb0… http://freeradius.org/security/fuzzer-2017.html#FR-GV-304 https://github.com/FreeRADIUS/freeradius-server/commit/19a18bf7c8af649c9e97… https://security.archlinux.org/CVE-2017-10978 https://security.archlinux.org/CVE-2017-10983 https://security.archlinux.org/CVE-2017-10984 https://security.archlinux.org/CVE-2017-10985 https://security.archlinux.org/CVE-2017-10986 https://security.archlinux.org/CVE-2017-10987

1 0

[arch-security] [ASA-201707-22] vim: arbitrary code execution
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-22 ========================================== Severity: High Date : 2017-07-18 CVE-ID : CVE-2017-11109 Package : vim Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-347 Summary ======= The package vim before version 8.0.0722-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.0.0722-1. # pacman -Syu "vim>=8.0.0722-1" The problem has been fixed upstream in version 8.0.0722. Workaround ========== None. Description =========== Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. Impact ====== An attacker is able to execute arbitrary code by tricking a user to locally execute a specially crafted vim source file. References ========== https://bugs.archlinux.org/task/54773 https://bugzilla.redhat.com/show_bug.cgi?id=1468492 https://www.mail-archive.com/vim_dev%40googlegroups.com/msg45274.html https://security.archlinux.org/CVE-2017-11109

1 0

[arch-security] [ASA-201707-21] c-ares: information disclosure
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-21 ========================================== Severity: Medium Date : 2017-07-18 CVE-ID : CVE-2017-1000381 Package : c-ares Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-315 Summary ======= The package c-ares before version 1.13.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.13.0-1. # pacman -Syu "c-ares>=1.13.0-1" The problem has been fixed upstream in version 1.13.0. Workaround ========== None. Description =========== A out-of-bounds read has been found in c-ares < 1.13.0. The ares_parse_naptr_reply() function, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. Impact ====== A remote attacker might be able to access sensitive information by responding to a DNS query with a crafted response packet. References ========== https://c-ares.haxx.se/adv_20170620.html https://security.archlinux.org/CVE-2017-1000381

1 0

[arch-security] [ASA-201707-20] pcre: multiple issues
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-20 ========================================== Severity: Medium Date : 2017-07-18 CVE-ID : CVE-2017-7186 CVE-2017-7244 CVE-2017-7245 CVE-2017-7246 Package : pcre Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-222 Summary ======= The package pcre before version 8.41-1 is vulnerable to multiple issues including denial of service and arbitrary code execution. Resolution ========== Upgrade to 8.41-1. # pacman -Syu "pcre>=8.41-1" The problems have been fixed upstream in version 8.41. Workaround ========== None. Description =========== - CVE-2017-7186 (denial of service) libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup. - CVE-2017-7244 (denial of service) A stack-based read buffer overflow has been found in libpcre <= 8.40, in the pcretest utility. It can lead to denial of service via a crafted expression passed to the pcretest command. - CVE-2017-7245 (arbitrary code execution) A stack-based write buffer overflow has been found in libpcre <= 8.40, in the pcretest utility. It can lead to arbitrary code execution via a crafted expression passed to the pcretest command. - CVE-2017-7246 (arbitrary code execution) A stack-based write buffer overflow has been found in libpcre <= 8.40, in the pcretest utility. It can lead to arbitrary code execution via a crafted expression passed to the pcretest command. Impact ====== An attacker can execute arbitrary code on the affected host by tricking a user into passing a crafted expression to the pcretest command. A remote attacker can cause a denial of service against an application using libpcre via a crafted expression. References ========== https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-over… https://blogs.gentoo.org/ago/2017/03/20/libpcre-invalid-memory-read-in-_pcr… https://bugs.exim.org/show_bug.cgi?id=2052 https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-matc… https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&so… https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=… https://security.archlinux.org/CVE-2017-7186 https://security.archlinux.org/CVE-2017-7244 https://security.archlinux.org/CVE-2017-7245 https://security.archlinux.org/CVE-2017-7246

1 0

[arch-security] [ASA-201707-19] gvim: arbitrary code execution
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-19 ========================================== Severity: High Date : 2017-07-18 CVE-ID : CVE-2017-11109 Package : gvim Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-347 Summary ======= The package gvim before version 8.0.0722-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.0.0722-1. # pacman -Syu "gvim>=8.0.0722-1" The problem has been fixed upstream in version 8.0.0722. Workaround ========== None. Description =========== Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file. Impact ====== An attacker is able to execute arbitrary code by tricking a user to locally execute a specially crafted vim source file. References ========== https://bugs.archlinux.org/task/54773 https://bugzilla.redhat.com/show_bug.cgi?id=1468492 https://www.mail-archive.com/vim_dev%40googlegroups.com/msg45274.html https://security.archlinux.org/CVE-2017-11109

1 0

[arch-security] [ASA-201707-18] lib32-libtiff: arbitrary code execution
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-18 ========================================== Severity: Critical Date : 2017-07-18 CVE-ID : CVE-2015-7554 CVE-2016-10095 Package : lib32-libtiff Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-87 Summary ======= The package lib32-libtiff before version 4.0.8-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.0.8-1. # pacman -Syu "lib32-libtiff>=4.0.8-1" The problems have been fixed upstream in version 4.0.8. Workaround ========== None. Description =========== - CVE-2015-7554 (arbitrary code execution) An Invalid memory write flaw was found in libtiff in the way it parsed certain extension tags when reading TIFF format files. An attacker could use this flaw to crash or even execute arbitrary code with the permission of the user running such an application compiled against libtiff. - CVE-2016-10095 (arbitrary code execution) A stack-based buffer overflow vulnerability was found in libtiff, in the _TIFFVGetField function in tif_dir.c, when running tiffslpit on crafted tiff file. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted TIFF file. References ========== https://bugs.archlinux.org/task/54842 http://seclists.org/oss-sec/2015/q4/590 http://bugzilla.maptools.org/show_bug.cgi?id=2564 http://seclists.org/oss-sec/2017/q1/10 https://blogs.gentoo.org/ago/2017/01/01/libtiff-stack-based-buffer-overflow… https://security.archlinux.org/CVE-2015-7554 https://security.archlinux.org/CVE-2016-10095

1 0

[arch-security] [ASA-201707-17] libtiff: arbitrary code execution
by Levente Polyak 18 Jul '17

18 Jul '17

Arch Linux Security Advisory ASA-201707-17 ========================================== Severity: Critical Date : 2017-07-18 CVE-ID : CVE-2015-7554 CVE-2016-10095 Package : libtiff Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-5 Summary ======= The package libtiff before version 4.0.8-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.0.8-2. # pacman -Syu "libtiff>=4.0.8-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-7554 (arbitrary code execution) An Invalid memory write flaw was found in libtiff in the way it parsed certain extension tags when reading TIFF format files. An attacker could use this flaw to crash or even execute arbitrary code with the permission of the user running such an application compiled against libtiff. - CVE-2016-10095 (arbitrary code execution) A stack-based buffer overflow vulnerability was found in libtiff, in the _TIFFVGetField function in tif_dir.c, when running tiffslpit on crafted tiff file. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted TIFF file. References ========== https://bugs.archlinux.org/task/54842 http://seclists.org/oss-sec/2015/q4/590 http://bugzilla.maptools.org/show_bug.cgi?id=2564 http://seclists.org/oss-sec/2017/q1/10 https://blogs.gentoo.org/ago/2017/01/01/libtiff-stack-based-buffer-overflow… https://security.archlinux.org/CVE-2015-7554 https://security.archlinux.org/CVE-2016-10095

1 0

[arch-security] [ASA-201707-16] mosquitto: information disclosure
by Jelle van der Waa 16 Jul '17

16 Jul '17

Arch Linux Security Advisory ASA-201707-16 ========================================== Severity: Medium Date : 2017-07-16 CVE-ID : CVE-2017-9868 Package : mosquitto Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-353 Summary ======= The package mosquitto before version 1.4.14-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.4.14-1. # pacman -Syu "mosquitto>=1.4.14-1" The problem has been fixed upstream in version 1.4.14. Workaround ========== None. Description =========== In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information. Impact ====== A local attacker could access sensitive information by reading the mosquitto.db. References ========== https://mosquitto.org/2017/06/security-advisory-cve-2017-9868/ https://security.archlinux.org/CVE-2017-9868

1 0