- Arch-security - lists.archlinux.org

[arch-security] [ASA-201707-15] apache: multiple issues
by Remi Gacogne 14 Jul '17

14 Jul '17

Arch Linux Security Advisory ASA-201707-15 ========================================== Severity: Critical Date : 2017-07-14 CVE-ID : CVE-2017-9788 CVE-2017-9789 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-350 Summary ======= The package apache before version 2.4.27-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2.4.27-1. # pacman -Syu "apache>=2.4.27-1" The problems have been fixed upstream in version 2.4.27. Workaround ========== None. Description =========== - CVE-2017-9788 (information disclosure) A security issue has been found in apache's mod_auth_digest <= 2.4.26, leading to information disclosure or denial of service. The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault. - CVE-2017-9789 (arbitrary code execution) A security issue has been found in apache's mod_http2 <= 2.4.26. When under stress, closing many connections, the HTTP/2 handling code would sometimes access memory after it has been freed, resulting in potentially erratic behaviour. Impact ====== A remote attacker could access sensitive information if mod_auth_digest is enabled, or be able to execute arbitrary code on the affected host if mod_http2 is enabled. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://security.archlinux.org/CVE-2017-9788 https://security.archlinux.org/CVE-2017-9789

1 0

[arch-security] [ASA-201707-14] evince: arbitrary command execution
by Remi Gacogne 14 Jul '17

14 Jul '17

Arch Linux Security Advisory ASA-201707-14 ========================================== Severity: Critical Date : 2017-07-14 CVE-ID : CVE-2017-1000083 Package : evince Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-348 Summary ======= The package evince before version 3.24.0+12+g717df38f-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.24.0+12+g717df38f-1. # pacman -Syu "evince>=3.24.0+12+g717df38f-1" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The comic book backend in evince <= 3.24.0 is vulnerable to a command injection bug that can be used to execute arbitrary commands when a cbt file is opened. CBT files are simple tar archives containing images. When a cbt file is processed, evince calls "tar -xOf $archive $filename" for every image file in the archive. While both the archive name and the filename are quoted to not be interpreted by the shell, the filename is completely attacker controlled an can start with "--" which leads to tar interpreting it as a command line flag. This can be exploited by creating a tar archive with an embedded file named something like this: "--checkpoint-action=exec=bash -c 'touch ~/covfefe.evince;'.jpg" This can presumably be triggered by the evince thumbnailer, which is not sandboxed, and web browsers that allow untrusted websites to auto- downloading files without user interaction (Chrome, Epiphany) can trigger the thumbnailer to run so this is web exposed. Impact ====== A remote attacker can execute arbitrary command on the affected host by convincing the user to download a crafted CBT file. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=784630 https://git.gnome.org/browse/evince/commit/?h=gnome-3-24&id=717df38fd8509bf… https://security.archlinux.org/CVE-2017-1000083

1 0

[arch-security] [ASA-201707-13] irssi: multiple issues
by Remi Gacogne 13 Jul '17

13 Jul '17

Arch Linux Security Advisory ASA-201707-13 ========================================== Severity: Critical Date : 2017-07-13 CVE-ID : CVE-2017-10965 CVE-2017-10966 Package : irssi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-342 Summary ======= The package irssi before version 1.0.4-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.0.4-1. # pacman -Syu "irssi>=1.0.4-1" The problems have been fixed upstream in version 1.0.4. Workaround ========== None. Description =========== - CVE-2017-10965 (denial of service) When receiving messages with invalid time stamps, Irssi would try to dereference a NULL pointer. This requires control over the IRC server, or a position of man-in-the-middle to be exploited. - CVE-2017-10966 (arbitrary code execution) While updating the internal nick list, Irssi may incorrectly use the GHashTable interface and free the nick while updating it. This will then result in use-after-free conditions on each access of the hash table. Note that this should not happen with a conforming IRC server, so it requires control over the IRC server or a position of man-in-the- middle to be exploitable. Impact ====== A remote attacker in position of man-in-the-middle or controlling the IRC server might be able to crash or execute arbitrary code on an affected host. References ========== https://github.com/irssi/irssi/commit/5e26325317c72a04c1610ad952974e206384d… https://irssi.org/security/irssi_sa_2017_07.txt https://security.archlinux.org/CVE-2017-10965 https://security.archlinux.org/CVE-2017-10966

1 0

[arch-security] [ASA-201707-12] nginx-mainline: information disclosure
by Remi Gacogne 12 Jul '17

12 Jul '17

Arch Linux Security Advisory ASA-201707-12 ========================================== Severity: High Date : 2017-07-12 CVE-ID : CVE-2017-7529 Package : nginx-mainline Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-346 Summary ======= The package nginx-mainline before version 1.13.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.13.3-1. # pacman -Syu "nginx-mainline>=1.13.3-1" The problem has been fixed upstream in version 1.13.3. Workaround ========== None. Description =========== A security issue was identified in the range filter module of nginx < 1.13.3. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak. When using nginx with standard modules this allows an attacker to obtain a cache file header if a response was returned from cache. In some configurations a cache file header may contain IP address of the backend server or other sensitive information. Besides, with 3rd party modules it is potentially possible that the issue may lead to a denial of service or a disclosure of a worker process memory. No such modules are currently known though. Impact ====== A remote attacker can access sensitive information by sending a specially crafted request. References ========== http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html https://nginx.org/download/patch.2017.ranges.txt https://security.archlinux.org/CVE-2017-7529

1 0

[arch-security] [ASA-201707-11] nginx: information disclosure
by Remi Gacogne 12 Jul '17

12 Jul '17

Arch Linux Security Advisory ASA-201707-11 ========================================== Severity: High Date : 2017-07-12 CVE-ID : CVE-2017-7529 Package : nginx Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-345 Summary ======= The package nginx before version 1.12.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.12.1-1. # pacman -Syu "nginx>=1.12.1-1" The problem has been fixed upstream in version 1.12.1. Workaround ========== None. Description =========== A security issue was identified in the range filter module of nginx < 1.13.3. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak. When using nginx with standard modules this allows an attacker to obtain a cache file header if a response was returned from cache. In some configurations a cache file header may contain IP address of the backend server or other sensitive information. Besides, with 3rd party modules it is potentially possible that the issue may lead to a denial of service or a disclosure of a worker process memory. No such modules are currently known though. Impact ====== A remote attacker can access sensitive information by sending a specially crafted request. References ========== http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html https://nginx.org/download/patch.2017.ranges.txt https://security.archlinux.org/CVE-2017-7529

1 0

[arch-security] [ASA-201707-10] flashplugin: multiple issues
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-10 ========================================== Severity: Critical Date : 2017-07-11 CVE-ID : CVE-2017-3080 CVE-2017-3099 CVE-2017-3100 Package : flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-344 Summary ======= The package flashplugin before version 26.0.0.137-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 26.0.0.137-1. # pacman -Syu "flashplugin>=26.0.0.137-1" The problems have been fixed upstream in version 26.0.0.137. Workaround ========== None. Description =========== - CVE-2017-3080 (information disclosure) A security issue leading to information disclosure has been found in Adobe Flash Player < 26.0.0.137. - CVE-2017-3099 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.137. - CVE-2017-3100 (information disclosure) A memory corruption vulnerability leading to the disclosure of a memory address has been found in Adobe Flash Player < 26.0.0.137. It could be used to bypass some security protections like ASLR. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-21.html https://security.archlinux.org/CVE-2017-3080 https://security.archlinux.org/CVE-2017-3099 https://security.archlinux.org/CVE-2017-3100

1 0

[arch-security] [ASA-201707-9] lib32-flashplugin: multiple issues
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-9 ========================================= Severity: Critical Date : 2017-07-11 CVE-ID : CVE-2017-3080 CVE-2017-3099 CVE-2017-3100 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-343 Summary ======= The package lib32-flashplugin before version 26.0.0.137-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 26.0.0.137-1. # pacman -Syu "lib32-flashplugin>=26.0.0.137-1" The problems have been fixed upstream in version 26.0.0.137. Workaround ========== None. Description =========== - CVE-2017-3080 (information disclosure) A security issue leading to information disclosure has been found in Adobe Flash Player < 26.0.0.137. - CVE-2017-3099 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.137. - CVE-2017-3100 (information disclosure) A memory corruption vulnerability leading to the disclosure of a memory address has been found in Adobe Flash Player < 26.0.0.137. It could be used to bypass some security protections like ASLR. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-21.html https://security.archlinux.org/CVE-2017-3080 https://security.archlinux.org/CVE-2017-3099 https://security.archlinux.org/CVE-2017-3100

1 0

[arch-security] [ASA-201707-8] tor: session hijacking
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-8 ========================================= Severity: Medium Date : 2017-07-11 CVE-ID : CVE-2017-0377 Package : tor Type : session hijacking Remote : Yes Link : https://security.archlinux.org/AVG-336 Summary ======= The package tor before version 0.3.0.9-1 is vulnerable to session hijacking. Resolution ========== Upgrade to 0.3.0.9-1. # pacman -Syu "tor>=0.3.0.9-1" The problem has been fixed upstream in version 0.3.0.9. Workaround ========== None. Description =========== A security issue has been found in Tor <= 0.3.0.8, which could make it easier to eavesdrop on Tor users' traffic. When choosing which guard to use for a circuit, Tor avoids using a node that is in the same family that the exit node it selected, but this check was accidentally removed in 0.3.0. Impact ====== An attacker might be able to eavesdrop on Tor users' traffic by getting in a position to analyze both the incoming and outgoing traffic of a circuit. References ========== https://blog.torproject.org/blog/tor-0309-released-security-update-clients https://trac.torproject.org/projects/tor/ticket/22753 https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548… https://security.archlinux.org/CVE-2017-0377

1 0

[arch-security] [ASA-201707-7] libdwarf: denial of service
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-7 ========================================= Severity: Low Date : 2017-07-11 CVE-ID : CVE-2017-9998 Package : libdwarf Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-332 Summary ======= The package libdwarf before version 20170709-1 is vulnerable to denial of service. Resolution ========== Upgrade to 20170709-1. # pacman -Syu "libdwarf>=20170709-1" The problem has been fixed upstream in version 20170709. Workaround ========== None. Description =========== The _dwarf_decode_s_leb128_chk function in dwarf_leb.c in libdwarf through 2017-06-28 allows attackers to cause a denial of service (Segmentation fault) via a crafted file. Impact ====== An attacker can cause a denial of service by tricking a local user into submitting a crafted file to a program linked against libdwarf. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1465756 https://security.archlinux.org/CVE-2017-9998

1 0

[arch-security] [ASA-201707-6] lib32-gnutls: denial of service
by Remi Gacogne 11 Jul '17

11 Jul '17

Arch Linux Security Advisory ASA-201707-6 ========================================= Severity: Medium Date : 2017-07-11 CVE-ID : CVE-2017-7507 Package : lib32-gnutls Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-295 Summary ======= The package lib32-gnutls before version 3.5.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.5.13-1. # pacman -Syu "lib32-gnutls>=3.5.13-1" The problem has been fixed upstream in version 3.5.13. Workaround ========== None. Description =========== GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contents. This could lead to a crash of the GnuTLS server application. Impact ====== A remote attacker can crash a vulnerable TLS server by sending a crafted status_request extension in a ClientHello message. References ========== https://www.gnutls.org/security.html#GNUTLS-SA-2017-4 https://bugzilla.redhat.com/show_bug.cgi?id=1454621 https://security.archlinux.org/CVE-2017-7507

1 0