- Arch-security - lists.archlinux.org

[arch-security] [ASA-201707-5] systemd: denial of service
by Remi Gacogne 04 Jul '17

04 Jul '17

Arch Linux Security Advisory ASA-201707-5 ========================================= Severity: Medium Date : 2017-07-04 CVE-ID : CVE-2017-9217 Package : systemd Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-337 Summary ======= The package systemd before version 233-7 is vulnerable to denial of service. Resolution ========== Upgrade to 233-7. # pacman -Syu "systemd>=233-7" The problem has been fixed upstream in version 233. Workaround ========== None. Description =========== A security issue has been found in systemd-resolved, allowing a remote attacker to cause a denial of service (daemon crash via NULL-pointer dereference) via a crafted DNS response with an empty question section. Impact ====== A remote attacker can cause a denial of service via a crafted DNS response. References ========== https://github.com/systemd/systemd/commit/262d95fecd357343887709006188f690c… https://github.com/systemd/systemd/pull/6020 https://security.archlinux.org/CVE-2017-9217

1 0

[arch-security] [ASA-201707-4] qt5-webengine: multiple issues
by Remi Gacogne 04 Jul '17

04 Jul '17

Arch Linux Security Advisory ASA-201707-4 ========================================= Severity: Critical Date : 2017-07-04 CVE-ID : CVE-2017-5070 CVE-2017-5071 CVE-2017-5075 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5083 CVE-2017-5088 CVE-2017-5089 Package : qt5-webengine Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-339 Summary ======= The package qt5-webengine before version 5.9.1-1 is vulnerable to multiple issues including arbitrary code execution, arbitrary command execution, information disclosure and content spoofing. Resolution ========== Upgrade to 5.9.1-1. # pacman -Syu "qt5-webengine>=5.9.1-1" The problems have been fixed upstream in version 5.9.1. Workaround ========== None. Description =========== - CVE-2017-5070 (arbitrary code execution) A type confusion flaw has been found in the V8 component of the Chromium browser. - CVE-2017-5071 (information disclosure) An out of bounds read flaw has been found in the V8 component of the Chromium browser. - CVE-2017-5075 (information disclosure) An information leak flaw has been found in the CSP reporting component of the Chromium browser. - CVE-2017-5076 (content spoofing) An address spoofing flaw has been found in the Omnibox component of the Chromium browser. - CVE-2017-5077 (arbitrary code execution) A heap buffer overflow flaw was found in the Skia component of the Chromium browser. - CVE-2017-5078 (arbitrary command execution) A possible command injection flaw has been found in the mailto handling component of the Chromium browser. - CVE-2017-5079 (content spoofing) A UI spoofing flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5083 (content spoofing) A UI spoofing flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5088 (information disclosure) An out-of-bounds read vulnerability has been found in the V8 component of the Chromium browser < 59.0.3071.104. - CVE-2017-5089 (content spoofing) A domain spoofing vulnerability has been found in the Omnibox component of the Chromium browser < 59.0.3071.104. Impact ====== A remote attacker can access sensitive information, spoof content and execute arbitrary code and commands on the affected host. References ========== https://github.com/qt/qtwebengine/blob/5.9.1/dist/changes-5.9.1 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=722756 https://bugs.chromium.org/p/chromium/issues/detail?id=715582 https://bugs.chromium.org/p/chromium/issues/detail?id=678776 https://bugs.chromium.org/p/chromium/issues/detail?id=719199 https://bugs.chromium.org/p/chromium/issues/detail?id=716311 https://bugs.chromium.org/p/chromium/issues/detail?id=711020 https://bugs.chromium.org/p/chromium/issues/detail?id=713686 https://bugs.chromium.org/p/chromium/issues/detail?id=714849 https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=729991 https://bugs.chromium.org/p/chromium/issues/detail?id=714196 https://security.archlinux.org/CVE-2017-5070 https://security.archlinux.org/CVE-2017-5071 https://security.archlinux.org/CVE-2017-5075 https://security.archlinux.org/CVE-2017-5076 https://security.archlinux.org/CVE-2017-5077 https://security.archlinux.org/CVE-2017-5078 https://security.archlinux.org/CVE-2017-5079 https://security.archlinux.org/CVE-2017-5083 https://security.archlinux.org/CVE-2017-5088 https://security.archlinux.org/CVE-2017-5089

1 0

[arch-security] [ASA-201707-3] bind: access restriction bypass
by Remi Gacogne 04 Jul '17

04 Jul '17

Arch Linux Security Advisory ASA-201707-3 ========================================= Severity: High Date : 2017-07-04 CVE-ID : CVE-2017-3142 CVE-2017-3143 Package : bind Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-335 Summary ======= The package bind before version 9.11.1.P2-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 9.11.1.P2-1. # pacman -Syu "bind>=9.11.1.P2-1" The problems have been fixed upstream in version 9.11.1.P2. Workaround ========== None. Description =========== - CVE-2017-3142 (access restriction bypass) An error in TSIG authentication has been found in Bind <= 9.11.1-P1, allowing a remote attacker to bypass authentication in order to perform unauthorized zone transfers or forge NOTIFY packets. The attacker needs to have knowledge of the key name, and should be allowed by the other ACL restrictions if any. - CVE-2017-3143 (access restriction bypass) An error in TSIG authentication has been found in Bind <= 9.11.1-P1, allowing a remote attacker to bypass authentication in order to perform unauthorized zone updates, altering the content of the zone. The attacker needs to have knowledge of the key name, and should be allowed by the other ACL restrictions if any. Impact ====== A remote attacker can bypass authentication in order to retrieve or update the content of a zone. References ========== https://kb.isc.org/article/AA-01504/74/CVE-2017-3142%3A-An-error-in-TSIG-au… https://kb.isc.org/article/AA-01503/74/CVE-2017-3143%3A-An-error-in-TSIG-au… https://security.archlinux.org/CVE-2017-3142 https://security.archlinux.org/CVE-2017-3143

1 0

[arch-security] [ASA-201707-2] systemd: arbitrary code execution
by Christian Rebischke 03 Jul '17

03 Jul '17

Arch Linux Security Advisory ASA-201707-2 ========================================= Severity: Critical Date : 2017-07-03 CVE-ID : CVE-2017-9445 Package : systemd Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-329 Summary ======= The package systemd before version 233-6 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 233-6. # pacman -Syu "systemd>=233-6" The problem has been fixed upstream in version 233. Workaround ========== None. Description =========== An out-of-bounds write was discovered in systemd-resolved when handling specially crafted DNS responses. A remote attacker could potentially exploit this to cause a denial of service (daemon crash) or execute arbitrary code. Impact ====== A remote attacker is able to craft a malicious DNS response to crash systemd-resolved or execute arbitrary code on the target host. References ========== https://bugs.archlinux.org/task/54619 http://seclists.org/oss-sec/2017/q2/618 https://security.archlinux.org/CVE-2017-9445

1 0

[arch-security] [ASA-201707-1] libgcrypt: private key recovery
by Remi Gacogne 03 Jul '17

03 Jul '17

Arch Linux Security Advisory ASA-201707-1 ========================================= Severity: High Date : 2017-07-03 CVE-ID : CVE-2017-7526 Package : libgcrypt Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-338 Summary ======= The package libgcrypt before version 1.7.8-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1.7.8-1. # pacman -Syu "libgcrypt>=1.7.8-1" The problem has been fixed upstream in version 1.7.8. Workaround ========== None. Description =========== The pattern of squarings and multiplications in left-to-right sliding windows in libgcrypt <= 1.7.7 leaks significant information about exponent bits, allowing for the very efficient recovery of a full 1024-bit RSA key. Impact ====== A local attacker can use a side-channel attack to recover a secret private key. References ========== https://eprint.iacr.org/2017/627 https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=a9f… https://security.archlinux.org/CVE-2017-7526

1 0

[arch-security] [ASA-201706-35] libnl: privilege escalation
by Christian Rebischke 28 Jun '17

28 Jun '17

Arch Linux Security Advisory ASA-201706-35 ========================================== Severity: Medium Date : 2017-06-28 CVE-ID : CVE-2017-0553 Package : libnl Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-292 Summary ======= The package libnl before version 3.3.0-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 3.3.0-1. # pacman -Syu "libnl>=3.3.0-1" The problem has been fixed upstream in version 3.3.0. Workaround ========== None. Description =========== An integer overflow vulnerability has been found in the nlmsg_reserve() function of libnl < 3.3.0, allowing local privilege escalation. Impact ====== A local attacker is able to escalate privileges. References ========== http://git.infradead.org/users/tgr/libnl.git/commitdiff/3e18948f17148e6a3c4… https://security.archlinux.org/CVE-2017-0553

1 0

[arch-security] [ASA-201706-34] apache: multiple issues
by Santiago Torres-Arias 28 Jun '17

28 Jun '17

Arch Linux Security Advisory ASA-201706-34 ========================================== Severity: High Date : 2017-06-28 CVE-ID : CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 CVE-2017-7668 CVE-2017-7679 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-316 Summary ======= The package apache before version 2.4.26-1 is vulnerable to multiple issues including denial of service, information disclosure and authentication bypass. Resolution ========== Upgrade to 2.4.26-1. # pacman -Syu "apache>=2.4.26-1" The problems have been fixed upstream in version 2.4.26. Workaround ========== None. Description =========== - CVE-2017-3167 (authentication bypass) An authentication bypass flaw has been found in Apache httpd < 2.4.26, where the use of the ap_get_basic_auth_pw() function by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Third-party module writers SHOULD use ap_get_basic_auth_components(), available in 2.2.33 and 2.4.26, instead of ap_get_basic_auth_pw(). Modules which call the legacy ap_get_basic_auth_pw() during the authentication phase MUST either immediately authenticate the user after the call, or else stop the request immediately with an error response, to avoid incorrectly authenticating the current request. - CVE-2017-3169 (denial of service) A NULL-pointer dereference leading to denial of service has been found in the mod_ssl component of Apache httpd < 2.4.26. mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. - CVE-2017-7659 (denial of service) A NULL-pointer dereference leading to denial of service has been found in the mod_http2 component of Apache httpd < 2.4.26. A maliciously constructed HTTP/2 request could cause mod_http2 to dereference a NULL pointer and crash the server process. - CVE-2017-7668 (information disclosure) An out-of-bounds read has been found in Apache httpd < 2.4.26. The HTTP strict parsing changes added in 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value. - CVE-2017-7679 (denial of service) An out-of-bounds read has been found in Apache httpd < 2.4.26, where mod_mime can read one byte past the end of a buffer when a malicious Content-Type response header is sent. Impact ====== A remote attacker can crash an apache server or obtain sensitive information from the host by performing a maliciously-crafted HTTP request. In addition, a malicious attacker can bypass a server's authentication requirements via maliciously-crafted request headers. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://www.apache.org/dist/httpd/patches/apply_to_2.2.32/CVE-2017-3167.pat… https://security.archlinux.org/CVE-2017-3167 https://security.archlinux.org/CVE-2017-3169 https://security.archlinux.org/CVE-2017-7659 https://security.archlinux.org/CVE-2017-7668 https://security.archlinux.org/CVE-2017-7679

1 0

[arch-security] [ASA-201706-33] poppler: arbitrary code execution
by Santiago Torres-Arias 26 Jun '17

26 Jun '17

Arch Linux Security Advisory ASA-201706-33 ========================================== Severity: High Date : 2017-06-26 CVE-ID : CVE-2017-9775 CVE-2017-9776 Package : poppler Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-326 Summary ======= The package poppler before version 0.56.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.56.0-1. # pacman -Syu "poppler>=0.56.0-1" The problems have been fixed upstream in version 0.56.0. Workaround ========== None. Description =========== - CVE-2017-9775 (arbitrary code execution) A stack buffer overflow in has been found in GfxState.cc's module of poppler. Due to some restrictions in the lines after the bug, an attacker can't control the values written in the stack so it unlikely this could lead to a code execution. - CVE-2017-9776 (arbitrary code execution) Integer overflow leading to heap overflow in JBIG2Stream.cc. Impact ====== An attacker might be able to execute arbitrary code on the affected host by tricking the user into opening a crafted PDF document. References ========== https://bugs.freedesktop.org/show_bug.cgi?id=101541 https://bugs.freedesktop.org/show_bug.cgi?id=101540 https://cgit.freedesktop.org/poppler/poppler/commit/?id=8f4ff8243a3d599ff2a… https://cgit.freedesktop.org/poppler/poppler/commit/?id=a3a98a6d83dfbf49f56… https://security.archlinux.org/CVE-2017-9775 https://security.archlinux.org/CVE-2017-9776

1 0

[arch-security] [ASA-201706-32] expat: denial of service
by Remi Gacogne 26 Jun '17

26 Jun '17

Arch Linux Security Advisory ASA-201706-32 ========================================== Severity: Medium Date : 2017-06-26 CVE-ID : CVE-2016-9063 CVE-2017-9233 Package : expat Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-306 Summary ======= The package expat before version 2.2.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.2.1-1. # pacman -Syu "expat>=2.2.1-1" The problems have been fixed upstream in version 2.2.1. Workaround ========== None. Description =========== - CVE-2016-9063 (denial of service) An integer overflow vulnerability has been discovered during the parsing of XML using the Expat library. - CVE-2017-9233 (denial of service) An external entity infinite loop issue has been found in Expat < 2.2.1, leading to a denial of service. Impact ====== An attacker can cause a denial of service in an application using expat by sending a crafted XML payload. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-89/#CVE-2016-9063 https://github.com/libexpat/libexpat/commit/d4f735b88d9932bd5039df2335eefdd… https://libexpat.github.io/doc/cve-2017-9233/ https://security.archlinux.org/CVE-2016-9063 https://security.archlinux.org/CVE-2017-9233

1 0

[arch-security] [ASA-201706-31] linux: privilege escalation
by Levente Polyak 23 Jun '17

23 Jun '17

Arch Linux Security Advisory ASA-201706-31 ========================================== Severity: High Date : 2017-06-23 CVE-ID : CVE-2017-1000364 Package : linux Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-313 Summary ======= The package linux before version 4.11.6-3 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.11.6-3. # pacman -Syu "linux>=4.11.6-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue more difficult. Impact ====== A local attacker is able to bypass the stack guard for user space binaries effectively leading to elevation of privileges by choosing a suitable target application. References ========== https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://git.kernel.org/linus/1be7107fbe18eed3e319a6c3e83c78254b693acb https://security.archlinux.org/CVE-2017-1000364

1 0