- Arch-security - lists.archlinux.org

[arch-security] [ASA-201706-20] thunderbird: multiple issues
by Remi Gacogne 17 Jun '17

17 Jun '17

Arch Linux Security Advisory ASA-201706-20 ========================================== Severity: Critical Date : 2017-06-16 CVE-ID : CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7764 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-303 Summary ======= The package thunderbird before version 52.2.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, information disclosure and content spoofing. Resolution ========== Upgrade to 52.2.0-1. # pacman -Syu "thunderbird>=52.2.0-1" The problems have been fixed upstream in version 52.2.0. Workaround ========== None. Description =========== - CVE-2017-5470 (arbitrary code execution) Several memory safety issues leading to arbitrary code execution have been found in Firefox < 54.0 and Thunderbird < 52.2. - CVE-2017-5472 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, in the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. - CVE-2017-7749 (arbitrary code execution) A user-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, when using an incorrect URL during the reloading of a docshell. - CVE-2017-7750 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, during video control operations when a <track> element holds a reference to an older window if that window has been replaced in the DOM. - CVE-2017-7751 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, in content viewer listeners. - CVE-2017-7752 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. - CVE-2017-7754 (information disclosure) An out-of-bounds read has been found in Firefox < 54.0 and Thunderbird < 52.2, with a maliciously crafted ImageInfo object during WebGL operations. - CVE-2017-7756 (arbitrary code execution) A use after-free and use-after-scope vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, when logging errors from headers for XML HTTP Requests (XHR). - CVE-2017-7757 (arbitrary code execution) A use after-free vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. - CVE-2017-7758 (information disclosure) An out-of-bounds read vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. - CVE-2017-7764 (content spoofing) A security issue has been found in Firefox < 54.0 and Thunderbird < 52.2, where characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. Firefox and Thunderbird behavior has been changed to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts." - CVE-2017-7771 (information disclosure) An out-of-bounds read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Pass::readPass. - CVE-2017-7772 (arbitrary code execution) A heap-buffer-overflow write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. - CVE-2017-7773 (arbitrary code execution) A heap-buffer-overflow write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. - CVE-2017-7774 (information disclosure) An out-of-bounds read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Silf::readGraphite. - CVE-2017-7775 (denial of service) An assertion failure has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2. - CVE-2017-7776 (information disclosure) A heap-buffer-overflow read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Silf::getClassGlyph. - CVE-2017-7777 (information disclosure) An use of initialized memory has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in GlyphCache::Loader::read_glyph. - CVE-2017-7778 (arbitrary code execution) An out-of-bounds write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. Impact ====== A remote attacker may be able to crash Thunderbird, access sensitive information, spoof content to trick the user into performing an unwanted action and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-17/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5470 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1359639%2C1349595%2C1352295… https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5472 https://bugzilla.mozilla.org/show_bug.cgi?id=1365602 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7749 https://bugzilla.mozilla.org/show_bug.cgi?id=1355039 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7750 https://bugzilla.mozilla.org/show_bug.cgi?id=1356558 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7751 https://bugzilla.mozilla.org/show_bug.cgi?id=1363396 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7752 https://bugzilla.mozilla.org/show_bug.cgi?id=1359547 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7754 https://bugzilla.mozilla.org/show_bug.cgi?id=1357090 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7756 https://bugzilla.mozilla.org/show_bug.cgi?id=1366595 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7757 https://bugzilla.mozilla.org/show_bug.cgi?id=1356824 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7758 https://bugzilla.mozilla.org/show_bug.cgi?id=1368490 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7764 https://bugzilla.mozilla.org/show_bug.cgi?id=1364283 http://www.unicode.org/reports/tr31/tr31-26.html#Aspirational_Use_Scripts https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7778 https://bugzilla.mozilla.org/show_bug.cgi?id=1350047 https://bugzilla.mozilla.org/show_bug.cgi?id=1352745 https://bugzilla.mozilla.org/show_bug.cgi?id=1352747 https://www.mozilla.org/en-US/security/advisories/mfsa2017-17/#CVE-2017-7778 https://bugzilla.mozilla.org/show_bug.cgi?id=1355174 https://bugzilla.mozilla.org/show_bug.cgi?id=1355182 https://bugzilla.mozilla.org/show_bug.cgi?id=1356607 https://bugzilla.mozilla.org/show_bug.cgi?id=1358551 https://bugzilla.mozilla.org/show_bug.cgi?id=1349310 https://security.archlinux.org/CVE-2017-5470 https://security.archlinux.org/CVE-2017-5472 https://security.archlinux.org/CVE-2017-7749 https://security.archlinux.org/CVE-2017-7750 https://security.archlinux.org/CVE-2017-7751 https://security.archlinux.org/CVE-2017-7752 https://security.archlinux.org/CVE-2017-7754 https://security.archlinux.org/CVE-2017-7756 https://security.archlinux.org/CVE-2017-7757 https://security.archlinux.org/CVE-2017-7758 https://security.archlinux.org/CVE-2017-7764 https://security.archlinux.org/CVE-2017-7771 https://security.archlinux.org/CVE-2017-7772 https://security.archlinux.org/CVE-2017-7773 https://security.archlinux.org/CVE-2017-7774 https://security.archlinux.org/CVE-2017-7775 https://security.archlinux.org/CVE-2017-7776 https://security.archlinux.org/CVE-2017-7777 https://security.archlinux.org/CVE-2017-7778

1 0

[arch-security] [ASA-201706-19] firefox: multiple issues
by Remi Gacogne 17 Jun '17

17 Jun '17

Arch Linux Security Advisory ASA-201706-19 ========================================== Severity: Critical Date : 2017-06-16 CVE-ID : CVE-2017-5470 CVE-2017-5471 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7762 CVE-2017-7764 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-302 Summary ======= The package firefox before version 54.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, information disclosure and content spoofing. Resolution ========== Upgrade to 54.0-1. # pacman -Syu "firefox>=54.0-1" The problems have been fixed upstream in version 54.0. Workaround ========== None. Description =========== - CVE-2017-5470 (arbitrary code execution) Several memory safety issues leading to arbitrary code execution have been found in Firefox < 54.0 and Thunderbird < 52.2. - CVE-2017-5471 (arbitrary code execution) Several memory safety issues leading to arbitrary code execution have been found in Firefox < 54.0. - CVE-2017-5472 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, in the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. - CVE-2017-7749 (arbitrary code execution) A user-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, when using an incorrect URL during the reloading of a docshell. - CVE-2017-7750 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, during video control operations when a <track> element holds a reference to an older window if that window has been replaced in the DOM. - CVE-2017-7751 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, in content viewer listeners. - CVE-2017-7752 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. - CVE-2017-7754 (information disclosure) An out-of-bounds read has been found in Firefox < 54.0 and Thunderbird < 52.2, with a maliciously crafted ImageInfo object during WebGL operations. - CVE-2017-7756 (arbitrary code execution) A use after-free and use-after-scope vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, when logging errors from headers for XML HTTP Requests (XHR). - CVE-2017-7757 (arbitrary code execution) A use after-free vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. - CVE-2017-7758 (information disclosure) An out-of-bounds read vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. - CVE-2017-7762 (content spoofing) A security issue has been found in Firefox < 54.0. When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. - CVE-2017-7764 (content spoofing) A security issue has been found in Firefox < 54.0 and Thunderbird < 52.2, where characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. Firefox and Thunderbird behavior has been changed to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts." - CVE-2017-7771 (information disclosure) An out-of-bounds read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Pass::readPass. - CVE-2017-7772 (arbitrary code execution) A heap-buffer-overflow write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. - CVE-2017-7773 (arbitrary code execution) A heap-buffer-overflow write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. - CVE-2017-7774 (information disclosure) An out-of-bounds read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Silf::readGraphite. - CVE-2017-7775 (denial of service) An assertion failure has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2. - CVE-2017-7776 (information disclosure) A heap-buffer-overflow read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Silf::getClassGlyph. - CVE-2017-7777 (information disclosure) An use of initialized memory has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in GlyphCache::Loader::read_glyph. - CVE-2017-7778 (arbitrary code execution) An out-of-bounds write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. Impact ====== A remote attacker may be able to crash Firefox, access sensitive information, spoof content to trick the user into performing an unwanted action and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5470 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1359639%2C1349595%2C1352295… https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5471 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5472 https://bugzilla.mozilla.org/show_bug.cgi?id=1365602 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7749 https://bugzilla.mozilla.org/show_bug.cgi?id=1355039 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7750 https://bugzilla.mozilla.org/show_bug.cgi?id=1356558 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7751 https://bugzilla.mozilla.org/show_bug.cgi?id=1363396 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7752 https://bugzilla.mozilla.org/show_bug.cgi?id=1359547 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7754 https://bugzilla.mozilla.org/show_bug.cgi?id=1357090 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7756 https://bugzilla.mozilla.org/show_bug.cgi?id=1366595 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7757 https://bugzilla.mozilla.org/show_bug.cgi?id=1356824 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7758 https://bugzilla.mozilla.org/show_bug.cgi?id=1368490 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7762 https://bugzilla.mozilla.org/show_bug.cgi?id=1358248 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7764 https://bugzilla.mozilla.org/show_bug.cgi?id=1364283 http://www.unicode.org/reports/tr31/tr31-26.html#Aspirational_Use_Scripts https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7778 https://bugzilla.mozilla.org/show_bug.cgi?id=1350047 https://bugzilla.mozilla.org/show_bug.cgi?id=1352745 https://bugzilla.mozilla.org/show_bug.cgi?id=1352747 https://www.mozilla.org/en-US/security/advisories/mfsa2017-17/#CVE-2017-7778 https://bugzilla.mozilla.org/show_bug.cgi?id=1355174 https://bugzilla.mozilla.org/show_bug.cgi?id=1355182 https://bugzilla.mozilla.org/show_bug.cgi?id=1356607 https://bugzilla.mozilla.org/show_bug.cgi?id=1358551 https://bugzilla.mozilla.org/show_bug.cgi?id=1349310 https://security.archlinux.org/CVE-2017-5470 https://security.archlinux.org/CVE-2017-5471 https://security.archlinux.org/CVE-2017-5472 https://security.archlinux.org/CVE-2017-7749 https://security.archlinux.org/CVE-2017-7750 https://security.archlinux.org/CVE-2017-7751 https://security.archlinux.org/CVE-2017-7752 https://security.archlinux.org/CVE-2017-7754 https://security.archlinux.org/CVE-2017-7756 https://security.archlinux.org/CVE-2017-7757 https://security.archlinux.org/CVE-2017-7758 https://security.archlinux.org/CVE-2017-7762 https://security.archlinux.org/CVE-2017-7764 https://security.archlinux.org/CVE-2017-7771 https://security.archlinux.org/CVE-2017-7772 https://security.archlinux.org/CVE-2017-7773 https://security.archlinux.org/CVE-2017-7774 https://security.archlinux.org/CVE-2017-7775 https://security.archlinux.org/CVE-2017-7776 https://security.archlinux.org/CVE-2017-7777 https://security.archlinux.org/CVE-2017-7778

1 0

[arch-security] [ASA-201706-18] bind: denial of service
by Remi Gacogne 15 Jun '17

15 Jun '17

Arch Linux Security Advisory ASA-201706-18 ========================================== Severity: Medium Date : 2017-06-15 CVE-ID : CVE-2017-3140 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-301 Summary ======= The package bind before version 9.11.1.P1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.1.P1-1. # pacman -Syu "bind>=9.11.1.P1-1" The problem has been fixed upstream in version 9.11.1.P1. Workaround ========== None. Description =========== A security issue has been found the Bind named DNS server < 9.11.1P1, leading to a denial of service. A remote attacker can make a vulnerable server configured to use a RPZ containing NSDNAME or NSIPpolicy rules enter an endless loop, querying the same sets of authoritative servers repeatedly, by sending a crafted query. Impact ====== A remote attacker can cause a denial of service of a vulnerable server using NSDNAME or NSIP RPZ policies by sending a crafted query. References ========== https://kb.isc.org/article/AA-01495 https://security.archlinux.org/CVE-2017-3140

1 0

[arch-security] [ASA-201706-17] messagelib: information disclosure
by Levente Polyak 14 Jun '17

14 Jun '17

Arch Linux Security Advisory ASA-201706-17 ========================================== Severity: Medium Date : 2017-06-14 CVE-ID : CVE-2017-9604 Package : messagelib Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-300 Summary ======= The package messagelib before version 17.04.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 17.04.2-1. # pacman -Syu "messagelib>=17.04.2-1" The problem has been fixed upstream in version 17.04.2. Workaround ========== None. Description =========== KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network. Impact ====== A remote attacker who is sniffing the network may be able to obtain sensitive information when an email that should be encrypted is sent via the "Send Later with Delay" function. References ========== https://www.kde.org/info/security/advisory-20170615-1.txt https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8 https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197 https://security.archlinux.org/CVE-2017-9604

1 0

[arch-security] [ASA-201706-16] kmail: information disclosure
by Levente Polyak 14 Jun '17

14 Jun '17

Arch Linux Security Advisory ASA-201706-16 ========================================== Severity: Medium Date : 2017-06-14 CVE-ID : CVE-2017-9604 Package : kmail Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-299 Summary ======= The package kmail before version 17.04.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 17.04.2-1. # pacman -Syu "kmail>=17.04.2-1" The problem has been fixed upstream in version 17.04.2. Workaround ========== None. Description =========== KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network. Impact ====== A remote attacker who is sniffing the network may be able to obtain sensitive information when an email that should be encrypted is sent via the "Send Later with Delay" function. References ========== https://www.kde.org/info/security/advisory-20170615-1.txt https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8 https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197 https://security.archlinux.org/CVE-2017-9604

1 0

[arch-security] [ASA-201706-15] lib32-flashplugin: arbitrary code execution
by Remi Gacogne 14 Jun '17

14 Jun '17

Arch Linux Security Advisory ASA-201706-15 ========================================== Severity: Critical Date : 2017-06-14 CVE-ID : CVE-2017-3075 CVE-2017-3076 CVE-2017-3077 CVE-2017-3078 CVE-2017-3079 CVE-2017-3081 CVE-2017-3082 CVE-2017-3083 CVE-2017-3084 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-298 Summary ======= The package lib32-flashplugin before version 26.0.0.126-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 26.0.0.126-1. # pacman -Syu "lib32-flashplugin>=26.0.0.126-1" The problems have been fixed upstream in version 26.0.0.126. Workaround ========== None. Description =========== - CVE-2017-3075 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3076 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3077 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3078 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3079 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3081 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3082 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3083 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3084 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-17.html https://security.archlinux.org/CVE-2017-3075 https://security.archlinux.org/CVE-2017-3076 https://security.archlinux.org/CVE-2017-3077 https://security.archlinux.org/CVE-2017-3078 https://security.archlinux.org/CVE-2017-3079 https://security.archlinux.org/CVE-2017-3081 https://security.archlinux.org/CVE-2017-3082 https://security.archlinux.org/CVE-2017-3083 https://security.archlinux.org/CVE-2017-3084

1 0

[arch-security] [ASA-201706-14] flashplugin: arbitrary code execution
by Remi Gacogne 14 Jun '17

14 Jun '17

Arch Linux Security Advisory ASA-201706-14 ========================================== Severity: Critical Date : 2017-06-14 CVE-ID : CVE-2017-3075 CVE-2017-3076 CVE-2017-3077 CVE-2017-3078 CVE-2017-3079 CVE-2017-3081 CVE-2017-3082 CVE-2017-3083 CVE-2017-3084 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-297 Summary ======= The package flashplugin before version 26.0.0.126-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 26.0.0.126-1. # pacman -Syu "flashplugin>=26.0.0.126-1" The problems have been fixed upstream in version 26.0.0.126. Workaround ========== None. Description =========== - CVE-2017-3075 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3076 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3077 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3078 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3079 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3081 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3082 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3083 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3084 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-17.html https://security.archlinux.org/CVE-2017-3075 https://security.archlinux.org/CVE-2017-3076 https://security.archlinux.org/CVE-2017-3077 https://security.archlinux.org/CVE-2017-3078 https://security.archlinux.org/CVE-2017-3079 https://security.archlinux.org/CVE-2017-3081 https://security.archlinux.org/CVE-2017-3082 https://security.archlinux.org/CVE-2017-3083 https://security.archlinux.org/CVE-2017-3084

1 0

[arch-security] [ASA-201706-13] tor: denial of service
by Levente Polyak 13 Jun '17

13 Jun '17

Arch Linux Security Advisory ASA-201706-13 ========================================== Severity: Medium Date : 2017-06-13 CVE-ID : CVE-2017-0375 CVE-2017-0376 Package : tor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-296 Summary ======= The package tor before version 0.3.0.8-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.3.0.8-1. # pacman -Syu "tor>=0.3.0.8-1" The problems have been fixed upstream in version 0.3.0.8. Workaround ========== None. Description =========== - CVE-2017-0375 (denial of service) The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell. - CVE-2017-0376 (denial of service) The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit. Impact ====== A remote attacker is able to send specially crafted input to the hidden-service feature of tor to crash the application. References ========== https://bugs.archlinux.org/task/54439 https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html https://trac.torproject.org/projects/tor/ticket/22493 https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f0… https://trac.torproject.org/projects/tor/ticket/22494 https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939… https://security.archlinux.org/CVE-2017-0375 https://security.archlinux.org/CVE-2017-0376

1 0

[arch-security] [ASA-201706-12] gnutls: denial of service
by Remi Gacogne 13 Jun '17

13 Jun '17

Arch Linux Security Advisory ASA-201706-12 ========================================== Severity: Medium Date : 2017-06-13 CVE-ID : CVE-2017-7507 Package : gnutls Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-294 Summary ======= The package gnutls before version 3.5.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.5.13-1. # pacman -Syu "gnutls>=3.5.13-1" The problem has been fixed upstream in version 3.5.13. Workaround ========== None. Description =========== A security issue has been found in GnuTLS < 3.5.13, where decoding a status request TLS extension that has a non-empty responder IDs list could lead to a crash due to a null pointer dereference. Impact ====== A remote attacker can crash a vulnerable TLS server by sending a crafted status_request extension in a ClientHello message. References ========== https://www.gnutls.org/security.html#GNUTLS-SA-2017-4 https://bugzilla.redhat.com/show_bug.cgi?id=1454621 https://security.archlinux.org/CVE-2017-7507

1 0

[arch-security] [ASA-201706-11] irssi: denial of service
by Remi Gacogne 12 Jun '17

12 Jun '17

Arch Linux Security Advisory ASA-201706-11 ========================================== Severity: Medium Date : 2017-06-12 CVE-ID : CVE-2017-9468 CVE-2017-9469 Package : irssi Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-293 Summary ======= The package irssi before version 1.0.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.3-1. # pacman -Syu "irssi>=1.0.3-1" The problems have been fixed upstream in version 1.0.3. Workaround ========== None. Description =========== - CVE-2017-9468 (denial of service) In Irssi before 1.0.3, when receiving a DCC message without source nick/host, it attempts to dereference a NULL pointer. Thus, remote IRC servers can cause a crash. - CVE-2017-9469 (denial of service) In Irssi before 1.0.3, when receiving certain incorrectly quoted DCC files, it tries to find the terminating quote one byte before the allocated memory. Thus, remote attackers might be able to cause a crash. Impact ====== A remote attacker can cause a denial of service by sending a crafted DCC message. References ========== https://github.com/irssi/irssi/commit/fb08fc7f1aa6b2e616413d003bf021612301a… http://openwall.com/lists/oss-security/2017/06/06/4 https://irssi.org/security/irssi_sa_2017_06.txt https://security.archlinux.org/CVE-2017-9468 https://security.archlinux.org/CVE-2017-9469

1 0