- Arch-security - lists.archlinux.org

[arch-security] [ASA-201706-10] lib32-libtasn1: arbitrary code execution
by Remi Gacogne 12 Jun '17

12 Jun '17

Arch Linux Security Advisory ASA-201706-10 ========================================== Severity: High Date : 2017-06-12 CVE-ID : CVE-2017-6891 Package : lib32-libtasn1 Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-286 Summary ======= The package lib32-libtasn1 before version 4.11-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.11-1. # pacman -Syu "lib32-libtasn1>=4.11-1" The problem has been fixed upstream in version 4.11. Workaround ========== None. Description =========== Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility. Impact ====== An attacker can execute arbitrary code on the affected host by tricking a local user into processing a specially crafted assignments file. References ========== https://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=5520704d… https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/ https://security.archlinux.org/CVE-2017-6891

1 0

[arch-security] [ASA-201706-9] wireshark-cli: denial of service
by Remi Gacogne 12 Jun '17

12 Jun '17

Arch Linux Security Advisory ASA-201706-9 ========================================= Severity: Low Date : 2017-06-12 CVE-ID : CVE-2017-9343 CVE-2017-9344 CVE-2017-9345 CVE-2017-9346 CVE-2017-9347 CVE-2017-9348 CVE-2017-9349 CVE-2017-9350 CVE-2017-9351 CVE-2017-9352 CVE-2017-9353 CVE-2017-9354 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-287 Summary ======= The package wireshark-cli before version 2.2.7-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.2.7-1. # pacman -Syu "wireshark-cli>=2.2.7-1" The problems have been fixed upstream in version 2.2.7. Workaround ========== None. Description =========== - CVE-2017-9343 (denial of service) An issue has been found in the MSNIP dissector of Wireshark < 2.2.7, where NULL pointer dereference can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9344 (denial of service) An issue has been found in the BT L2CAP dissector of Wireshark < 2.2.7, where a division by zero can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9345 (denial of service) An issue has been found in the DNS dissector of Wireshark < 2.2.7, where an infinite loop can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9346 (denial of service) An issue has been found in the SoulSeek dissector of Wireshark < 2.2.7, where an infinite loop can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9347 (denial of service) An issue has been found in the ROS dissector of Wireshark < 2.2.7, where an NULL pointer dereference can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9348 (denial of service) An issue has been found in the DOF dissector of Wireshark < 2.2.7, where a heap-based out-of-bounds read can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9349 (denial of service) An issue has been found in the DICOM dissector of Wireshark < 2.2.7, where an infinite loop can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9350 (denial of service) An issue has been found in the openSAFETY dissector of Wireshark < 2.2.7, where an over-sized memory allocation can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9351 (denial of service) An issue has been found in the DHCP dissector of Wireshark < 2.2.7, where a heap-based out-of-bounds read can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9352 (denial of service) An issue has been found in the bazaar dissector of Wireshark < 2.2.7, where an infinite loop can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9353 (denial of service) An issue has been found in the IPv6 dissector of Wireshark < 2.2.7, where a NULL pointer dereference can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. - CVE-2017-9354 (denial of service) An issue has been found in the RGMP dissector of Wireshark < 2.2.7, where a NULL pointer dereference can be triggered by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker can cause a denial of service by injecting a malicious packet into the wire or by convincing someone to read a malformed packet trace file. References ========== https://www.wireshark.org/docs/relnotes/wireshark-2.2.7.html https://www.wireshark.org/security/wnpa-sec-2017-30.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13725 https://www.wireshark.org/security/wnpa-sec-2017-29.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13701 https://www.wireshark.org/security/wnpa-sec-2017-26.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13633 https://www.wireshark.org/security/wnpa-sec-2017-25.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13631 https://www.wireshark.org/security/wnpa-sec-2017-31.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13637 https://www.wireshark.org/security/wnpa-sec-2017-23.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13608 https://www.wireshark.org/security/wnpa-sec-2017-27.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13685 https://www.wireshark.org/security/wnpa-sec-2017-28.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13649 https://www.wireshark.org/security/wnpa-sec-2017-24.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13609 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13628 https://www.wireshark.org/security/wnpa-sec-2017-22.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13599 https://www.wireshark.org/security/wnpa-sec-2017-33.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13675 https://www.wireshark.org/security/wnpa-sec-2017-32.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13646 https://security.archlinux.org/CVE-2017-9343 https://security.archlinux.org/CVE-2017-9344 https://security.archlinux.org/CVE-2017-9345 https://security.archlinux.org/CVE-2017-9346 https://security.archlinux.org/CVE-2017-9347 https://security.archlinux.org/CVE-2017-9348 https://security.archlinux.org/CVE-2017-9349 https://security.archlinux.org/CVE-2017-9350 https://security.archlinux.org/CVE-2017-9351 https://security.archlinux.org/CVE-2017-9352 https://security.archlinux.org/CVE-2017-9353 https://security.archlinux.org/CVE-2017-9354

1 0

[arch-security] [ASA-201706-8] chromium: multiple issues
by Remi Gacogne 07 Jun '17

07 Jun '17

Arch Linux Security Advisory ASA-201706-8 ========================================= Severity: Critical Date : 2017-06-07 CVE-ID : CVE-2017-5070 CVE-2017-5071 CVE-2017-5072 CVE-2017-5073 CVE-2017-5074 CVE-2017-5075 CVE-2017-5076 CVE-2017-5077 CVE-2017-5078 CVE-2017-5079 CVE-2017-5080 CVE-2017-5081 CVE-2017-5082 CVE-2017-5083 CVE-2017-5085 CVE-2017-5086 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-289 Summary ======= The package chromium before version 59.0.3071.86-1 is vulnerable to multiple issues including arbitrary code execution, arbitrary command execution, authentication bypass, content spoofing, information disclosure, cross-site scripting and insufficient validation. Resolution ========== Upgrade to 59.0.3071.86-1. # pacman -Syu "chromium>=59.0.3071.86-1" The problems have been fixed upstream in version 59.0.3071.86. Workaround ========== None. Description =========== - CVE-2017-5070 (arbitrary code execution) A type confusion flaw has been found in the V8 component of the Chromium browser. - CVE-2017-5071 (information disclosure) An out of bounds read flaw has been found in the V8 component of the Chromium browser. - CVE-2017-5072 (content spoofing) An address spoofing flaw has been found in the Omnibox component of the Chromium browser. - CVE-2017-5073 (arbitrary code execution) A use-after-free flaw has been found in the print preview component of the Chromium browser. - CVE-2017-5074 (arbitrary code execution) A use-after-free flaw has been found in the Apps Bluetooth component of the Chromium browser. - CVE-2017-5075 (information disclosure) An information leak flaw has been found in the CSP reporting component of the Chromium browser. - CVE-2017-5076 (content spoofing) An address spoofing flaw has been found in the Omnibox component of the Chromium browser. - CVE-2017-5077 (arbitrary code execution) A heap buffer overflow flaw was found in the Skia component of the Chromium browser. - CVE-2017-5078 (arbitrary command execution) A possible command injection flaw has been found in the mailto handling component of the Chromium browser. - CVE-2017-5079 (content spoofing) A UI spoofing flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5080 (arbitrary code execution) A use-after-free flaw has been found in the credit card autofill component of the Chromium browser. - CVE-2017-5081 (authentication bypass) A extension verification bypass has been found in the Chromium browser. - CVE-2017-5082 (insufficient validation) An insufficient hardening flaw has been found in the credit card editor component of the Chromium browser. - CVE-2017-5083 (content spoofing) A UI spoofing flaw has been found in the Blink component of the Chromium browser. - CVE-2017-5085 (cross-site scripting) A security issue has been found in the Chromium browser, where javascript is inappropriately executed on WebUI pages - CVE-2017-5086 (content spoofing) An address spoofing flaw has been found in the Omnibox component of the Chromium browser. Impact ====== A remote attacker can access sensitive information, spoof content, bypass security measures and execute arbitrary code and commands on the affected host. References ========== https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=722756 https://bugs.chromium.org/p/chromium/issues/detail?id=715582 https://bugs.chromium.org/p/chromium/issues/detail?id=709417 https://bugs.chromium.org/p/chromium/issues/detail?id=716474 https://bugs.chromium.org/p/chromium/issues/detail?id=700040 https://bugs.chromium.org/p/chromium/issues/detail?id=678776 https://bugs.chromium.org/p/chromium/issues/detail?id=719199 https://bugs.chromium.org/p/chromium/issues/detail?id=716311 https://bugs.chromium.org/p/chromium/issues/detail?id=711020 https://bugs.chromium.org/p/chromium/issues/detail?id=713686 https://bugs.chromium.org/p/chromium/issues/detail?id=708819 https://bugs.chromium.org/p/chromium/issues/detail?id=672008 https://bugs.chromium.org/p/chromium/issues/detail?id=721579 https://bugs.chromium.org/p/chromium/issues/detail?id=714849 https://bugs.chromium.org/p/chromium/issues/detail?id=692378 https://bugs.chromium.org/p/chromium/issues/detail?id=722639 https://security.archlinux.org/CVE-2017-5070 https://security.archlinux.org/CVE-2017-5071 https://security.archlinux.org/CVE-2017-5072 https://security.archlinux.org/CVE-2017-5073 https://security.archlinux.org/CVE-2017-5074 https://security.archlinux.org/CVE-2017-5075 https://security.archlinux.org/CVE-2017-5076 https://security.archlinux.org/CVE-2017-5077 https://security.archlinux.org/CVE-2017-5078 https://security.archlinux.org/CVE-2017-5079 https://security.archlinux.org/CVE-2017-5080 https://security.archlinux.org/CVE-2017-5081 https://security.archlinux.org/CVE-2017-5082 https://security.archlinux.org/CVE-2017-5083 https://security.archlinux.org/CVE-2017-5085 https://security.archlinux.org/CVE-2017-5086

1 0

[arch-security] [ASA-201706-7] tomcat8: access restriction bypass
by Remi Gacogne 06 Jun '17

06 Jun '17

Arch Linux Security Advisory ASA-201706-7 ========================================= Severity: High Date : 2017-06-06 CVE-ID : CVE-2017-5664 Package : tomcat8 Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-291 Summary ======= The package tomcat8 before version 8.0.44-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 8.0.44-1. # pacman -Syu "tomcat8>=8.0.44-1" The problem has been fixed upstream in version 8.0.44. Workaround ========== None. Description =========== A security issue has been found in Apache Tomcat < 7.0.18 and < 8.0.44. The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve the content of the file as if processing a GET request, regardless of the actual HTTP method. Tomcat's Default Servlet did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Impact ====== A remote attacker can alter, replace or remove the custom error page of an affected server by sending an HTTP request with a specific method. References ========== https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78 https://svn.apache.org/viewvc?view=revision&revision=1793471 https://svn.apache.org/viewvc?view=revision&revision=1793491 https://security.archlinux.org/CVE-2017-5664

1 0

[arch-security] [ASA-201706-6] tomcat7: access restriction bypass
by Remi Gacogne 06 Jun '17

06 Jun '17

Arch Linux Security Advisory ASA-201706-6 ========================================= Severity: High Date : 2017-06-06 CVE-ID : CVE-2017-5664 Package : tomcat7 Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-290 Summary ======= The package tomcat7 before version 7.0.78-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 7.0.78-1. # pacman -Syu "tomcat7>=7.0.78-1" The problem has been fixed upstream in version 7.0.78. Workaround ========== None. Description =========== A security issue has been found in Apache Tomcat < 7.0.18 and < 8.0.44. The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve the content of the file as if processing a GET request, regardless of the actual HTTP method. Tomcat's Default Servlet did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Impact ====== A remote attacker can alter, replace or remove the custom error page of an affected server by sending an HTTP request with a specific method. References ========== https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44 https://svn.apache.org/viewvc?view=revision&revision=1793471 https://svn.apache.org/viewvc?view=revision&revision=1793491 https://security.archlinux.org/CVE-2017-5664

1 0

[arch-security] [ASA-201706-5] libusbmuxd: access restriction bypass
by Santiago Torres-Arias 05 Jun '17

05 Jun '17

Arch Linux Security Advisory ASA-201706-5 ========================================= Severity: Medium Date : 2017-06-05 CVE-ID : CVE-2016-5104 Package : libusbmuxd Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-7 Summary ======= The package libusbmuxd before version 1.0.10-2 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 1.0.10-2. # pacman -Syu "libusbmuxd>=1.0.10-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers on the local network to bypass intended access restrictions and communicate with services on affected devices by connecting to an IPv4 TCP socket. Impact ====== A remote attacker is able to interact with a USB-connected device by connecting to a IPv4 TCP socket. References ========== https://git.archlinux.org/svntogit/packages.git/tree/trunk/CVE-2016-5104.pa… https://github.com/libimobiledevice/libusbmuxd/commit/4397b3376dc4e4cb1c991… http://www.openwall.com/lists/oss-security/2016/05/26/6 https://security.archlinux.org/CVE-2016-5104

1 0

[arch-security] [ASA-201706-4] gajim: information disclosure
by Santiago Torres-Arias 05 Jun '17

05 Jun '17

Arch Linux Security Advisory ASA-201706-4 ========================================= Severity: High Date : 2017-06-05 CVE-ID : CVE-2016-1037 Package : gajim Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-284 Summary ======= The package gajim before version 0.16.8-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 0.16.8-1. # pacman -Syu "gajim>=0.16.8-1" The problem has been fixed upstream in version 0.16.8. Workaround ========== None. Description =========== Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote Controlling Clients" extension. This can be abused by malicious XMPP servers to, for example, extract plaintext from OTR encrypted sessions. Impact ====== A malicious attacker can extract user session data by leveraging the XEP-0146 (remote controlling clients) feature of the XMPP protocol, which is enabled by default. References ========== https://dev.gajim.org/gajim/gajim/issues/8378 https://dev.gajim.org/gajim/gajim/commit/cb65cfc5aed9efe05208ebbb7fb2d41fcf… https://security.archlinux.org/CVE-2016-1037

1 0

[arch-security] [ASA-201706-3] libtasn1: arbitrary code execution
by Remi Gacogne 02 Jun '17

02 Jun '17

Arch Linux Security Advisory ASA-201706-3 ========================================= Severity: High Date : 2017-06-02 CVE-ID : CVE-2017-6891 Package : libtasn1 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-285 Summary ======= The package libtasn1 before version 4.11-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.11-1. # pacman -Syu "libtasn1>=4.11-1" The problem has been fixed upstream in version 4.11. Workaround ========== None. Description =========== Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility. Impact ====== A remote attacker can execute arbitrary code on the affected host by tricking a local user into processing a specially crafted assignments file. References ========== https://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=5520704d… https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/ https://security.archlinux.org/CVE-2017-6891

1 0

[arch-security] [ASA-201706-2] freeradius: authentication bypass
by Remi Gacogne 02 Jun '17

02 Jun '17

Arch Linux Security Advisory ASA-201706-2 ========================================= Severity: High Date : 2017-06-02 CVE-ID : CVE-2017-9148 Package : freeradius Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-281 Summary ======= The package freeradius before version 3.0.14-3 is vulnerable to authentication bypass. Resolution ========== Upgrade to 3.0.14-3. # pacman -Syu "freeradius>=3.0.14-3" The problem has been fixed upstream in version 3.0.14. Workaround ========== None. Description =========== A security issue has been found in FreeRADIUS < 3.0.14. The implementation of TTLS and PEAP in FreeRADIUS skips inner authentication when it handles a resumed TLS connection. This is a feature but there is a critical catch: the server must never allow resumption of a TLS session until its initial connection gets to the point where inner authentication has been finished successfully. Unfortunately, affected versions of FreeRADIUS fail to reliably prevent resumption of unauthenticated sessions unless the TLS session cache is disabled completely and allow an attacker (e.g. a malicious supplicant) to elicit EAP Success without sending any valid credentials. Impact ====== A remote user can bypass authentication by starting then resuming an unauthenticated TLS session. References ========== http://freeradius.org/press/index.html#3.0.14 http://seclists.org/oss-sec/2017/q2/342 https://security.archlinux.org/CVE-2017-9148

1 0

[arch-security] [ASA-201706-1] vlc: multiple issues
by Levente Polyak 01 Jun '17

01 Jun '17

Arch Linux Security Advisory ASA-201706-1 ========================================= Severity: High Date : 2017-06-01 CVE-ID : CVE-2017-8310 CVE-2017-8311 CVE-2017-8312 Package : vlc Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-283 Summary ======= The package vlc before version 2.2.6-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.2.6-1. # pacman -Syu "vlc>=2.2.6-1" The problems have been fixed upstream in version 2.2.6. Workaround ========== None. Description =========== - CVE-2017-8310 (denial of service) Heap out-of-bound read in CreateHtmlSubtitle in VideoLAN VLC 2.2.x due to missing check of string termination allows attackers to read data beyond allocated memory and potentially crash the process (causing a denial of service) via a crafted subtitles file. - CVE-2017-8311 (arbitrary code execution) Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file. - CVE-2017-8312 (denial of service) Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file. Impact ====== A local attacker is able to use a specially crafted subtitles file to crash the application or execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/54194 http://git.videolan.org/?p=vlc/vlc-2.2.git;a=commitdiff;h=7cac839692ab79dbf… http://git.videolan.org/?p=vlc.git;a=commitdiff;h=775de716add17322f24b47643… http://git.videolan.org/?p=vlc.git;a=commitdiff;h=611398fc8d32f3fe4331f60b2… https://security.archlinux.org/CVE-2017-8310 https://security.archlinux.org/CVE-2017-8311 https://security.archlinux.org/CVE-2017-8312

1 0