- Arch-security - lists.archlinux.org

[arch-security] [ASA-201706-23] glibc: privilege escalation
by Levente Polyak 20 Jun '17

20 Jun '17

Arch Linux Security Advisory ASA-201706-23 ========================================== Severity: High Date : 2017-06-20 CVE-ID : CVE-2017-1000366 Package : glibc Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-307 Summary ======= The package glibc before version 2.25-4 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.25-4. # pacman -Syu "glibc>=2.25-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult. Impact ====== A local attacker is able to execute arbitrary code on the affected host that is effectively leading to elevation of privileges by choosing a suitable target application. References ========== https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://security.archlinux.org/CVE-2017-1000366

1 0

[arch-security] [ASA-201706-22] lib32-glibc: privilege escalation
by Levente Polyak 20 Jun '17

20 Jun '17

Arch Linux Security Advisory ASA-201706-22 ========================================== Severity: High Date : 2017-06-20 CVE-ID : CVE-2017-1000366 Package : lib32-glibc Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-308 Summary ======= The package lib32-glibc before version 2.25-4 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.25-4. # pacman -Syu "lib32-glibc>=2.25-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult. Impact ====== A local attacker is able to execute arbitrary code on the affected host that is effectively leading to elevation of privileges by choosing a suitable target application. References ========== https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://security.archlinux.org/CVE-2017-1000366

1 0

[arch-security] [ASA-201706-21] chromium: multiple issues
by Remi Gacogne 18 Jun '17

18 Jun '17

Arch Linux Security Advisory ASA-201706-21 ========================================== Severity: High Date : 2017-06-17 CVE-ID : CVE-2017-5087 CVE-2017-5088 CVE-2017-5089 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-304 Summary ======= The package chromium before version 59.0.3071.104-1 is vulnerable to multiple issues including information disclosure, sandbox escape and content spoofing. Resolution ========== Upgrade to 59.0.3071.104-1. # pacman -Syu "chromium>=59.0.3071.104-1" The problems have been fixed upstream in version 59.0.3071.104. Workaround ========== None. Description =========== - CVE-2017-5087 (sandbox escape) A sandbox escape vulnerability has been found in the IndexedDB component of the Chromium browser < 59.0.3071.104. - CVE-2017-5088 (information disclosure) An out-of-bounds read vulnerability has been found in the V8 component of the Chromium browser < 59.0.3071.104. - CVE-2017-5089 (content spoofing) A domain spoofing vulnerability has been found in the Omnibox component of the Chromium browser < 59.0.3071.104. Impact ====== A remote attacker can escape the sandbox, access sensitive information and trick the user into performing an unwanted action by spoofing the domain name. References ========== https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-des… https://crbug.com/725032 https://bugs.chromium.org/p/chromium/issues/detail?id=729991 https://bugs.chromium.org/p/chromium/issues/detail?id=714196 https://security.archlinux.org/CVE-2017-5087 https://security.archlinux.org/CVE-2017-5088 https://security.archlinux.org/CVE-2017-5089

1 0

[arch-security] [ASA-201706-20] thunderbird: multiple issues
by Remi Gacogne 17 Jun '17

17 Jun '17

Arch Linux Security Advisory ASA-201706-20 ========================================== Severity: Critical Date : 2017-06-16 CVE-ID : CVE-2017-5470 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7764 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-303 Summary ======= The package thunderbird before version 52.2.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, information disclosure and content spoofing. Resolution ========== Upgrade to 52.2.0-1. # pacman -Syu "thunderbird>=52.2.0-1" The problems have been fixed upstream in version 52.2.0. Workaround ========== None. Description =========== - CVE-2017-5470 (arbitrary code execution) Several memory safety issues leading to arbitrary code execution have been found in Firefox < 54.0 and Thunderbird < 52.2. - CVE-2017-5472 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, in the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. - CVE-2017-7749 (arbitrary code execution) A user-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, when using an incorrect URL during the reloading of a docshell. - CVE-2017-7750 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, during video control operations when a <track> element holds a reference to an older window if that window has been replaced in the DOM. - CVE-2017-7751 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, in content viewer listeners. - CVE-2017-7752 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. - CVE-2017-7754 (information disclosure) An out-of-bounds read has been found in Firefox < 54.0 and Thunderbird < 52.2, with a maliciously crafted ImageInfo object during WebGL operations. - CVE-2017-7756 (arbitrary code execution) A use after-free and use-after-scope vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, when logging errors from headers for XML HTTP Requests (XHR). - CVE-2017-7757 (arbitrary code execution) A use after-free vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. - CVE-2017-7758 (information disclosure) An out-of-bounds read vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. - CVE-2017-7764 (content spoofing) A security issue has been found in Firefox < 54.0 and Thunderbird < 52.2, where characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. Firefox and Thunderbird behavior has been changed to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts." - CVE-2017-7771 (information disclosure) An out-of-bounds read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Pass::readPass. - CVE-2017-7772 (arbitrary code execution) A heap-buffer-overflow write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. - CVE-2017-7773 (arbitrary code execution) A heap-buffer-overflow write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. - CVE-2017-7774 (information disclosure) An out-of-bounds read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Silf::readGraphite. - CVE-2017-7775 (denial of service) An assertion failure has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2. - CVE-2017-7776 (information disclosure) A heap-buffer-overflow read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Silf::getClassGlyph. - CVE-2017-7777 (information disclosure) An use of initialized memory has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in GlyphCache::Loader::read_glyph. - CVE-2017-7778 (arbitrary code execution) An out-of-bounds write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. Impact ====== A remote attacker may be able to crash Thunderbird, access sensitive information, spoof content to trick the user into performing an unwanted action and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-17/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5470 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1359639%2C1349595%2C1352295… https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5472 https://bugzilla.mozilla.org/show_bug.cgi?id=1365602 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7749 https://bugzilla.mozilla.org/show_bug.cgi?id=1355039 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7750 https://bugzilla.mozilla.org/show_bug.cgi?id=1356558 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7751 https://bugzilla.mozilla.org/show_bug.cgi?id=1363396 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7752 https://bugzilla.mozilla.org/show_bug.cgi?id=1359547 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7754 https://bugzilla.mozilla.org/show_bug.cgi?id=1357090 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7756 https://bugzilla.mozilla.org/show_bug.cgi?id=1366595 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7757 https://bugzilla.mozilla.org/show_bug.cgi?id=1356824 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7758 https://bugzilla.mozilla.org/show_bug.cgi?id=1368490 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7764 https://bugzilla.mozilla.org/show_bug.cgi?id=1364283 http://www.unicode.org/reports/tr31/tr31-26.html#Aspirational_Use_Scripts https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7778 https://bugzilla.mozilla.org/show_bug.cgi?id=1350047 https://bugzilla.mozilla.org/show_bug.cgi?id=1352745 https://bugzilla.mozilla.org/show_bug.cgi?id=1352747 https://www.mozilla.org/en-US/security/advisories/mfsa2017-17/#CVE-2017-7778 https://bugzilla.mozilla.org/show_bug.cgi?id=1355174 https://bugzilla.mozilla.org/show_bug.cgi?id=1355182 https://bugzilla.mozilla.org/show_bug.cgi?id=1356607 https://bugzilla.mozilla.org/show_bug.cgi?id=1358551 https://bugzilla.mozilla.org/show_bug.cgi?id=1349310 https://security.archlinux.org/CVE-2017-5470 https://security.archlinux.org/CVE-2017-5472 https://security.archlinux.org/CVE-2017-7749 https://security.archlinux.org/CVE-2017-7750 https://security.archlinux.org/CVE-2017-7751 https://security.archlinux.org/CVE-2017-7752 https://security.archlinux.org/CVE-2017-7754 https://security.archlinux.org/CVE-2017-7756 https://security.archlinux.org/CVE-2017-7757 https://security.archlinux.org/CVE-2017-7758 https://security.archlinux.org/CVE-2017-7764 https://security.archlinux.org/CVE-2017-7771 https://security.archlinux.org/CVE-2017-7772 https://security.archlinux.org/CVE-2017-7773 https://security.archlinux.org/CVE-2017-7774 https://security.archlinux.org/CVE-2017-7775 https://security.archlinux.org/CVE-2017-7776 https://security.archlinux.org/CVE-2017-7777 https://security.archlinux.org/CVE-2017-7778

1 0

[arch-security] [ASA-201706-19] firefox: multiple issues
by Remi Gacogne 17 Jun '17

17 Jun '17

Arch Linux Security Advisory ASA-201706-19 ========================================== Severity: Critical Date : 2017-06-16 CVE-ID : CVE-2017-5470 CVE-2017-5471 CVE-2017-5472 CVE-2017-7749 CVE-2017-7750 CVE-2017-7751 CVE-2017-7752 CVE-2017-7754 CVE-2017-7756 CVE-2017-7757 CVE-2017-7758 CVE-2017-7762 CVE-2017-7764 CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-302 Summary ======= The package firefox before version 54.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, information disclosure and content spoofing. Resolution ========== Upgrade to 54.0-1. # pacman -Syu "firefox>=54.0-1" The problems have been fixed upstream in version 54.0. Workaround ========== None. Description =========== - CVE-2017-5470 (arbitrary code execution) Several memory safety issues leading to arbitrary code execution have been found in Firefox < 54.0 and Thunderbird < 52.2. - CVE-2017-5471 (arbitrary code execution) Several memory safety issues leading to arbitrary code execution have been found in Firefox < 54.0. - CVE-2017-5472 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, in the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. - CVE-2017-7749 (arbitrary code execution) A user-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, when using an incorrect URL during the reloading of a docshell. - CVE-2017-7750 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, during video control operations when a <track> element holds a reference to an older window if that window has been replaced in the DOM. - CVE-2017-7751 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, in content viewer listeners. - CVE-2017-7752 (arbitrary code execution) A use-after-free has been found in Firefox < 54.0 and Thunderbird < 52.2, during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. - CVE-2017-7754 (information disclosure) An out-of-bounds read has been found in Firefox < 54.0 and Thunderbird < 52.2, with a maliciously crafted ImageInfo object during WebGL operations. - CVE-2017-7756 (arbitrary code execution) A use after-free and use-after-scope vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, when logging errors from headers for XML HTTP Requests (XHR). - CVE-2017-7757 (arbitrary code execution) A use after-free vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. - CVE-2017-7758 (information disclosure) An out-of-bounds read vulnerability has been found in Firefox < 54.0 and Thunderbird < 52.2, with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. - CVE-2017-7762 (content spoofing) A security issue has been found in Firefox < 54.0. When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. - CVE-2017-7764 (content spoofing) A security issue has been found in Firefox < 54.0 and Thunderbird < 52.2, where characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. Firefox and Thunderbird behavior has been changed to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts." - CVE-2017-7771 (information disclosure) An out-of-bounds read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Pass::readPass. - CVE-2017-7772 (arbitrary code execution) A heap-buffer-overflow write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. - CVE-2017-7773 (arbitrary code execution) A heap-buffer-overflow write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. - CVE-2017-7774 (information disclosure) An out-of-bounds read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Silf::readGraphite. - CVE-2017-7775 (denial of service) An assertion failure has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2. - CVE-2017-7776 (information disclosure) A heap-buffer-overflow read has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in Silf::getClassGlyph. - CVE-2017-7777 (information disclosure) An use of initialized memory has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in GlyphCache::Loader::read_glyph. - CVE-2017-7778 (arbitrary code execution) An out-of-bounds write has been found in the Graphite 2 library used in Firefox < 54.0 and Thunderbird < 52.2, in lz4::decompress. Impact ====== A remote attacker may be able to crash Firefox, access sensitive information, spoof content to trick the user into performing an unwanted action and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5470 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1359639%2C1349595%2C1352295… https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5471 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-5472 https://bugzilla.mozilla.org/show_bug.cgi?id=1365602 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7749 https://bugzilla.mozilla.org/show_bug.cgi?id=1355039 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7750 https://bugzilla.mozilla.org/show_bug.cgi?id=1356558 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7751 https://bugzilla.mozilla.org/show_bug.cgi?id=1363396 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7752 https://bugzilla.mozilla.org/show_bug.cgi?id=1359547 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7754 https://bugzilla.mozilla.org/show_bug.cgi?id=1357090 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7756 https://bugzilla.mozilla.org/show_bug.cgi?id=1366595 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7757 https://bugzilla.mozilla.org/show_bug.cgi?id=1356824 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7758 https://bugzilla.mozilla.org/show_bug.cgi?id=1368490 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7762 https://bugzilla.mozilla.org/show_bug.cgi?id=1358248 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7764 https://bugzilla.mozilla.org/show_bug.cgi?id=1364283 http://www.unicode.org/reports/tr31/tr31-26.html#Aspirational_Use_Scripts https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/#CVE-2017-7778 https://bugzilla.mozilla.org/show_bug.cgi?id=1350047 https://bugzilla.mozilla.org/show_bug.cgi?id=1352745 https://bugzilla.mozilla.org/show_bug.cgi?id=1352747 https://www.mozilla.org/en-US/security/advisories/mfsa2017-17/#CVE-2017-7778 https://bugzilla.mozilla.org/show_bug.cgi?id=1355174 https://bugzilla.mozilla.org/show_bug.cgi?id=1355182 https://bugzilla.mozilla.org/show_bug.cgi?id=1356607 https://bugzilla.mozilla.org/show_bug.cgi?id=1358551 https://bugzilla.mozilla.org/show_bug.cgi?id=1349310 https://security.archlinux.org/CVE-2017-5470 https://security.archlinux.org/CVE-2017-5471 https://security.archlinux.org/CVE-2017-5472 https://security.archlinux.org/CVE-2017-7749 https://security.archlinux.org/CVE-2017-7750 https://security.archlinux.org/CVE-2017-7751 https://security.archlinux.org/CVE-2017-7752 https://security.archlinux.org/CVE-2017-7754 https://security.archlinux.org/CVE-2017-7756 https://security.archlinux.org/CVE-2017-7757 https://security.archlinux.org/CVE-2017-7758 https://security.archlinux.org/CVE-2017-7762 https://security.archlinux.org/CVE-2017-7764 https://security.archlinux.org/CVE-2017-7771 https://security.archlinux.org/CVE-2017-7772 https://security.archlinux.org/CVE-2017-7773 https://security.archlinux.org/CVE-2017-7774 https://security.archlinux.org/CVE-2017-7775 https://security.archlinux.org/CVE-2017-7776 https://security.archlinux.org/CVE-2017-7777 https://security.archlinux.org/CVE-2017-7778

1 0

[arch-security] [ASA-201706-18] bind: denial of service
by Remi Gacogne 15 Jun '17

15 Jun '17

Arch Linux Security Advisory ASA-201706-18 ========================================== Severity: Medium Date : 2017-06-15 CVE-ID : CVE-2017-3140 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-301 Summary ======= The package bind before version 9.11.1.P1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.1.P1-1. # pacman -Syu "bind>=9.11.1.P1-1" The problem has been fixed upstream in version 9.11.1.P1. Workaround ========== None. Description =========== A security issue has been found the Bind named DNS server < 9.11.1P1, leading to a denial of service. A remote attacker can make a vulnerable server configured to use a RPZ containing NSDNAME or NSIPpolicy rules enter an endless loop, querying the same sets of authoritative servers repeatedly, by sending a crafted query. Impact ====== A remote attacker can cause a denial of service of a vulnerable server using NSDNAME or NSIP RPZ policies by sending a crafted query. References ========== https://kb.isc.org/article/AA-01495 https://security.archlinux.org/CVE-2017-3140

1 0

[arch-security] [ASA-201706-17] messagelib: information disclosure
by Levente Polyak 15 Jun '17

15 Jun '17

Arch Linux Security Advisory ASA-201706-17 ========================================== Severity: Medium Date : 2017-06-14 CVE-ID : CVE-2017-9604 Package : messagelib Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-300 Summary ======= The package messagelib before version 17.04.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 17.04.2-1. # pacman -Syu "messagelib>=17.04.2-1" The problem has been fixed upstream in version 17.04.2. Workaround ========== None. Description =========== KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network. Impact ====== A remote attacker who is sniffing the network may be able to obtain sensitive information when an email that should be encrypted is sent via the "Send Later with Delay" function. References ========== https://www.kde.org/info/security/advisory-20170615-1.txt https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8 https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197 https://security.archlinux.org/CVE-2017-9604

1 0

[arch-security] [ASA-201706-16] kmail: information disclosure
by Levente Polyak 15 Jun '17

15 Jun '17

Arch Linux Security Advisory ASA-201706-16 ========================================== Severity: Medium Date : 2017-06-14 CVE-ID : CVE-2017-9604 Package : kmail Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-299 Summary ======= The package kmail before version 17.04.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 17.04.2-1. # pacman -Syu "kmail>=17.04.2-1" The problem has been fixed upstream in version 17.04.2. Workaround ========== None. Description =========== KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network. Impact ====== A remote attacker who is sniffing the network may be able to obtain sensitive information when an email that should be encrypted is sent via the "Send Later with Delay" function. References ========== https://www.kde.org/info/security/advisory-20170615-1.txt https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8 https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197 https://security.archlinux.org/CVE-2017-9604

1 0

[arch-security] [ASA-201706-15] lib32-flashplugin: arbitrary code execution
by Remi Gacogne 15 Jun '17

15 Jun '17

Arch Linux Security Advisory ASA-201706-15 ========================================== Severity: Critical Date : 2017-06-14 CVE-ID : CVE-2017-3075 CVE-2017-3076 CVE-2017-3077 CVE-2017-3078 CVE-2017-3079 CVE-2017-3081 CVE-2017-3082 CVE-2017-3083 CVE-2017-3084 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-298 Summary ======= The package lib32-flashplugin before version 26.0.0.126-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 26.0.0.126-1. # pacman -Syu "lib32-flashplugin>=26.0.0.126-1" The problems have been fixed upstream in version 26.0.0.126. Workaround ========== None. Description =========== - CVE-2017-3075 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3076 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3077 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3078 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3079 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3081 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3082 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3083 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3084 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-17.html https://security.archlinux.org/CVE-2017-3075 https://security.archlinux.org/CVE-2017-3076 https://security.archlinux.org/CVE-2017-3077 https://security.archlinux.org/CVE-2017-3078 https://security.archlinux.org/CVE-2017-3079 https://security.archlinux.org/CVE-2017-3081 https://security.archlinux.org/CVE-2017-3082 https://security.archlinux.org/CVE-2017-3083 https://security.archlinux.org/CVE-2017-3084

1 0

[arch-security] [ASA-201706-14] flashplugin: arbitrary code execution
by Remi Gacogne 15 Jun '17

15 Jun '17

Arch Linux Security Advisory ASA-201706-14 ========================================== Severity: Critical Date : 2017-06-14 CVE-ID : CVE-2017-3075 CVE-2017-3076 CVE-2017-3077 CVE-2017-3078 CVE-2017-3079 CVE-2017-3081 CVE-2017-3082 CVE-2017-3083 CVE-2017-3084 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-297 Summary ======= The package flashplugin before version 26.0.0.126-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 26.0.0.126-1. # pacman -Syu "flashplugin>=26.0.0.126-1" The problems have been fixed upstream in version 26.0.0.126. Workaround ========== None. Description =========== - CVE-2017-3075 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3076 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3077 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3078 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3079 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3081 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3082 (arbitrary code execution) A memory corruption vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3083 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. - CVE-2017-3084 (arbitrary code execution) A use-after-free vulnerability leading to remote code execution has been found in Adobe Flash Player < 26.0.0.126. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-17.html https://security.archlinux.org/CVE-2017-3075 https://security.archlinux.org/CVE-2017-3076 https://security.archlinux.org/CVE-2017-3077 https://security.archlinux.org/CVE-2017-3078 https://security.archlinux.org/CVE-2017-3079 https://security.archlinux.org/CVE-2017-3081 https://security.archlinux.org/CVE-2017-3082 https://security.archlinux.org/CVE-2017-3083 https://security.archlinux.org/CVE-2017-3084

1 0