- Arch-security - lists.archlinux.org

[arch-security] [ASA-201703-16] mbedtls: arbitrary code execution
by Remi Gacogne 20 Mar '17

20 Mar '17

Arch Linux Security Advisory ASA-201703-16 ========================================== Severity: Critical Date : 2017-03-20 CVE-ID : CVE-2017-2784 Package : mbedtls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-198 Summary ======= The package mbedtls before version 2.4.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.4.2-1. # pacman -Syu "mbedtls>=2.4.2-1" The problem has been fixed upstream in version 2.4.2. Workaround ========== None. Description =========== A security issue has been found in mbed TLS < 2.4.2. If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service (client crash) or potentially could be exploited to allow remote code execution with the same privileges as the host application. Impact ====== A remote attacker can cause a denial of service or execute arbitrary code on the affected host via a crafted certificate. References ========== https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://security.archlinux.org/CVE-2017-2784

1 0

[arch-security] [ASA-201703-15] firefox: arbitrary code execution
by Remi Gacogne 20 Mar '17

20 Mar '17

Arch Linux Security Advisory ASA-201703-15 ========================================== Severity: High Date : 2017-03-18 CVE-ID : CVE-2017-5428 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-219 Summary ======= The package firefox before version 52.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 52.0.1-1. # pacman -Syu "firefox>=52.0.1-1" The problem has been fixed upstream in version 52.0.1. Workaround ========== None. Description =========== An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/#CVE-2017-5428 https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 https://security.archlinux.org/CVE-2017-5428

1 0

[arch-security] [ASA-201703-14] wordpress: multiple issues
by Remi Gacogne 18 Mar '17

18 Mar '17

Arch Linux Security Advisory ASA-201703-14 ========================================== Severity: Medium Date : 2017-03-16 CVE-ID : CVE-2017-6814 CVE-2017-6815 CVE-2017-6816 CVE-2017-6817 CVE-2017-6818 CVE-2017-6819 Package : wordpress Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-202 Summary ======= The package wordpress before version 4.7.3-1 is vulnerable to multiple issues including cross-site request forgery, cross-site scripting and insufficient validation. Resolution ========== Upgrade to 4.7.3-1. # pacman -Syu "wordpress>=4.7.3-1" The problems have been fixed upstream in version 4.7.3. Workaround ========== None. Description =========== - CVE-2017-6814 (cross-site scripting) An authenticated cross-site scripting (XSS) vulnerability has been discovered in WordPress before 4.7.3 via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp- includes/js/mediaelement/wp-playlist.js. - CVE-2017-6815 (insufficient validation) A vulnerability has been discovered in WordPress before 4.7.3 (wp- includes/pluggable.php) that certain control characters can trick redirect URL validation. - CVE-2017-6816 (insufficient validation) It has been discovered that unintended files can be deleted by administrators in WordPress before 4.7.3 (wp-admin/plugins.php) using the plugin deletion functionality. - CVE-2017-6817 (cross-site scripting) An authenticated cross-site scripting (XSS) vulnerability has been discovered in in WordPress before 4.7.3 (wp-includes/embed.php) via YouTube URL Embeds. - CVE-2017-6818 (cross-site scripting) A cross-site scripting (XSS) vulnerability has been discovered in WordPress before 4.7.3 (wp-admin/js/tags-box.js) via taxonomy term names. - CVE-2017-6819 (cross-site request forgery) A cross-site request forgery (CSRF) vulnerability exists on the Press This page of WordPress. This issue can be used to create a Denial of Service (DoS) condition if an authenticated administrator visits a malicious URL. Impact ====== A remote attacker is able to execute arbitrary javascript on the clients machine or perform a denial of service attack against the server by tricking an administrator to visit a certain site. Furthermore a malicious administrator is able to delete unintended files from the server. References ========== https://codex.wordpress.org/Version_4.7.3 https://github.com/WordPress/WordPress/commit/28f838ca3ee205b6f39cd2bf23eb4… https://sumofpwn.nl/advisory/2016/wordpress_audio_playlist_functionality_is… https://wordpress.org/news/2017/03/wordpress-4-7-3-security-and-maintenance… https://github.com/WordPress/WordPress/commit/288cd469396cfe7055972b457eb58… https://github.com/WordPress/WordPress/commit/4d80f8b3e1b00a3edcee0774dc9c2… https://github.com/WordPress/WordPress/commit/419c8d97ce8df7d5004ee0b566bc5… https://github.com/WordPress/WordPress/commit/9092fd01e1f452f37c313d38b18f9… https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_wordpress_p… https://github.com/WordPress/WordPress/commit/263831a72d08556bc2f3a328673d9… https://security.archlinux.org/CVE-2017-6814 https://security.archlinux.org/CVE-2017-6815 https://security.archlinux.org/CVE-2017-6816 https://security.archlinux.org/CVE-2017-6817 https://security.archlinux.org/CVE-2017-6818 https://security.archlinux.org/CVE-2017-6819

1 0

[arch-security] [ASA-201703-13] linux-zen: privilege escalation
by Levente Polyak 16 Mar '17

16 Mar '17

Arch Linux Security Advisory ASA-201703-13 ========================================== Severity: High Date : 2017-03-16 CVE-ID : CVE-2017-2636 Package : linux-zen Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-203 Summary ======= The package linux-zen before version 4.10.2-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.10.2-1. # pacman -Syu "linux-zen>=4.10.2-1" The problem has been fixed upstream in version 4.10.2. Workaround ========== # echo "install n_hdlc /bin/true" >> /etc/modprobe.d/disable- n_hdlc.conf Description =========== A race condition flaw was found in the N_HLDC Linux kernel driver when accessing the n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to crash the system or increase their privileges on the system. Impact ====== A local attacker is able to escalate privileges or crash the system. References ========== https://bugs.archlinux.org/task/53242 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… http://seclists.org/oss-sec/2017/q1/569 https://security.archlinux.org/CVE-2017-2636

1 0

[arch-security] [ASA-201703-12] lib32-flashplugin: multiple issues
by Remi Gacogne 15 Mar '17

15 Mar '17

Arch Linux Security Advisory ASA-201703-12 ========================================== Severity: Critical Date : 2017-03-15 CVE-ID : CVE-2017-2997 CVE-2017-2998 CVE-2017-2999 CVE-2017-3000 CVE-2017-3001 CVE-2017-3002 CVE-2017-3003 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-209 Summary ======= The package lib32-flashplugin before version 25.0.0.127-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 25.0.0.127-1. # pacman -Syu "lib32-flashplugin>=25.0.0.127-1" The problems have been fixed upstream in version 25.0.0.127. Workaround ========== None. Description =========== - CVE-2017-2997 (arbitrary code execution) A buffer overflow vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-2998 (arbitrary code execution) A memory corruption vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-2999 (arbitrary code execution) A memory corruption vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3000 (information disclosure) A random number generator vulnerability used for constant blinding that could lead to information disclosure has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3001 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3002 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3003 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-07.html https://security.archlinux.org/CVE-2017-2997 https://security.archlinux.org/CVE-2017-2998 https://security.archlinux.org/CVE-2017-2999 https://security.archlinux.org/CVE-2017-3000 https://security.archlinux.org/CVE-2017-3001 https://security.archlinux.org/CVE-2017-3002 https://security.archlinux.org/CVE-2017-3003

1 0

[arch-security] [ASA-201703-11] flashplugin: multiple issues
by Remi Gacogne 15 Mar '17

15 Mar '17

Arch Linux Security Advisory ASA-201703-11 ========================================== Severity: Critical Date : 2017-03-15 CVE-ID : CVE-2017-2997 CVE-2017-2998 CVE-2017-2999 CVE-2017-3000 CVE-2017-3001 CVE-2017-3002 CVE-2017-3003 Package : flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-208 Summary ======= The package flashplugin before version 25.0.0.127-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 25.0.0.127-1. # pacman -Syu "flashplugin>=25.0.0.127-1" The problems have been fixed upstream in version 25.0.0.127. Workaround ========== None. Description =========== - CVE-2017-2997 (arbitrary code execution) A buffer overflow vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-2998 (arbitrary code execution) A memory corruption vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-2999 (arbitrary code execution) A memory corruption vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3000 (information disclosure) A random number generator vulnerability used for constant blinding that could lead to information disclosure has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3001 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3002 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. - CVE-2017-3003 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player <= 24.0.0.221. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-07.html https://security.archlinux.org/CVE-2017-2997 https://security.archlinux.org/CVE-2017-2998 https://security.archlinux.org/CVE-2017-2999 https://security.archlinux.org/CVE-2017-3000 https://security.archlinux.org/CVE-2017-3001 https://security.archlinux.org/CVE-2017-3002 https://security.archlinux.org/CVE-2017-3003

1 0

[arch-security] [ASA-201703-10] roundcubemail: cross-site scripting
by Levente Polyak 14 Mar '17

14 Mar '17

Arch Linux Security Advisory ASA-201703-10 ========================================== Severity: Medium Date : 2017-03-14 CVE-ID : CVE-2017-6820 Package : roundcubemail Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-199 Summary ======= The package roundcubemail before version 1.2.4-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.2.4-1. # pacman -Syu "roundcubemail>=1.2.4-1" The problem has been fixed upstream in version 1.2.4. Workaround ========== None. Description =========== It has been discovered that rcube_utils.php in Roundcube before 1.1.8 and before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets (CSS) token sequence within an SVG element. Impact ====== A remote attacker is able to use a specially crafted SVG file to execute arbitrary javascript on the client's machine. References ========== http://seclists.org/oss-sec/2017/q1/583 https://roundcube.net/news/2017/03/10/updates-1.2.4-and-1.1.8-released https://github.com/roundcube/roundcubemail/commit/fa2824fdcd44af3f970b2797f… https://github.com/roundcube/roundcubemail/commit/cbd35626f7db7855f3b5e2db0… https://security.archlinux.org/CVE-2017-6820

1 0

[arch-security] [ASA-201703-9] jasper: multiple issues
by Levente Polyak 14 Mar '17

14 Mar '17

Arch Linux Security Advisory ASA-201703-9 ========================================= Severity: High Date : 2017-03-14 CVE-ID : CVE-2016-8886 CVE-2016-9591 Package : jasper Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-69 Summary ======= The package jasper before version 2.0.12-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.0.12-1. # pacman -Syu "jasper>=2.0.12-1" The problems have been fixed upstream in version 2.0.12. Workaround ========== None. Description =========== - CVE-2016-8886 (denial of service) A memory allocation failure was found in jas_malloc triggered by a crafted file that results in an application crash leading to denial of service. - CVE-2016-9591 (arbitrary code execution) A heap-use-after-free vulnerability has been found in jasper. The vulnerability exists in code responsible for re-encoding the decoded input image file to a J2P image. The vulnerability is caused by not setting related pointers to be null after the pointers are freed (i.e. missing Setting-Pointer-Null operations after free). The vulnerability can further cause double-free. Impact ====== A remote attacker is able to use specially crafted images that, when processed, lead to arbitrary code execution or application crash. References ========== http://seclists.org/oss-sec/2016/q4/214 https://blogs.gentoo.org/ago/2016/10/18/jasper-memory-allocation-failure-in… https://github.com/mdadams/jasper/commit/65536647d380571d1a9a6c91fa03775fb5… https://github.com/mdadams/jasper/issues/105 http://www.openwall.com/lists/oss-security/2016/12/16/3 https://github.com/mdadams/jasper/commit/03fe49ab96bf65fea784cdc256507ea882… https://security.archlinux.org/CVE-2016-8886 https://security.archlinux.org/CVE-2016-9591

1 0

[arch-security] [ASA-201703-8] linux: privilege escalation
by Santiago Torres-Arias 14 Mar '17

14 Mar '17

Arch Linux Security Advisory ASA-201703-8 ========================================= Severity: High Date : 2017-03-14 CVE-ID : CVE-2017-2636 Package : linux Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-192 Summary ======= The package linux before version 4.10.2-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.10.2-1. # pacman -Syu "linux>=4.10.2-1" The problem has been fixed upstream in version 4.10.2. Workaround ========== # echo "install n_hdlc /bin/true" >> /etc/modprobe.d/disable- n_hdlc.conf Description =========== A race condition flaw was found in the N_HLDC Linux kernel driver when accessing the n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to crash the system or increase their privileges on the system. Impact ====== A local attacker is able to escalate privileges or crash the system. References ========== https://bugs.archlinux.org/task/53242 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… http://seclists.org/oss-sec/2017/q1/569 https://security.archlinux.org/CVE-2017-2636

1 0

[arch-security] [ASA-201703-7] linux-grsec: privilege escalation
by Levente Polyak 13 Mar '17

13 Mar '17

Arch Linux Security Advisory ASA-201703-7 ========================================= Severity: Low Date : 2017-03-13 CVE-ID : CVE-2017-2636 Package : linux-grsec Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-201 Summary ======= The package linux-grsec before version 1:4.9.14.r201703121245-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1:4.9.14.r201703121245-1. # pacman -Syu "linux-grsec>=1:4.9.14.r201703121245-1" The problem has been fixed upstream in version 4.9.14.r201703121245. Workaround ========== # echo "install n_hdlc /bin/true" >> /etc/modprobe.d/disable- n_hdlc.conf Description =========== A race condition flaw was found in the N_HLDC Linux kernel driver when accessing the n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to crash the system or increase their privileges on the system. Impact ====== A local attacker is able to escalate privileges or crash the system if the n_hdlc kernel module has already been explicitly loaded by an administrator. References ========== https://bugs.archlinux.org/task/53242 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… http://seclists.org/oss-sec/2017/q1/569 https://security.archlinux.org/CVE-2017-2636

1 0