- Arch-security - lists.archlinux.org

[arch-security] [ASA-201701-36] lib32-openssl: multiple issues
by Christian Rebischke 29 Jan '17

29 Jan '17

Arch Linux Security Advisory ASA-201701-36 ========================================== Severity: Medium Date : 2017-01-27 CVE-ID : CVE-2016-7055 CVE-2017-3731 CVE-2017-3732 Package : lib32-openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-155 Summary ======= The package lib32-openssl before version 1:1.0.2.k-1 is vulnerable to multiple issues including denial of service, incorrect calculation and information disclosure. Resolution ========== Upgrade to 1:1.0.2.k-1. # pacman -Syu "lib32-openssl>=1:1.0.2.k-1" The problems have been fixed upstream in version 1.0.2.k. Workaround ========== None. Description =========== - CVE-2016-7055 (incorrect calculation) There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input of the attacker's direct choice. Otherwise the bug can manifest itself as transient authentication and key negotiation failures or reproducible erroneous outcome of public-key operations with specially crafted input. Among EC algorithms only Brainpool P-512 curves are affected and one presumably can attack ECDH key negotiation. Impact was not analyzed in detail, because pre-requisites for attack are considered unlikely. Namely multiple clients have to choose the curve in question and the server has to share the private key among them, neither of which is default behavior. Even then only clients that chose the curve will be affected. - CVE-2017-3731 (denial of service) If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k. - CVE-2017-3732 (information disclosure) There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem. Impact ====== A remote attacker is able to crash the application, access sensitive information or transiently authenticate against the server. References ========== https://www.openssl.org/news/secadv/20161110.txt https://www.openssl.org/news/secadv/20170126.txt https://github.com/openssl/openssl/commit/57c4b9f6a2f800b41ce2836986fe33640… https://security.archlinux.org/CVE-2016-7055 https://security.archlinux.org/CVE-2017-3731 https://security.archlinux.org/CVE-2017-3732

1 0

[arch-security] [ASA-201701-35] linux-lts: privilege escalation
by Christian Rebischke 27 Jan '17

27 Jan '17

Arch Linux Security Advisory ASA-201701-35 ========================================== Severity: Medium Date : 2017-01-27 CVE-ID : CVE-2017-2583 Package : linux-lts Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-150 Summary ======= The package linux-lts before version 4.4.44-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.4.44-1. # pacman -Syu "linux-lts>=4.4.44-1" The problem has been fixed upstream in version 4.4.44. Workaround ========== None. Description =========== The Linux kernel > 3.6-rc1, when built with Kernel-based Virtual Machine (CONFIG_KVM) support, is vulnerable to an incorrect segment selector (SS) value error. It could occur loading values into SS register in long mode. A user/process inside a guest host could use this flaw to crash the guest, resulting in denial of service, or potentially escalate their privileges inside the guest system on an AMD processor. Impact ====== A local attacker in a guest host is able to crash the system or escalate privileges inside the guest on an AMD processor. References ========== http://seclists.org/oss-sec/2017/q1/137 https://git.kernel.org/linus/33ab91103b3415e12457e3104f0e4517ce12d0f3 https://security.archlinux.org/CVE-2017-2583

1 0

[arch-security] [ASA-201701-34] libimobiledevice: access restriction bypass
by Christian Rebischke 27 Jan '17

27 Jan '17

Arch Linux Security Advisory ASA-201701-34 ========================================== Severity: Medium Date : 2017-01-27 CVE-ID : CVE-2016-5104 Package : libimobiledevice Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-8 Summary ======= The package libimobiledevice before version 1.2.0-4 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 1.2.0-4. # pacman -Syu "libimobiledevice>=1.2.0-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers on the local network to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket. Impact ====== A remote attacker on the local network is able to bypass access restrictions and communicate with services on connected iOS devices. References ========== http://www.openwall.com/lists/oss-security/2016/05/26/6 https://security.archlinux.org/CVE-2016-5104

1 0

[arch-security] [ASA-201701-33] chromium: multiple issues
by Remi Gacogne 27 Jan '17

27 Jan '17

Arch Linux Security Advisory ASA-201701-33 ========================================== Severity: Critical Date : 2017-01-27 CVE-ID : CVE-2017-5006 CVE-2017-5007 CVE-2017-5008 CVE-2017-5009 CVE-2017-5010 CVE-2017-5011 CVE-2017-5012 CVE-2017-5013 CVE-2017-5014 CVE-2017-5015 CVE-2017-5016 CVE-2017-5017 CVE-2017-5018 CVE-2017-5019 CVE-2017-5020 CVE-2017-5021 CVE-2017-5022 CVE-2017-5023 CVE-2017-5024 CVE-2017-5025 CVE-2017-5026 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-156 Summary ======= The package chromium before version 56.0.2924.76-1 is vulnerable to multiple issues including arbitrary code execution, arbitrary filesystem access, cross-site scripting, content spoofing, information disclosure, access restriction bypass and denial of service. Resolution ========== Upgrade to 56.0.2924.76-1. # pacman -Syu "chromium>=56.0.2924.76-1" The problems have been fixed upstream in version 56.0.2924.76. Workaround ========== None. Description =========== - CVE-2017-5006 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2017-5007 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2017-5008 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2017-5009 (arbitrary code execution) An out of bounds memory access flaw was found in the WebRTC component of the Chromium browser. - CVE-2017-5010 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2017-5011 (arbitrary filesystem access) An unauthorised file access flaw was found in the Devtools component of the Chromium browser. - CVE-2017-5012 (arbitrary code execution) A heap overflow flaw was found in the V8 component of the Chromium browser. - CVE-2017-5013 (content spoofing) An address spoofing flaw was found in the Omnibox component of the Chromium browser - CVE-2017-5014 (arbitrary code execution) A heap overflow flaw was found in the Skia component of the Chromium browser. - CVE-2017-5015 (content spoofing) An address spoofing flaw was found in the Omnibox component of the Chromium browser. - CVE-2017-5016 (content spoofing) An UI spoofing flaw was found in the Blink component of the Chromium browser. - CVE-2017-5017 (information disclosure) An uninitialised memory access flaw was found in the webm video component of the Chromium browser. - CVE-2017-5018 (cross-site scripting) An universal XSS flaw was found in the chrome://apps component of the Chromium browser. - CVE-2017-5019 (arbitrary code execution) An use after free flaw was found in the Renderer component of the Chromium browser. - CVE-2017-5020 (cross-site scripting) An universal XSS flaw was found in the chrome://downloads component of the Chromium browser. - CVE-2017-5021 (arbitrary code execution) A use-after-free flaw was found in the Extensions component of the Chromium browser. - CVE-2017-5022 (access restriction bypass) A bypass of content security policy flaw was found in the Blink component of the Chromium browser. - CVE-2017-5023 (denial of service) A type confusion flaw was found in the metrics component of the Chromium browser. - CVE-2017-5024 (arbitrary code execution) A heap overflow flaw was found in the FFmpeg component of the Chromium browser. - CVE-2017-5025 (arbitrary code execution) A heap overflow flaw was found in the FFmpeg component of the Chromium browser. - CVE-2017-5026 (content spoofing) A UI spoofing flaw was found in the Chromium browser. Impact ====== A remote attacker can access sensitive information and arbitrary files, bypass security restrictions, spoof content and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/01/stable-channel-update-for-des… https://bugzilla.redhat.com/show_bug.cgi?id=1416658 https://code.google.com/p/chromium/issues/detail?id=673170 https://code.google.com/p/chromium/issues/detail?id=671102 https://bugzilla.redhat.com/show_bug.cgi?id=1416657 https://bugzilla.redhat.com/show_bug.cgi?id=1416659 https://code.google.com/p/chromium/issues/detail?id=668552 https://bugzilla.redhat.com/show_bug.cgi?id=1416662 https://code.google.com/p/chromium/issues/detail?id=667504 https://bugzilla.redhat.com/show_bug.cgi?id=1416660 https://code.google.com/p/chromium/issues/detail?id=663476 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-5011 https://code.google.com/p/chromium/issues/detail?id=662859 https://bugzilla.redhat.com/show_bug.cgi?id=1416663 https://code.google.com/p/chromium/issues/detail?id=681843 https://code.google.com/p/chromium/issues/detail?id=677716 https://bugzilla.redhat.com/show_bug.cgi?id=1416664 https://bugzilla.redhat.com/show_bug.cgi?id=1416665 https://code.google.com/p/chromium/issues/detail?id=675332 https://bugzilla.redhat.com/show_bug.cgi?id=1416666 https://code.google.com/p/chromium/issues/detail?id=673971 https://bugzilla.redhat.com/show_bug.cgi?id=1416668 https://code.google.com/p/chromium/issues/detail?id=673163 https://bugzilla.redhat.com/show_bug.cgi?id=1416669 https://code.google.com/p/chromium/issues/detail?id=676975 https://bugzilla.redhat.com/show_bug.cgi?id=1416670 https://code.google.com/p/chromium/issues/detail?id=668665 https://bugzilla.redhat.com/show_bug.cgi?id=1416667 https://code.google.com/p/chromium/issues/detail?id=666714 https://bugzilla.redhat.com/show_bug.cgi?id=1416671 https://code.google.com/p/chromium/issues/detail?id=668653 https://bugzilla.redhat.com/show_bug.cgi?id=1416672 https://code.google.com/p/chromium/issues/detail?id=663726 https://bugzilla.redhat.com/show_bug.cgi?id=1416673 https://code.google.com/p/chromium/issues/detail?id=663620 https://bugzilla.redhat.com/show_bug.cgi?id=1416674 https://code.google.com/p/chromium/issues/detail?id=651443 https://bugzilla.redhat.com/show_bug.cgi?id=1416675 https://code.google.com/p/chromium/issues/detail?id=643951 https://code.google.com/p/chromium/issues/detail?id=643950 https://bugzilla.redhat.com/show_bug.cgi?id=1416676 https://code.google.com/p/chromium/issues/detail?id=634108 https://bugzilla.redhat.com/show_bug.cgi?id=1416677 https://security.archlinux.org/CVE-2017-5006 https://security.archlinux.org/CVE-2017-5007 https://security.archlinux.org/CVE-2017-5008 https://security.archlinux.org/CVE-2017-5009 https://security.archlinux.org/CVE-2017-5010 https://security.archlinux.org/CVE-2017-5011 https://security.archlinux.org/CVE-2017-5012 https://security.archlinux.org/CVE-2017-5013 https://security.archlinux.org/CVE-2017-5014 https://security.archlinux.org/CVE-2017-5015 https://security.archlinux.org/CVE-2017-5016 https://security.archlinux.org/CVE-2017-5017 https://security.archlinux.org/CVE-2017-5018 https://security.archlinux.org/CVE-2017-5019 https://security.archlinux.org/CVE-2017-5020 https://security.archlinux.org/CVE-2017-5021 https://security.archlinux.org/CVE-2017-5022 https://security.archlinux.org/CVE-2017-5023 https://security.archlinux.org/CVE-2017-5024 https://security.archlinux.org/CVE-2017-5025 https://security.archlinux.org/CVE-2017-5026

1 0

[arch-security] [ASA-201701-32] linux: privilege escalation
by Christian Rebischke 27 Jan '17

27 Jan '17

Arch Linux Security Advisory ASA-201701-32 ========================================== Severity: Medium Date : 2017-01-27 CVE-ID : CVE-2017-2583 Package : linux Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-149 Summary ======= The package linux before version 4.9.5-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.9.5-1. # pacman -Syu "linux>=4.9.5-1" The problem has been fixed upstream in version 4.9.5. Workaround ========== None. Description =========== The Linux kernel > 3.6-rc1, when built with Kernel-based Virtual Machine (CONFIG_KVM) support, is vulnerable to an incorrect segment selector (SS) value error. It could occur loading values into SS register in long mode. A user/process inside a guest host could use this flaw to crash the guest, resulting in denial of service, or potentially escalate their privileges inside the guest system on an AMD processor. Impact ====== A local attacker in a guest host is able to crash the system or escalate privileges inside the guest on an AMD processor. References ========== http://seclists.org/oss-sec/2017/q1/137 https://git.kernel.org/linus/33ab91103b3415e12457e3104f0e4517ce12d0f3 https://security.archlinux.org/CVE-2017-2583

1 0

[arch-security] [ASA-201701-31] ed: denial of service
by Santiago Torres-Arias 25 Jan '17

25 Jan '17

Arch Linux Security Advisory ASA-201701-31 ========================================== Severity: Low Date : 2017-01-25 CVE-ID : CVE-2017-5357 Package : ed Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-145 Summary ======= The package ed before version 1.14.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.14.1-1. # pacman -Syu "ed>=1.14.1-1" The problem has been fixed upstream in version 1.14.1. Workaround ========== None. Description =========== A vulnerability was found in GNU ed. An invalid free might occur while parsing specially crafted commands which will make the application crash. Impact ====== A local attacker is able to crash the application by providing malicious input. References ========== https://lists.gnu.org/archive/html/bug-ed/2017-01/msg00000.html http://www.openwall.com/lists/oss-security/2017/01/12/5 https://security.archlinux.org/CVE-2017-5357

1 0

[arch-security] [ASA-201701-30] powerdns-recursor: multiple issues
by Levente Polyak 20 Jan '17

20 Jan '17

Arch Linux Security Advisory ASA-201701-30 ========================================== Severity: Medium Date : 2017-01-19 CVE-ID : CVE-2016-7068 CVE-2016-7073 CVE-2016-7074 Package : powerdns-recursor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-148 Summary ======= The package powerdns-recursor before version 4.0.4-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 4.0.4-1. # pacman -Syu "powerdns-recursor>=4.0.4-1" The problems have been fixed upstream in version 4.0.4. Workaround ========== None. Description =========== - CVE-2016-7068 (denial of service) An issue has been found in PowerDNS allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour. - CVE-2016-7073 (insufficient validation) An issue has been found in PowerDNS Authoritative Server and PowerDNS Recursor allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values in AXFRRetriever, leading to a possible replay attack. - CVE-2016-7074 (insufficient validation) An issue has been found in PowerDNS Authoritative Server and PowerDNS Recursor allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature. Impact ====== A remote attacker is able to perform a denial of service attack or bypass certain verification possibly leading to a replay attack. References ========== http://seclists.org/oss-sec/2017/q1/97 https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/ https://security.archlinux.org/CVE-2016-7068 https://security.archlinux.org/CVE-2016-7073 https://security.archlinux.org/CVE-2016-7074

1 0

[arch-security] [ASA-201701-29] powerdns: multiple issues
by Levente Polyak 20 Jan '17

20 Jan '17

Arch Linux Security Advisory ASA-201701-29 ========================================== Severity: Medium Date : 2017-01-19 CVE-ID : CVE-2016-2120 CVE-2016-7068 CVE-2016-7072 CVE-2016-7073 CVE-2016-7074 Package : powerdns Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-147 Summary ======= The package powerdns before version 4.0.2-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 4.0.2-1. # pacman -Syu "powerdns>=4.0.2-1" The problems have been fixed upstream in version 4.0.2. Workaround ========== None. Description =========== - CVE-2016-2120 (denial of service) An issue has been found in PowerDNS Authoritative Server allowing an authorized user to crash the server by inserting a specially crafted record in a zone under their control then sending a DNS query for that record. The issue is due to an integer overflow when checking if the content of the record matches the expected size, allowing an attacker to cause a read past the buffer boundary. - CVE-2016-7068 (denial of service) An issue has been found in PowerDNS allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the PowerDNS server by sending crafted DNS queries, which might result in a partial denial of service if the system becomes overloaded. This issue is based on the fact that the PowerDNS server parses all records present in a query regardless of whether they are needed or even legitimate. A specially crafted query containing a large number of records can be used to take advantage of that behaviour. - CVE-2016-7072 (denial of service) An issue has been found in PowerDNS Authoritative Server allowing a remote, unauthenticated attacker to cause a denial of service by opening a large number of TCP connections to the web server. If the web server runs out of file descriptors, it triggers an exception and terminates the whole PowerDNS process. While it's more complicated for an unauthorized attacker to make the web server run out of file descriptors since its connection will be closed just after being accepted, it might still be possible. - CVE-2016-7073 (insufficient validation) An issue has been found in PowerDNS Authoritative Server and PowerDNS Recursor allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values in AXFRRetriever, leading to a possible replay attack. - CVE-2016-7074 (insufficient validation) An issue has been found in PowerDNS Authoritative Server and PowerDNS Recursor allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check that the TSIG record is the last one, leading to the possibility of parsing records that are not covered by the TSIG signature. Impact ====== A remote attacker is able to perform a denial of service attack or bypass certain verification possibly leading to a replay attack. References ========== http://seclists.org/oss-sec/2017/q1/97 https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/ https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/ https://security.archlinux.org/CVE-2016-2120 https://security.archlinux.org/CVE-2016-7068 https://security.archlinux.org/CVE-2016-7072 https://security.archlinux.org/CVE-2016-7073 https://security.archlinux.org/CVE-2016-7074

1 0

[arch-security] [ASA-201701-28] php: multiple issues
by Santiago Torres-Arias 19 Jan '17

19 Jan '17

Arch Linux Security Advisory ASA-201701-28 ========================================== Severity: High Date : 2017-01-19 CVE-ID : CVE-2016-9935 CVE-2016-9936 CVE-2017-5340 Package : php Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-105 Summary ======= The package php before version 7.1.1-0 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.1.1-0. # pacman -Syu "php>=7.1.1-0" The problems have been fixed upstream in version 7.1.1. Workaround ========== None. Description =========== - CVE-2016-9935 (denial of service) The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document. - CVE-2016-9936 (arbitrary code execution) The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after- free) or possibly execute arbitrary code via crafted serialized data. - CVE-2017-5340 (arbitrary code execution) It was found that PHP uses uninitialized memory during calls to `unserialize()`. The payload supplied to `unserialize()` may control this uninitialized memory region and thus may be used to trick PHP into operating on faked objects and calling attacker controlled destructor function pointers, effectively allowing arbitrary code execution via specially crafted serialized data. Impact ====== A remote attacker is able to use specially crafted input to perform a denial of service attack or execute arbitrary code on the affected host. References ========== http://www.openwall.com/lists/oss-security/2016/12/12/2 https://bugs.php.net/bug.php?id=73631 https://github.com/php/php-src/commit/66fd44209d5ffcb9b3d1bc1b9fd8e35b48504… http://seclists.org/oss-sec/2016/q4/658 https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372… https://bugs.php.net/bug.php?id=72978 https://bugs.php.net/bug.php?id=73832 https://security.archlinux.org/CVE-2016-9935 https://security.archlinux.org/CVE-2016-9936 https://security.archlinux.org/CVE-2017-5340

1 0

[arch-security] [ASA-201701-27] webkit2gtk: multiple issues
by Remi Gacogne 18 Jan '17

18 Jan '17

Arch Linux Security Advisory ASA-201701-27 ========================================== Severity: Critical Date : 2017-01-18 CVE-ID : CVE-2016-7586 CVE-2016-7589 CVE-2016-7592 CVE-2016-7599 CVE-2016-7623 CVE-2016-7632 CVE-2016-7635 CVE-2016-7639 CVE-2016-7641 CVE-2016-7645 CVE-2016-7652 CVE-2016-7654 CVE-2016-7656 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-146 Summary ======= The package webkit2gtk before version 2.14.3-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2.14.3-1. # pacman -Syu "webkit2gtk>=2.14.3-1" The problems have been fixed upstream in version 2.14.3. Workaround ========== None. Description =========== - CVE-2016-7586 (information disclosure) A validation issue was found in WebKitGTK+ < 2.14.3, leading to the potential disclosure of user information while processing maliciously crafted web content. The issue was fixed through improved state management. - CVE-2016-7589 (arbitrary code execution) A memory corruption issue was found in WebKitGTK+ < 2.14.3, leading to potential arbitrary code execution while processing maliciously crafted web content. The issue was fixed through improved state management. - CVE-2016-7592 (information disclosure) An issue in the handling of JavaScript prompts was found in WebKitGTK+ < 2.14.3, leading to potential compromise of user information while processing maliciously crafted web content. The issue was fixed through improved state management. - CVE-2016-7599 (information disclosure) An issue in the handling of HTTP redirects was found in WebKitGTK+ < 2.14.3, leading to potential disclosure of user information while processing maliciously crafted web content. This issue was addressed through improved cross origin validation. - CVE-2016-7623 (information disclosure) An issue in the handling of blob URLs was found in WebKitGTK+ < 2.14.3, leading to potential compromise of user information while processing maliciously crafted web content. This issue was addressed through improved URL handling. - CVE-2016-7632 (arbitrary code execution) A memory corruption issue was found in WebKitGTK+ < 2.14.3, leading to denial of service or arbitrary code execution while processing maliciously crafted web content. This issue was addressed through improved state management. - CVE-2016-7635 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved memory handling. - CVE-2016-7639 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved state management. - CVE-2016-7641 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved state management. - CVE-2016-7645 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved state management. - CVE-2016-7652 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved memory handling. - CVE-2016-7654 (arbitrary code execution) Multiple memory corruption issues were found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issues were addressed through improved state management. - CVE-2016-7656 (arbitrary code execution) A memory corruption issue was found in WebKitGTK+ < 2.14.3, leading to arbitrary code execution while processing maliciously crafted web content. This issue was addressed through improved state management. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host via a maliciously crafted web content. References ========== https://webkitgtk.org/security/WSA-2017-0001.html https://security.archlinux.org/CVE-2016-7586 https://security.archlinux.org/CVE-2016-7589 https://security.archlinux.org/CVE-2016-7592 https://security.archlinux.org/CVE-2016-7599 https://security.archlinux.org/CVE-2016-7623 https://security.archlinux.org/CVE-2016-7632 https://security.archlinux.org/CVE-2016-7635 https://security.archlinux.org/CVE-2016-7639 https://security.archlinux.org/CVE-2016-7641 https://security.archlinux.org/CVE-2016-7645 https://security.archlinux.org/CVE-2016-7652 https://security.archlinux.org/CVE-2016-7654 https://security.archlinux.org/CVE-2016-7656

1 0