- Arch-security - lists.archlinux.org

[arch-security] [ASA-201701-26] python-crypto: arbitrary code execution
by Levente Polyak 16 Jan '17

16 Jan '17

Arch Linux Security Advisory ASA-201701-26 ========================================== Severity: Critical Date : 2017-01-15 CVE-ID : CVE-2013-7459 Package : python-crypto Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-118 Summary ======= The package python-crypto before version 2.6.1-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.6.1-5. # pacman -Syu "python-crypto>=2.6.1-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this issue. Impact ====== A remote attacker is able to execute arbitrary code by passing certain parameters to the AES module. References ========== https://github.com/dlitz/pycrypto/issues/176 https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf… http://seclists.org/oss-sec/2016/q4/760 https://security.archlinux.org/CVE-2013-7459

1 0

[arch-security] [ASA-201701-25] python2-crypto: arbitrary code execution
by Levente Polyak 16 Jan '17

16 Jan '17

Arch Linux Security Advisory ASA-201701-25 ========================================== Severity: Critical Date : 2017-01-15 CVE-ID : CVE-2013-7459 Package : python2-crypto Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-118 Summary ======= The package python2-crypto before version 2.6.1-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.6.1-5. # pacman -Syu "python2-crypto>=2.6.1-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap-buffer overflow vulnerability was discovered in pycrypto leading to arbitrary code execution. All users of pycrypto's AES module that allow the mode of operation to be specified by an attacker, check for ECB explicitly and create the objects without specifying an IV are vulnerable to this issue. Impact ====== A remote attacker is able to execute arbitrary code by passing certain parameters to the AES module. References ========== https://github.com/dlitz/pycrypto/issues/176 https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf… http://seclists.org/oss-sec/2016/q4/760 https://security.archlinux.org/CVE-2013-7459

1 0

[arch-security] [ASA-201701-24] nginx-mainline: privilege escalation
by Levente Polyak 15 Jan '17

15 Jan '17

Arch Linux Security Advisory ASA-201701-24 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-1247 Package : nginx-mainline Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-139 Summary ======= The package nginx-mainline before version 1.11.8-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.11.8-2. # pacman -Syu "nginx-mainline>=1.11.8-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A symlink attack vulnerability was discovered in nginx. An attacker who could already run commands under the nginx user id could use this access to append data to files owned by root, potentially elevating their own privileges to root. Impact ====== A remote attacker who managed to compromise a web application is able to obtain root privileges on the affected host. References ========== https://bugs.archlinux.org/task/52547 https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016… https://security.archlinux.org/CVE-2016-1247

1 0

[arch-security] [ASA-201701-23] nginx: privilege escalation
by Levente Polyak 15 Jan '17

15 Jan '17

Arch Linux Security Advisory ASA-201701-23 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-1247 Package : nginx Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-138 Summary ======= The package nginx before version 1.10.2-3 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.10.2-3. # pacman -Syu "nginx>=1.10.2-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A symlink attack vulnerability was discovered in nginx. An attacker who could already run commands under the nginx user id could use this access to append data to files owned by root, potentially elevating their own privileges to root. Impact ====== A remote attacker who managed to compromise a web application is able to obtain root privileges on the affected host. References ========== https://bugs.archlinux.org/task/52546 https://legalhackers.com/advisories/Nginx-Exploit-Deb-Root-PrivEsc-CVE-2016… https://security.archlinux.org/CVE-2016-1247

1 0

[arch-security] [ASA-201701-22] wordpress: multiple issues
by Levente Polyak 15 Jan '17

15 Jan '17

Arch Linux Security Advisory ASA-201701-22 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-10033 CVE-2016-10045 CVE-2017-5487 CVE-2017-5488 CVE-2017-5489 CVE-2017-5490 CVE-2017-5491 CVE-2017-5492 CVE-2017-5493 Package : wordpress Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-142 Summary ======= The package wordpress before version 4.7.1-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, access restriction bypass, cross-site request forgery and insufficient validation. Resolution ========== Upgrade to 4.7.1-1. # pacman -Syu "wordpress>=4.7.1-1" The problems have been fixed upstream in version 4.7.1. Workaround ========== None. Description =========== - CVE-2016-10033 (arbitrary code execution) A vulnerability has been discovered in PHPMailer that could potentially be used by unauthenticated remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application. This issue can be triggered by passing a maliciously crafted expression to the vulnerable application. - CVE-2016-10045 (arbitrary code execution) It has been discovered that the first patch of the vulnerability CVE-2016-10033 in PHPMailer was incomplete and could potentially still be used by unauthenticated remote attackers to achieve remote arbitrary code execution in the context of the web server user and remotely compromise the target web application. This issue can be triggered by passing a maliciously crafted expression to the vulnerable application. - CVE-2017-5487 (access restriction bypass) A vulnerability has been discovered in wordpress exposing user data for all users who had authored a post of a public post type via the REST API. wordpress 4.7.1 limits this to only post types which have specified that they should be shown within the REST API. - CVE-2017-5488 (cross-site scripting) A cross-site scripting (XSS) vulnerability has been discovered in wordpress via the plugin name or version header on update-core.php. - CVE-2017-5489 (cross-site request forgery) A cross-site request forgery (CSRF) bypass has been discovered in wordpress via uploading a Flash file. - CVE-2017-5490 (cross-site scripting) A cross-site scripting (XSS) vulnerability has been discovered in wordpress via theme name fallback. - CVE-2017-5491 (access restriction bypass) A vulnerability has been discovered in wordpress allowing to post via email as it checks for mail.example.com if default settings aren't changed. - CVE-2017-5492 (cross-site request forgery) A cross-site request forgery (CSRF) vulnerability has been discovered in wordpress in the accessibility mode of widget editing. - CVE-2017-5493 (insufficient validation) An insufficient validation vulnerability has been discovered in wordpress leading to weak cryptographic security for multisite activation key. Impact ====== A remote attacker is able to perform a cross-site scripting or cross- site request forgery attack or possibly execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/52555 https://wordpress.org/news/2017/01/wordpress-4-7-1-security-and-maintenance… http://seclists.org/oss-sec/2017/q1/95 https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-… https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-… https://github.com/WordPress/WordPress/commit/daf358983cc1ce0c77bf6d2de2ebb… https://github.com/WordPress/WordPress/commit/c9ea1de1441bb3bda133bf72d513c… https://github.com/WordPress/WordPress/commit/ce7fb2934dd111e6353784852de8a… https://github.com/WordPress/WordPress/commit/061e8788814ac87706d8b95688df2… https://github.com/WordPress/WordPress/commit/03e5c0314aeffe6b27f4b98fef842… https://github.com/WordPress/WordPress/commit/cea9e2dc62abf777e06b12ec4ad9d… https://security.archlinux.org/CVE-2016-10033 https://security.archlinux.org/CVE-2016-10045 https://security.archlinux.org/CVE-2017-5487 https://security.archlinux.org/CVE-2017-5488 https://security.archlinux.org/CVE-2017-5489 https://security.archlinux.org/CVE-2017-5490 https://security.archlinux.org/CVE-2017-5491 https://security.archlinux.org/CVE-2017-5492 https://security.archlinux.org/CVE-2017-5493

1 0

[arch-security] [ASA-201701-21] libgit2: multiple issues
by Levente Polyak 15 Jan '17

15 Jan '17

Arch Linux Security Advisory ASA-201701-21 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-10128 CVE-2016-10129 CVE-2016-10130 Package : libgit2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-131 Summary ======= The package libgit2 before version 1:0.24.6-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation and denial of service. Resolution ========== Upgrade to 1:0.24.6-1. # pacman -Syu "libgit2>=1:0.24.6-1" The problems have been fixed upstream in version 0.24.6. Workaround ========== None. Description =========== - CVE-2016-10128 (arbitrary code execution) Each packet line in the Git protocol is prefixed by a four-byte length of how much data will follow, which we parse in `git_pkt_parse_line`. The transmitted length can either be equal to zero in case of a flush packet or has to be at least of length four, as it also includes the encoded length itself. Not checking this may result in a buffer overflow as it directly passes the length to functions which accept a `size_t` length as parameter. The issue is fixed by verifying that non-flush packets have at least a length of `PKT_LEN_SIZE`. - CVE-2016-10129 (denial of service) The Git protocol does not specify what should happen in the case of an empty packet line (that is a packet line "0004"). currently it indicates success, but does not return a packet in the case where an empty line is hit. The smart protocol was not prepared to handle such packets in all cases, though, resulting in a `NULL` pointer dereference. The issue is fixed by returning an error instead. - CVE-2016-10130 (insufficient validation) An issue has been discovered when checking certificate validity before clobbering the error variable. A valid parameter is provided to indicate whether the native cryptographic library considered the certificate to be correct. This parameter is always 1/true before the fix leading to a possible man-in-the-middle (MITM). Impact ====== A remote attacker is able to perform a man-in-the-middle attack, crash the application or possibly execute arbitrary code on the affected host. References ========== http://www.openwall.com/lists/oss-security/2017/01/11/6 https://github.com/libgit2/libgit2/commit/66e3774d279672ee51c3b54545a79d20d… https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75… https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb… https://security.archlinux.org/CVE-2016-10128 https://security.archlinux.org/CVE-2016-10129 https://security.archlinux.org/CVE-2016-10130

1 0

[arch-security] [ASA-201701-20] libvncserver: arbitrary code execution
by Levente Polyak 13 Jan '17

13 Jan '17

Arch Linux Security Advisory ASA-201701-20 ========================================== Severity: Critical Date : 2017-01-13 CVE-ID : CVE-2016-9941 CVE-2016-9942 Package : libvncserver Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-124 Summary ======= The package libvncserver before version 0.9.11-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.9.11-1. # pacman -Syu "libvncserver>=0.9.11-1" The problems have been fixed upstream in version 0.9.11. Workaround ========== None. Description =========== - CVE-2016-9941 (arbitrary code execution) A heap-based buffer overflow has been discovered in rfbproto.c in the LibVNCClient part of LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message containing a subrectangle outside of the client drawing area. - CVE-2016-9942 (arbitrary code execution) A heap-based buffer overflow has been discovered in ultra.c in LibVNCClient in LibVNCServer before 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message with the Ultra type tile, such that the LZO payload decompressed length exceeds what is specified by the tile dimensions. Impact ====== A remote attacker is able to use specially crafted messages to execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/52481 https://github.com/LibVNC/libvncserver/pull/137 https://security.archlinux.org/CVE-2016-9941 https://security.archlinux.org/CVE-2016-9942

1 0

[arch-security] [ASA-201701-19] docker: privilege escalation
by Jelle van der Waa 13 Jan '17

13 Jan '17

Arch Linux Security Advisory ASA-201701-19 ========================================== Severity: High Date : 2017-01-13 CVE-ID : CVE-2016-9962 Package : docker Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-133 Summary ======= The package docker before version 1:1.12.6-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1:1.12.6-1. # pacman -Syu "docker>=1:1.12.6-1" The problem has been fixed upstream in version 1.12.6. Workaround ========== None. Description =========== The runc component used by `docker exec` feature of docker allowed additional container processes via to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain low-level access to these new processes during initialization. An attacker can, depending on the nature of the incoming process, leverage this to elevate access to the host. This ranges from accessing host content through the file descriptors of the incoming process to, potentially, a complete container escape by leveraging memory access or syscall interception. Impact ====== A local unprivileged attacker when running as root inside a docker container is able to access the host filesystem leading to privilege escalation. References ========== https://bugs.archlinux.org/task/52493 https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3d… https://bugzilla.suse.com/show_bug.cgi?id=1012568 https://github.com/docker/docker/compare/v1.12.5...v1.12.6 https://www.mail-archive.com/fulldisclosure@seclists.org/msg04165.html https://security.archlinux.org/CVE-2016-9962

1 0

[arch-security] [ASA-201701-18] ark: arbitrary command execution
by Remi Gacogne 13 Jan '17

13 Jan '17

Arch Linux Security Advisory ASA-201701-18 ========================================== Severity: High Date : 2017-01-13 CVE-ID : CVE-2017-5330 Package : ark Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-130 Summary ======= The package ark before version 16.12.1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 16.12.1-1. # pacman -Syu "ark>=16.12.1-1" The problem has been fixed upstream in version 16.12.1. Workaround ========== None. Description =========== Opening an url with ark will call KRUN::runURL() which detects the mime-type of the url and runs the appropriate service for that mimetype when found. This leads to unintended execution of scripts and executable files. Impact ====== An attacker can execute arbitrary command on the affected host by tricking a user into opening an executable file from an archive. References ========== http://seclists.org/oss-sec/2017/q1/45 https://cgit.kde.org/ark.git/commit/?id=82fdfd24d46966a117fa625b68784735a40… https://bugs.kde.org/show_bug.cgi?id=374572 https://security.archlinux.org/CVE-2017-5330

1 0

[arch-security] [ASA-201701-17] lib32-flashplugin: multiple issues
by Remi Gacogne 13 Jan '17

13 Jan '17

Arch Linux Security Advisory ASA-201701-17 ========================================== Severity: Critical Date : 2017-01-12 CVE-ID : CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-136 Summary ======= The package lib32-flashplugin before version 24.0.0.194-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 24.0.0.194-1. # pacman -Syu "lib32-flashplugin>=24.0.0.194-1" The problems have been fixed upstream in version 24.0.0.194. Workaround ========== None. Description =========== - CVE-2017-2925 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability in the JPEG XR codec. - CVE-2017-2926 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. - CVE-2017-2927 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing Adobe Texture Format files. - CVE-2017-2928 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to setting visual mode effects. - CVE-2017-2930 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability due to a concurrency error when manipulating a display list. Successful exploitation could lead to arbitrary code execution. - CVE-2017-2931 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to the parsing of SWF metadata. - CVE-2017-2932 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript MovieClip class. - CVE-2017-2933 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability related to texture compression. - CVE-2017-2934 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when parsing Adobe Texture Format files. - CVE-2017-2935 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable heap overflow vulnerability when processing the Flash Video container file format. - CVE-2017-2936 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class. - CVE-2017-2937 (arbitrary code execution) Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable use after free vulnerability in the ActionScript FileReference class, when using class inheritance. - CVE-2017-2938 (information disclosure) Adobe Flash Player versions 24.0.0.186 and earlier have a security bypass vulnerability related to handling TCP connections. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-02.html https://security.archlinux.org/CVE-2017-2925 https://security.archlinux.org/CVE-2017-2926 https://security.archlinux.org/CVE-2017-2927 https://security.archlinux.org/CVE-2017-2928 https://security.archlinux.org/CVE-2017-2930 https://security.archlinux.org/CVE-2017-2931 https://security.archlinux.org/CVE-2017-2932 https://security.archlinux.org/CVE-2017-2933 https://security.archlinux.org/CVE-2017-2934 https://security.archlinux.org/CVE-2017-2935 https://security.archlinux.org/CVE-2017-2936 https://security.archlinux.org/CVE-2017-2937 https://security.archlinux.org/CVE-2017-2938

1 0