- Arch-security - lists.archlinux.org

[arch-security] [ASA-201701-6] lib32-libpng12: denial of service
by Levente Polyak 02 Jan '17

02 Jan '17

Arch Linux Security Advisory ASA-201701-6 ========================================= Severity: Low Date : 2017-01-02 CVE-ID : CVE-2016-10087 Package : lib32-libpng12 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-121 Summary ======= The package lib32-libpng12 before version 1.2.57-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.2.57-1. # pacman -Syu "lib32-libpng12>=1.2.57-1" The problem has been fixed upstream in version 1.2.57. Workaround ========== None. Description =========== A NULL-pointer dereference issue has been found in png_set_text_2() in libpng. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure. Impact ====== A remote attacker is able to crash the application under certain circumstances. References ========== http://seclists.org/oss-sec/2016/q4/782 https://security.archlinux.org/CVE-2016-10087

1 0

[arch-security] [ASA-201701-5] lib32-libpng: denial of service
by Levente Polyak 02 Jan '17

02 Jan '17

Arch Linux Security Advisory ASA-201701-5 ========================================= Severity: Low Date : 2017-01-02 CVE-ID : CVE-2016-10087 Package : lib32-libpng Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-120 Summary ======= The package lib32-libpng before version 1.6.27-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.6.27-1. # pacman -Syu "lib32-libpng>=1.6.27-1" The problem has been fixed upstream in version 1.6.27. Workaround ========== None. Description =========== A NULL-pointer dereference issue has been found in png_set_text_2() in libpng. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure. Impact ====== A remote attacker is able to crash the application under certain circumstances. References ========== http://seclists.org/oss-sec/2016/q4/782 https://security.archlinux.org/CVE-2016-10087

1 0

[arch-security] [ASA-201701-4] libpng12: denial of service
by Levente Polyak 02 Jan '17

02 Jan '17

Arch Linux Security Advisory ASA-201701-4 ========================================= Severity: Low Date : 2017-01-02 CVE-ID : CVE-2016-10087 Package : libpng12 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-122 Summary ======= The package libpng12 before version 1.2.57-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.2.57-1. # pacman -Syu "libpng12>=1.2.57-1" The problem has been fixed upstream in version 1.2.57. Workaround ========== None. Description =========== A NULL-pointer dereference issue has been found in png_set_text_2() in libpng. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure. Impact ====== A remote attacker is able to crash the application under certain circumstances. References ========== http://seclists.org/oss-sec/2016/q4/782 https://security.archlinux.org/CVE-2016-10087

1 0

[arch-security] [ASA-201701-3] gst-plugins-bad: multiple issues
by Santiago Torres-Arias 02 Jan '17

02 Jan '17

Arch Linux Security Advisory ASA-201701-3 ========================================= Severity: High Date : 2017-01-02 CVE-ID : CVE-2016-9445 CVE-2016-9446 Package : gst-plugins-bad Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-76 Summary ======= The package gst-plugins-bad before version 1.10.2-2 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 1.10.2-2. # pacman -Syu "gst-plugins-bad>=1.10.2-2" The problems have been fixed upstream in version 1.10.2. Workaround ========== None Description =========== - CVE-2016-9445 (arbitrary code execution) The vmnc decoder in gst-plugins-bad of the gstreamer code base contains a width * height * depth integer overflow in the allocation of the render buffer inside gst/vmnc/vmncdec.c. - CVE-2016-9446 (information disclosure) An information disclosure vulnerability has been discovered in the render canvas functionality of gst-plugins-bad due to the lack of initializing the returned heap area of g_malloc(). An example for the information leak would be thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas at all. This could be a problem for anyone using gstreamer in a server environment to provide a thumbnailing services. Impact ====== An attacker is able to provide a crafted VMNC file that would allow for either arbitrary code execution or disclose information of the memory of the running host. References ========== http://www.openwall.com/lists/oss-security/2016/11/18/13 https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisi… https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmnc… https://bugzilla.gnome.org/show_bug.cgi?id=774533 https://security.archlinux.org/CVE-2016-9445 https://security.archlinux.org/CVE-2016-9446

1 0

[arch-security] [ASA-201701-2] libpng: denial of service
by Levente Polyak 02 Jan '17

02 Jan '17

Arch Linux Security Advisory ASA-201701-2 ========================================= Severity: Low Date : 2017-01-01 CVE-ID : CVE-2016-10087 Package : libpng Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-119 Summary ======= The package libpng before version 1.6.27-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.6.27-1. # pacman -Syu "libpng>=1.6.27-1" The problem has been fixed upstream in version 1.6.27. Workaround ========== None. Description =========== A NULL-pointer dereference issue has been found in png_set_text_2() in libpng <= 1.6.26 and >= 0.71. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure. Impact ====== A remote attacker is able to crash the application under certain circumstances. References ========== http://seclists.org/oss-sec/2016/q4/782 https://security.archlinux.org/CVE-2016-10087

1 0

[arch-security] [ASA-201701-1] libwmf: multiple issues
by Levente Polyak 01 Jan '17

01 Jan '17

Arch Linux Security Advisory ASA-201701-1 ========================================= Severity: Critical Date : 2017-01-01 CVE-ID : CVE-2006-3376 CVE-2007-0455 CVE-2007-2756 CVE-2007-3472 CVE-2007-3473 CVE-2007-3477 CVE-2009-1364 CVE-2009-3546 CVE-2015-0848 CVE-2015-4588 CVE-2015-4695 CVE-2015-4696 CVE-2016-9011 Package : libwmf Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-16 Summary ======= The package libwmf before version 0.2.8.4-14 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.2.8.4-14. # pacman -Syu "libwmf>=0.2.8.4-14" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2006-3376 (arbitrary code execution) Integer overflow in player.c in libwmf 0.2.8.4, as used in multiple products including (1) wv, (2) abiword, (3) freetype, (4) gimp, (5) libgsf, and (6) imagemagick allows remote attackers to execute arbitrary code via the MaxRecordSize header field in a WMF file. - CVE-2007-0455 (arbitrary code execution) Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font. - CVE-2007-2756 (denial of service) The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng. - CVE-2007-3472 (denial of service) Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified attack vectors and impact. - CVE-2007-3473 (denial of service) The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. - CVE-2007-3477 (denial of service) The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allow attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. - CVE-2009-1364 (arbitrary code execution) Use-after-free vulnerability in the embedded GD library in libwmf 0.2.8.4 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted WMF file. - CVE-2009-3546 (arbitrary code execution) The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file. - CVE-2015-0848 (arbitrary code execution) It was discovered that libwmf did not correctly process certain WMF (Windows Metafiles) containing BMP images. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the application. - CVE-2015-4588 (arbitrary code execution) It was discovered that libwmf did not correctly process certain WMF (Windows Metafiles) with embedded BMP images. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly use this flaw to execute arbitrary code with the privileges of the user running the application. - CVE-2015-4695 (arbitrary code execution) It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash or execute arbitrary code with the privileges of the user running the application. - CVE-2015-4696 (arbitrary code execution) It was discovered that libwmf did not properly process certain WMF files. By tricking a victim into opening a specially crafted WMF file in an application using libwmf, a remote attacker could possibly exploit this flaw to cause a crash or execute arbitrary code with the privileges of the user running the application. - CVE-2016-9011 (denial of service) A memory allocation failure in function wmf_malloc in api.c was reported in libwmf. Opening a maliciously crafted file could cause the application to crash. Impact ====== A remote attacker is able to use specially crafted files to crash the application or execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/49162 http://www.openwall.com/lists/oss-security/2015/06/16/4 https://blogs.gentoo.org/ago/2016/10/18/libwmf-memory-allocation-failure-in… https://security.archlinux.org/CVE-2006-3376 https://security.archlinux.org/CVE-2007-0455 https://security.archlinux.org/CVE-2007-2756 https://security.archlinux.org/CVE-2007-3472 https://security.archlinux.org/CVE-2007-3473 https://security.archlinux.org/CVE-2007-3477 https://security.archlinux.org/CVE-2009-1364 https://security.archlinux.org/CVE-2009-3546 https://security.archlinux.org/CVE-2015-0848 https://security.archlinux.org/CVE-2015-4588 https://security.archlinux.org/CVE-2015-4695 https://security.archlinux.org/CVE-2015-4696 https://security.archlinux.org/CVE-2016-9011

1 0

[arch-security] [ASA-201612-22] curl: multiple issues
by Santiago Torres-Arias 01 Jan '17

01 Jan '17

Arch Linux Security Advisory ASA-201612-22 ========================================== Severity: Medium Date : 2016-12-27 CVE-ID : CVE-2016-9586 CVE-2016-9594 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-112 Summary ======= The package curl before version 7.52.1-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 7.52.1-1. # pacman -Syu "curl>=7.52.1-1" The problems have been fixed upstream in version 7.52.1. Workaround ========== None. Description =========== - CVE-2016-9586 (arbitrary code execution) libcurl's implementation of the printf() functions triggers a buffer overflow when doing a large floating point output. The bug occurs when the conversion outputs more than 255 bytes. The flaw happens because the floating point conversion is using system functions without the correct boundary checks. The functions have been documented as deprecated for a long time and users are discouraged from using them in "new programs" as they are planned to get removed at a future point. But as the functions are present and there's nothing preventing users from using them, we expect there to be a certain amount of existing users in the wild. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks. - CVE-2016-9594 (incorrect calculation) libcurl's (new) internal function that returns a good 32bit random value was implemented poorly and overwrote the pointer instead of writing the value into the buffer the pointer pointed to. This random value is used to generate nonces for Digest and NTLM authentication, for generating boundary strings in HTTP formposts and more. Having a weak or virtually non-existent random there makes these operations vulnerable. This function has been introduced in 7.52.0 Impact ====== A remote attacker is able to execute arbitrary code on a target machine by sending crafted data to the server. In addition, the nonces generated by libcurl 7.52.0 were not truly random, which allowed for an attacker to derive sensitive information (e.g., session keys). References ========== https://bugs.archlinux.org/task/52247 https://curl.haxx.se/docs/adv_20161221A.html https://curl.haxx.se/docs/adv_20161223.html https://security.archlinux.org/CVE-2016-9586 https://security.archlinux.org/CVE-2016-9594

1 0

[arch-security] [ASA-201612-21] openfire: multiple issues
by Santiago Torres-Arias 27 Dec '16

27 Dec '16

Arch Linux Security Advisory ASA-201612-21 ========================================== Severity: High Date : 2016-12-23 CVE-ID : CVE-2015-6972 CVE-2015-6973 CVE-2015-7707 Package : openfire Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-15 Summary ======= The package openfire before version 4.1.0-1 is vulnerable to multiple issues including privilege escalation, cross-site request forgery and cross-site scripting. Resolution ========== Upgrade to 4.1.0-1. # pacman -Syu "openfire>=4.1.0-1" The problems have been fixed upstream in version 4.1.0. Workaround ========== None. Description =========== - CVE-2015-6972 (cross-site scripting) Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to inject arbitrary web script or HTML via the (1) groupchatName parameter to plugins/clientcontrol/create-bookmark.jsp; the (2) urlName parameter to plugins/clientcontrol/create-bookmark.jsp; the (3) hostname parameter to server-session-details.jsp; or the (4) search parameter to group- summary.jsp. - CVE-2015-6973 (cross-site request forgery) Multiple cross-site request forgery (CSRF) vulnerabilities in Ignite Realtime Openfire 3.10.2 allow remote attackers to hijack the authentication of administrators for requests that (1) change a password via a crafted request to user-password.jsp, (2) add users via a crafted request to user-create.jsp, (3) edit server settings or (4) disable SSL on the server via a crafted request to server-props.jsp, or (5) add clients via a crafted request to plugins/clientcontrol/permitted-clients.jsp. - CVE-2015-7707 (privilege escalation) Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit- form.jsp. Impact ====== A remote attacker is able to escalate privileges, perform cross-site request forgery and cross-site scripting. References ========== http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-XSS.txt https://igniterealtime.org/issues/browse/OF-942 http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-CSRF.txt http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-PRIV-ESCALATION.txt https://issues.igniterealtime.org/browse/OF-941 https://security.archlinux.org/CVE-2015-6972 https://security.archlinux.org/CVE-2015-6973 https://security.archlinux.org/CVE-2015-7707

1 0

[arch-security] [ASA-201612-20] openssh: multiple issues
by Levente Polyak 23 Dec '16

23 Dec '16

Arch Linux Security Advisory ASA-201612-20 ========================================== Severity: Medium Date : 2016-12-22 CVE-ID : CVE-2016-10009 CVE-2016-10010 CVE-2016-10011 CVE-2016-10012 Package : openssh Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-110 Summary ======= The package openssh before version 7.4p1-1 is vulnerable to multiple issues including arbitrary code execution, privilege escalation, information disclosure and insufficient validation. Resolution ========== Upgrade to 7.4p1-1. # pacman -Syu "openssh>=7.4p1-1" The problems have been fixed upstream in version 7.4p1. Workaround ========== None. Description =========== - CVE-2016-10009 (arbitrary code execution) It was found that ssh-agent could load PKCS#11 modules from paths outside of a trusted whitelist. An attacker able to load a crafted PKCS#11 module across a forwarded agent channel could potentially use this flaw to execute arbitrary code on the system running the ssh- agent. Note that the attacker must have control of the forwarded agent- socket and the ability to write to the filesystem of the host running ssh-agent. - CVE-2016-10010 (privilege escalation) It was found that when privilege separation was disabled in OpenSSH, forwarded Unix-domain sockets would be created by sshd with root privileges instead of the privileges of the authenticated user. This could allow an authenticated attacker to potentially gain root privileges on the host system. Privileges separation has been enabled by default since OpenSSH 3.3/3.3p1 (2002-06-21). Thus, OpenSSH is not affected by default. An affected OpenSSH configuration would have to specifically disable privilege separation with the "UsePrivilegeSeparation no" configuration directive in /etc/ssh/sshd_config. - CVE-2016-10011 (information disclosure) It was found that there is a theoretical leak of host private key material to privilege-separated child processes via realloc() when reading keys. No such leak was observed in practice for normal-sized keys, nor does a leak to the child processes directly expose key material to unprivileged users. - CVE-2016-10012 (insufficient validation) It was found that the shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimizing compilers. Additionally, this memory manager was incorrectly accessible when pre-authentication compression was disabled. This could potentially allow attacks against the privileged monitor process from the sandboxed privilege-separation process (a compromise of the latter would be required first). Impact ====== A remote attacker may be able to perform attacks against the shared memory manager used by pre-authentication compression support. Furthermore a local attacker may be able to execute arbitrary code and disclose sensitive information under certain circumstances or possibly escalate privileges when having privilege separation explicitly disabled. References ========== https://www.openssh.com/txt/release-7.4 http://seclists.org/oss-sec/2016/q4/708 http://seclists.org/oss-sec/2016/q4/705 https://access.redhat.com/security/cve/CVE-2016-10009 https://access.redhat.com/security/cve/CVE-2016-10010 https://access.redhat.com/security/cve/CVE-2016-10011 https://access.redhat.com/security/cve/CVE-2016-10012

1 0

[arch-security] [ASA-201612-19] samba: multiple issues
by Levente Polyak 22 Dec '16

22 Dec '16

Arch Linux Security Advisory ASA-201612-19 ========================================== Severity: Critical Date : 2016-12-22 CVE-ID : CVE-2016-2123 CVE-2016-2125 CVE-2016-2126 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-111 Summary ======= The package samba before version 4.5.3-1 is vulnerable to multiple issues including arbitrary code execution, authentication bypass and privilege escalation. Resolution ========== Upgrade to 4.5.3-1. # pacman -Syu "samba>=4.5.3-1" The problems have been fixed upstream in version 4.5.3. Workaround ========== None. Description =========== - CVE-2016-2123 (arbitrary code execution) The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects, this makes the defect additionally a remote privilege escalation. - CVE-2016-2125 (authentication bypass) Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" (TGT), which can be used to fully impersonate the authenticated user or service. The risks of impersonation of the client are similar to the well known risks from forwarding of NTLM credentials, with two important differences: - NTLM forwarding can and should be mitigated with packet signing - Kerberos forwarding can only be attempted after the trusted destination server decrypts the ticket. - CVE-2016-2126 (privilege escalation) A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket due to incorrect handling of the PAC checksum. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions. For the remote attack, the memory overwrite kills the main winbindd process and an authenticated attacker can construct this situation by watching for password changes in Samba. One specific trigger occurs when winbindd changes its machine account password and the client has still a valid Kerberos ticket (that was encrypted with the old password). Impact ====== A remote authenticated attacker is able to execute arbitrary code, bypass authentication via unconditional privilege delegation and escalate privileges via various vectors. References ========== https://bugs.archlinux.org/task/52219 https://www.samba.org/samba/security/CVE-2016-2123.html https://www.samba.org/samba/security/CVE-2016-2125.html https://www.samba.org/samba/security/CVE-2016-2126.html https://access.redhat.com/security/cve/CVE-2016-2123 https://access.redhat.com/security/cve/CVE-2016-2125 https://access.redhat.com/security/cve/CVE-2016-2126

1 0