- Arch-security - lists.archlinux.org

[arch-security] [ASA-201612-18] qt5-webengine: multiple issues
by Remi Gacogne 17 Dec '16

17 Dec '16

Arch Linux Security Advisory ASA-201612-18 ========================================== Severity: Critical Date : 2016-12-17 CVE-ID : CVE-2016-5133 CVE-2016-5147 CVE-2016-5153 CVE-2016-5155 CVE-2016-5161 CVE-2016-5166 CVE-2016-5170 CVE-2016-5171 CVE-2016-5172 CVE-2016-5181 CVE-2016-5185 CVE-2016-5186 CVE-2016-5187 CVE-2016-5188 CVE-2016-5192 CVE-2016-5198 Package : qt5-webengine Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qt5-webengine before version 5.7.1-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, cross-site scripting, information disclosure and same-origin policy bypass. Resolution ========== Upgrade to 5.7.1-1. # pacman -Syu "qt5-webengine>=5.7.1-1" The problems have been fixed upstream in version 5.7.1. Workaround ========== None. Description =========== - CVE-2016-5133 (content spoofing) Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream. - CVE-2016-5147 (cross-site scripting) Blink, as used in Google Chrome, mishandles deferred page loads, which allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)." - CVE-2016-5153 (arbitrary code execution) The Web Animations implementation in Blink improperly relies on list iteration, which allows remote attackers to cause a denial of service (use-after-destruction) or possibly have unspecified other impact via a crafted web site. - CVE-2016-5155 (content spoofing) Chromium does not properly validate access to the initial document, which allows remote attackers to spoof the address bar via a crafted web site. - CVE-2016-5161 (information disclosure) The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class. - CVE-2016-5166 (information disclosure) The download implementation in Chromium does not properly restrict saving a file:// URL that is referenced by an http:// URL, which makes it easier for user-assisted remote attackers to discover NetNTLM hashes and conduct SMB relay attacks via a crafted web page that is accessed with the "Save page as" menu choice. - CVE-2016-5170 (arbitrary code execution) WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink does not properly consider getter side effects during array key conversion, which allows remote attackers to cause a denial of service (use-after- free) or possibly have unspecified other impact via crafted Indexed Database (aka IndexedDB) API calls. - CVE-2016-5171 (arbitrary code execution) WebKit/Source/bindings/templates/interface.cpp in Blink does not prevent certain constructor calls, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code. - CVE-2016-5172 (information disclosure) The parser in Google V8 mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code. - CVE-2016-5181 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5185 (arbitrary code execution) An use after free flaw was found in the Blink component of the Chromium browser. - CVE-2016-5186 (information disclosure) An out of bounds read flaw was found in the DevTools component of the Chromium browser. - CVE-2016-5187 (content spoofing) An URL spoofing flaw was found in the Chromium browser. - CVE-2016-5188 (content spoofing) An UI spoofing flaw was found in the Chromium browser. - CVE-2016-5192 (same-origin policy bypass) A cross-origin bypass flaw was found in the Blink component of the Chromium browser. - CVE-2016-5198 (arbitrary code execution) An out of bounds memory access flaw was found in the V8 component of the Chromium browser. Impact ====== A remote attacker can access sensitive information, spoof content, bypass security measures or execute arbitrary code on the affected host. References ========== https://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.7.1?h=5.7 https://bugs.chromium.org/p/chromium/issues/detail?id=613626 https://bugs.chromium.org/p/chromium/issues/detail?id=628942 https://bugs.chromium.org/p/chromium/issues/detail?id=631052 https://bugs.chromium.org/p/chromium/issues/detail?id=630662 https://bugzilla.redhat.com/show_bug.cgi?id=1372216 https://bugs.chromium.org/p/chromium/issues/detail?id=622420 https://bugs.chromium.org/p/chromium/issues/detail?id=616429 https://bugs.chromium.org/p/chromium/issues/detail?id=641101 https://bugs.chromium.org/p/chromium/issues/detail?id=643357 https://chromereleases.googleblog.com/2016/09/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=616386 https://googlechromereleases.blogspot.fr/2016/10/stable-channel-update-for-… https://chromereleases.googleblog.com/2016/11/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=659475 https://access.redhat.com/security/cve/CVE-2016-5133 https://access.redhat.com/security/cve/CVE-2016-5147 https://access.redhat.com/security/cve/CVE-2016-5153 https://access.redhat.com/security/cve/CVE-2016-5155 https://access.redhat.com/security/cve/CVE-2016-5161 https://access.redhat.com/security/cve/CVE-2016-5166 https://access.redhat.com/security/cve/CVE-2016-5170 https://access.redhat.com/security/cve/CVE-2016-5171 https://access.redhat.com/security/cve/CVE-2016-5172 https://access.redhat.com/security/cve/CVE-2016-5181 https://access.redhat.com/security/cve/CVE-2016-5185 https://access.redhat.com/security/cve/CVE-2016-5186 https://access.redhat.com/security/cve/CVE-2016-5187 https://access.redhat.com/security/cve/CVE-2016-5188 https://access.redhat.com/security/cve/CVE-2016-5192 https://access.redhat.com/security/cve/CVE-2016-5198

1 0

[arch-security] [ASA-201612-17] lib32-flashplugin: multiple issues
by Levente Polyak 15 Dec '16

15 Dec '16

Arch Linux Security Advisory ASA-201612-17 ========================================== Severity: Critical Date : 2016-12-15 CVE-ID : CVE-2016-7867 CVE-2016-7868 CVE-2016-7869 CVE-2016-7870 CVE-2016-7871 CVE-2016-7872 CVE-2016-7873 CVE-2016-7874 CVE-2016-7875 CVE-2016-7876 CVE-2016-7877 CVE-2016-7878 CVE-2016-7879 CVE-2016-7880 CVE-2016-7881 CVE-2016-7890 CVE-2016-7892 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 24.0.0.186-1 is vulnerable to multiple issues including arbitrary code execution and access restriction bypass. Resolution ========== Upgrade to 24.0.0.186-1. # pacman -Syu "lib32-flashplugin>=24.0.0.186-1" The problems have been fixed upstream in version 24.0.0.186. Workaround ========== None. Description =========== - CVE-2016-7867 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7868 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7869 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7870 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7871 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7872 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7873 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7874 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7875 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7876 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7877 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7878 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7879 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7880 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7881 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7890 (access restriction bypass) A security bypass vulnerability has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7892 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. Impact ====== A remote attacker is able to bypass certain security restrictions and execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-39.html https://access.redhat.com/security/cve/CVE-2016-7867 https://access.redhat.com/security/cve/CVE-2016-7868 https://access.redhat.com/security/cve/CVE-2016-7869 https://access.redhat.com/security/cve/CVE-2016-7870 https://access.redhat.com/security/cve/CVE-2016-7871 https://access.redhat.com/security/cve/CVE-2016-7872 https://access.redhat.com/security/cve/CVE-2016-7873 https://access.redhat.com/security/cve/CVE-2016-7874 https://access.redhat.com/security/cve/CVE-2016-7875 https://access.redhat.com/security/cve/CVE-2016-7876 https://access.redhat.com/security/cve/CVE-2016-7877 https://access.redhat.com/security/cve/CVE-2016-7878 https://access.redhat.com/security/cve/CVE-2016-7879 https://access.redhat.com/security/cve/CVE-2016-7880 https://access.redhat.com/security/cve/CVE-2016-7881 https://access.redhat.com/security/cve/CVE-2016-7890 https://access.redhat.com/security/cve/CVE-2016-7892

1 0

[arch-security] [ASA-201612-16] flashplugin: multiple issues
by Levente Polyak 15 Dec '16

15 Dec '16

Arch Linux Security Advisory ASA-201612-16 ========================================== Severity: Critical Date : 2016-12-15 CVE-ID : CVE-2016-7867 CVE-2016-7868 CVE-2016-7869 CVE-2016-7870 CVE-2016-7871 CVE-2016-7872 CVE-2016-7873 CVE-2016-7874 CVE-2016-7875 CVE-2016-7876 CVE-2016-7877 CVE-2016-7878 CVE-2016-7879 CVE-2016-7880 CVE-2016-7881 CVE-2016-7890 CVE-2016-7892 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 24.0.0.186-1 is vulnerable to multiple issues including arbitrary code execution and access restriction bypass. Resolution ========== Upgrade to 24.0.0.186-1. # pacman -Syu "flashplugin>=24.0.0.186-1" The problems have been fixed upstream in version 24.0.0.186. Workaround ========== None. Description =========== - CVE-2016-7867 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7868 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7869 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7870 (arbitrary code execution) A buffer overflow vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7871 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7872 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7873 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7874 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7875 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7876 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7877 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7878 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7879 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7880 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7881 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7890 (access restriction bypass) A security bypass vulnerability has been found in Adobe Flash Player < 24.0.0.186. - CVE-2016-7892 (arbitrary code execution) A use-after-free vulnerability leading to code execution has been found in Adobe Flash Player < 24.0.0.186. Impact ====== A remote attacker is able to bypass certain security restrictions and execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-39.html https://access.redhat.com/security/cve/CVE-2016-7867 https://access.redhat.com/security/cve/CVE-2016-7868 https://access.redhat.com/security/cve/CVE-2016-7869 https://access.redhat.com/security/cve/CVE-2016-7870 https://access.redhat.com/security/cve/CVE-2016-7871 https://access.redhat.com/security/cve/CVE-2016-7872 https://access.redhat.com/security/cve/CVE-2016-7873 https://access.redhat.com/security/cve/CVE-2016-7874 https://access.redhat.com/security/cve/CVE-2016-7875 https://access.redhat.com/security/cve/CVE-2016-7876 https://access.redhat.com/security/cve/CVE-2016-7877 https://access.redhat.com/security/cve/CVE-2016-7878 https://access.redhat.com/security/cve/CVE-2016-7879 https://access.redhat.com/security/cve/CVE-2016-7880 https://access.redhat.com/security/cve/CVE-2016-7881 https://access.redhat.com/security/cve/CVE-2016-7890 https://access.redhat.com/security/cve/CVE-2016-7892

1 0

[arch-security] [ASA-201612-15] firefox: multiple issues
by Remi Gacogne 14 Dec '16

14 Dec '16

Arch Linux Security Advisory ASA-201612-15 ========================================== Severity: Critical Date : 2016-12-14 CVE-ID : CVE-2016-9080 CVE-2016-9893 CVE-2016-9894 CVE-2016-9895 CVE-2016-9896 CVE-2016-9897 CVE-2016-9898 CVE-2016-9899 CVE-2016-9900 CVE-2016-9901 CVE-2016-9902 CVE-2016-9903 CVE-2016-9904 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 50.1.0-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure, content spoofing, cross-site scripting and insufficient validation. Resolution ========== Upgrade to 50.1.0-1. # pacman -Syu "firefox>=50.1.0-1" The problems have been fixed upstream in version 50.1.0. Workaround ========== None. Description =========== - CVE-2016-9080 (arbitrary code execution) Mozilla developers and community members Kan-Ru Chen, Christian Holler, and Tyson Smith reported memory safety bugs present in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2016-9893 (arbitrary code execution) Mozilla developers and community members Jan de Mooij, Iris Hsiao, Christian Holler, Carsten Book, Timothy Nikkel, Christoph Diehl, Olli Pettay, Raymond Forbes, and Boris Zbarsky reported memory safety bugs present in Firefox 50.0.2 and Firefox ESR 45.5.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. - CVE-2016-9894 (arbitrary code execution) A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. - CVE-2016-9895 (access restriction bypass) Event handlers on marquee elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. - CVE-2016-9896 (arbitrary code execution) Use-after-free while manipulating the navigator object within WebVR. Note: WebVR is not currently enabled by default. - CVE-2016-9897 (arbitrary code execution) Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. - CVE-2016-9898 (arbitrary code execution) Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. - CVE-2016-9899 (arbitrary code execution) Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. - CVE-2016-9900 (information disclosure) External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of data: URLs. This could allow for cross-domain data leakage. - CVE-2016-9901 (insufficient validation) HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the about:pocket-saved (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. - CVE-2016-9902 (content spoofing) The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. - CVE-2016-9903 (cross-site scripting) Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. - CVE-2016-9904 (information disclosure) An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. Impact ====== A remote attacker can access sensitive information, bypass security measures and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9080 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9893 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9894 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9895 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9896 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9897 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9898 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9899 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9900 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9901 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9902 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9903 https://www.mozilla.org/en-US/security/advisories/mfsa2016-94/#CVE-2016-9904 https://access.redhat.com/security/cve/CVE-2016-9080 https://access.redhat.com/security/cve/CVE-2016-9893 https://access.redhat.com/security/cve/CVE-2016-9894 https://access.redhat.com/security/cve/CVE-2016-9895 https://access.redhat.com/security/cve/CVE-2016-9896 https://access.redhat.com/security/cve/CVE-2016-9897 https://access.redhat.com/security/cve/CVE-2016-9898 https://access.redhat.com/security/cve/CVE-2016-9899 https://access.redhat.com/security/cve/CVE-2016-9900 https://access.redhat.com/security/cve/CVE-2016-9901 https://access.redhat.com/security/cve/CVE-2016-9902 https://access.redhat.com/security/cve/CVE-2016-9903 https://access.redhat.com/security/cve/CVE-2016-9904

1 0

[arch-security] [ASA-201612-14] linux-zen: denial of service
by Santiago Torres-Arias 14 Dec '16

14 Dec '16

Arch Linux Security Advisory ASA-201612-14 ========================================== Severity: High Date : 2016-12-12 CVE-ID : CVE-2016-9919 Package : linux-zen Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-zen before version 4.8.13-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.8.13-1. # pacman -Syu "linux-zen>=4.8.13-1" The problem has been fixed upstream in version 4.8.13. Workaround ========== None. Description =========== The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet. Impact ====== A remote attacker can cause a kernel panic by sending a fragmented IPv6 packet. References ========== https://bugzilla.kernel.org/show_bug.cgi?id=189851 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-9919

1 0

[arch-security] [ASA-201612-13] python-html5lib: cross-site scripting
by Santiago Torres-Arias 14 Dec '16

14 Dec '16

Arch Linux Security Advisory ASA-201612-13 ========================================== Severity: Low Date : 2016-12-12 CVE-ID : CVE-2016-9909 CVE-2016-9910 Package : python-html5lib Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-html5lib before version 0.999999999-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 0.999999999-1. # pacman -Syu "python-html5lib>=0.999999999-1" The problems have been fixed upstream in version 0.999999999. Workaround ========== None. Description =========== - CVE-2016-9909 (cross-site scripting) A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. - CVE-2016-9910 (cross-site scripting) A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. Impact ====== A remote attacker is able to execute arbitrary javascript in certain legacy browsers. References ========== http://www.openwall.com/lists/oss-security/2016/12/06/5 https://github.com/html5lib/html5lib-python/issues/11 https://github.com/html5lib/html5lib-python/issues/12 https://access.redhat.com/security/cve/CVE-2016-9909 https://access.redhat.com/security/cve/CVE-2016-9910

1 0

[arch-security] [ASA-201612-12] python2-html5lib: cross-site scripting
by Santiago Torres-Arias 14 Dec '16

14 Dec '16

Arch Linux Security Advisory ASA-201612-12 ========================================== Severity: Low Date : 2016-12-12 CVE-ID : CVE-2016-9909 CVE-2016-9910 Package : python2-html5lib Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-html5lib before version 0.999999999-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 0.999999999-1. # pacman -Syu "python2-html5lib>=0.999999999-1" The problems have been fixed upstream in version 0.999999999. Workaround ========== None. Description =========== - CVE-2016-9909 (cross-site scripting) A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. - CVE-2016-9910 (cross-site scripting) A potential cross site scripting vulnerability was found in python- html5lib due to unquoted attributes that need escaping in legacy browsers. Impact ====== A remote attacker is able to execute arbitrary javascript in certain legacy browsers. References ========== http://www.openwall.com/lists/oss-security/2016/12/06/5 https://github.com/html5lib/html5lib-python/issues/11 https://github.com/html5lib/html5lib-python/issues/12 https://access.redhat.com/security/cve/CVE-2016-9909 https://access.redhat.com/security/cve/CVE-2016-9910

1 0

[arch-security] [ASA-201612-11] linux-grsec: denial of service
by Remi Gacogne 10 Dec '16

10 Dec '16

Arch Linux Security Advisory ASA-201612-11 ========================================== Severity: High Date : 2016-12-10 CVE-ID : CVE-2016-9919 Package : linux-grsec Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-grsec before version 1:4.8.12.r201612062306-2 is vulnerable to denial of service. Resolution ========== Upgrade to 1:4.8.12.r201612062306-2. # pacman -Syu "linux-grsec>=1:4.8.12.r201612062306-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet. Impact ====== A remote attacker can cause a kernel panic by sending a fragmented IPv6 packet. References ========== https://bugzilla.kernel.org/show_bug.cgi?id=189851 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-9919

2 1

[arch-security] [ASA-201612-10] linux: denial of service
by Remi Gacogne 10 Dec '16

10 Dec '16

Arch Linux Security Advisory ASA-201612-10 ========================================== Severity: High Date : 2016-12-10 CVE-ID : CVE-2016-9919 Package : linux Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux before version 4.8.12-3 is vulnerable to denial of service. Resolution ========== Upgrade to 4.8.12-3. # pacman -Syu "linux>=4.8.12-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet. Impact ====== A remote attacker can cause a kernel panic by sending a fragmented IPv6 packet. References ========== https://bugzilla.kernel.org/show_bug.cgi?id=189851 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-9919

1 0

[arch-security] [ASA-201612-9] jasper: multiple issues
by Levente Polyak 09 Dec '16

09 Dec '16

Arch Linux Security Advisory ASA-201612-9 ========================================= Severity: Critical Date : 2016-12-07 CVE-ID : CVE-2015-5203 CVE-2015-8751 CVE-2016-2089 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692 CVE-2016-8693 CVE-2016-8884 CVE-2016-8885 CVE-2016-8887 CVE-2016-9262 CVE-2016-9387 CVE-2016-9388 CVE-2016-9557 CVE-2016-9560 Package : jasper Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jasper before version 1.900.31-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.900.31-1. # pacman -Syu "jasper>=1.900.31-1" The problems have been fixed upstream in version 1.900.31. Workaround ========== None. Description =========== - CVE-2015-5203 (arbitrary code execution) A double free flaw was found in the way JasPer's jasper_image_stop_load() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or possibly execute arbitrary code. - CVE-2015-8751 (denial of service) An integer overflow flaw was found in the way the JasPer's library jas_matrix_create() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. - CVE-2016-2089 (denial of service) The jas_matrix_clip function in jas_seq.c allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image. - CVE-2016-8690 (denial of service) A null pointer dereference vulnerability was found in bmp_getdata triggered by invoking imginfo command on specially crafted BMP image. - CVE-2016-8691 (denial of service) A division by zero vulnerability was found in jpc_dec_process_siz triggered by invoking imginfo command on specially crafted file. - CVE-2016-8692 (denial of service) A division by zero vulnerability was found in jpc_dec_process_siz triggered by invoking imginfo command on specially crafted file. - CVE-2016-8693 (denial of service) A double free vulnerability was found in mem_close in jas_stream.c triggered by invoking imginfo command on specially crafted image file. - CVE-2016-8884 (denial of service) A null pointer dereference vulnerability has been discovered in bmp_getdata in bmp_dec.c. - CVE-2016-8885 (denial of service) A null pointer dereference vulnerability has been discovered in bmp_getdata in bmp_dec.c. - CVE-2016-8887 (denial of service) A null pointer dereference vulnerability was found in jp2_colr_destroy in jp2_cod.c leading to application crash. - CVE-2016-9262 (arbitrary code execution) A number of overflows were found in jasper causing use after free vulnerability triggered by a crafted image. - CVE-2016-9387 (denial of service) An integer overflow in jpc_dec_process_siz was found that can be triggered by crafted image file when given as input to imginfo. - CVE-2016-9388 (denial of service) An improper error handling was found in the RAS encoder/decoder triggering assertion tests that result in denial of service. - CVE-2016-9557 (denial of service) A signed integer overflow vulnerability has been discovered in jas_image.c triggered by a crafted image. An option max_samples has been added to the BMP and JPEG decoders to restrict the maximum size of image that they can decode. This change was made as a (possibly temporary) fix to address security concerns. - CVE-2016-9560 (arbitrary code execution) A stack buffer overflow vulnerability has been discovered in jpc/jpc_dec.c duo to an out of bounds array write triggered by a crafted image. Impact ====== A remote attacker is able to perform a denial of service attack or execute arbitrary code on the affected host. References ========== http://seclists.org/oss-sec/2015/q3/366 https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c3 http://seclists.org/oss-sec/2016/q1/44 https://bugzilla.redhat.com/show_bug.cgi?id=1294039 http://www.openwall.com/lists/oss-security/2016/10/16/14 https://blogs.gentoo.org/ago/2016/10/16/jasper-two-null-pointer-dereference… https://github.com/mdadams/jasper/commit/8f62b4761711d036fd8964df256b938c80… https://github.com/mdadams/jasper/commit/d8c2604cd438c41ec72aff52c16ebd8183… https://github.com/mdadams/jasper/commit/44a524e367597af58d6265ae2014468b33… https://github.com/mdadams/jasper/commit/5d66894d2313e3f3469f19066 http://seclists.org/oss-sec/2016/q4/213 https://github.com/mdadams/jasper/commit/e24bdc716c3327b067c551bc6cfb97fd23… http://seclists.org/oss-sec/2016/q4/215 https://github.com/mdadams/jasper/commit/634ce8e8a5accc0fa05dd2 http://seclists.org/oss-sec/2016/q4/385 https://github.com/mdadams/jasper/commit/d91198abd00fc435a397fe6bad906a4c17… http://seclists.org/oss-sec/2016/q4/441 https://github.com/mdadams/jasper/commit/411a4068f8c464e883358bf403a3e25158… https://github.com/mdadams/jasper/commit/d42b2388f7f8e0332c846675133acea151… http://www.openwall.com/lists/oss-security/2016/11/23/2 https://github.com/mdadams/jasper/commit/1abc2e5a401a4bf1d5ca4df91358ce5df1… http://www.openwall.com/lists/oss-security/2016/11/23/5 https://access.redhat.com/security/cve/CVE-2015-5203 https://access.redhat.com/security/cve/CVE-2015-8751 https://access.redhat.com/security/cve/CVE-2016-2089 https://access.redhat.com/security/cve/CVE-2016-8690 https://access.redhat.com/security/cve/CVE-2016-8691 https://access.redhat.com/security/cve/CVE-2016-8692 https://access.redhat.com/security/cve/CVE-2016-8693 https://access.redhat.com/security/cve/CVE-2016-8884 https://access.redhat.com/security/cve/CVE-2016-8885 https://access.redhat.com/security/cve/CVE-2016-8887 https://access.redhat.com/security/cve/CVE-2016-9262 https://access.redhat.com/security/cve/CVE-2016-9387 https://access.redhat.com/security/cve/CVE-2016-9388 https://access.redhat.com/security/cve/CVE-2016-9557 https://access.redhat.com/security/cve/CVE-2016-9560

1 0