- Arch-security - lists.archlinux.org

[arch-security] [ASA-201610-16] linux-grsec: privilege escalation
by Christian Rebischke 24 Oct '16

24 Oct '16

Arch Linux Security Advisory ASA-201610-16 ========================================== Severity: High Date : 2016-10-24 CVE-ID : CVE-2016-5195 Package : linux-grsec Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-grsec before version 1:4.7.10.r201610222037-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1:4.7.10.r201610222037-1. # pacman -Syu "linux-grsec>=1:4.7.10.r201610222037-1" The problem has been fixed upstream in version 4.7.10.r201610222037. Workaround ========== None. Description =========== A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. Impact ====== An unprivileged local attacker is able to elevate their privileges on the system and gain root access. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1384344 https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-5195

1 0

[arch-security] [ASA-201610-15] chromium: multiple issues
by Remi Gacogne 23 Oct '16

23 Oct '16

Arch Linux Security Advisory ASA-201610-15 ========================================== Severity: Critical Date : 2016-10-23 CVE-ID : CVE-2016-5181 CVE-2016-5182 CVE-2016-5183 CVE-2016-5184 CVE-2016-5185 CVE-2016-5186 CVE-2016-5187 CVE-2016-5188 CVE-2016-5189 CVE-2016-5190 CVE-2016-5191 CVE-2016-5192 CVE-2016-5193 CVE-2016-5194 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 54.0.2840.59-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, cross-site scripting, information disclosure, same-origin policy bypass and insufficient validation. Resolution ========== Upgrade to 54.0.2840.59-1. # pacman -Syu "chromium>=54.0.2840.59-1" The problems have been fixed upstream in version 54.0.2840.59. Workaround ========== None. Description =========== - CVE-2016-5181 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5182 (arbitrary code execution) A heap overflow flaw was found in the Blink component of the Chromium browser. - CVE-2016-5183 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5184 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5185 (arbitrary code execution) An use after free flaw was found in the Blink component of the Chromium browser. - CVE-2016-5186 (information disclosure) An out of bounds read flaw was found in the DevTools component of the Chromium browser. - CVE-2016-5187 (content spoofing) An URL spoofing flaw was found in the Chromium browser. - CVE-2016-5188 (content spoofing) An UI spoofing flaw was found in the Chromium browser. - CVE-2016-5189 (content spoofing) An URL spoofing flaw was found in the Chromium browser. - CVE-2016-5190 (arbitrary code execution) An use after free flaw was found in the Internals component of the Chromium browser. - CVE-2016-5191 (cross-site scripting) An universal XSS flaw was found in the Bookmarks component of the Chromium browser. - CVE-2016-5192 (same-origin policy bypass) A cross-origin bypass flaw was found in the Blink component of the Chromium browser. - CVE-2016-5193 (insufficient validation) A scheme bypass vulnerability has been discovered. - CVE-2016-5194 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass security measures, access sensitive information or execute arbitrary code on the affected host. References ========== https://googlechromereleases.blogspot.fr/2016/10/stable-channel-update-for-… https://access.redhat.com/security/cve/CVE-2016-5181 https://access.redhat.com/security/cve/CVE-2016-5182 https://access.redhat.com/security/cve/CVE-2016-5183 https://access.redhat.com/security/cve/CVE-2016-5184 https://access.redhat.com/security/cve/CVE-2016-5185 https://access.redhat.com/security/cve/CVE-2016-5186 https://access.redhat.com/security/cve/CVE-2016-5187 https://access.redhat.com/security/cve/CVE-2016-5188 https://access.redhat.com/security/cve/CVE-2016-5189 https://access.redhat.com/security/cve/CVE-2016-5190 https://access.redhat.com/security/cve/CVE-2016-5191 https://access.redhat.com/security/cve/CVE-2016-5192 https://access.redhat.com/security/cve/CVE-2016-5193 https://access.redhat.com/security/cve/CVE-2016-5194

1 0

[arch-security] [ASA-201610-14] linux: privilege escalation
by Levente Polyak 22 Oct '16

22 Oct '16

Arch Linux Security Advisory ASA-201610-14 ========================================== Severity: High Date : 2016-10-22 CVE-ID : CVE-2016-5195 Package : linux Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux before version 4.8.3-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.8.3-1. # pacman -Syu "linux>=4.8.3-1" The problem has been fixed upstream in version 4.8.3. Workaround ========== None. Description =========== A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. Impact ====== An unprivileged local attacker is able to elevate their privileges on the system and gain root access. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1384344 https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-5195

1 0

[arch-security] [ASA-201610-13] python-django: cross-site request forgery
by Levente Polyak 21 Oct '16

21 Oct '16

Arch Linux Security Advisory ASA-201610-13 ========================================== Severity: Medium Date : 2016-10-21 CVE-ID : CVE-2016-7401 Package : python-django Type : cross-site request forgery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-django before version 1.10.1-1 is vulnerable to cross-site request forgery. Resolution ========== Upgrade to 1.10.1-1. # pacman -Syu "python-django>=1.10.1-1" The problem has been fixed upstream in version 1.10.1. Workaround ========== None. Description =========== Sergey Bobrov found a vulnerability where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. Impact ====== A remote attacker is able to perform cross-site request forgery by bypassing the protection under certain circumstances. References ========== https://www.djangoproject.com/weblog/2016/sep/26/security-releases/ https://access.redhat.com/security/cve/CVE-2016-7401

1 0

[arch-security] [ASA-201610-12] python2-django: cross-site request forgery
by Levente Polyak 21 Oct '16

21 Oct '16

Arch Linux Security Advisory ASA-201610-12 ========================================== Severity: Medium Date : 2016-10-21 CVE-ID : CVE-2016-7401 Package : python2-django Type : cross-site request forgery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-django before version 1.10.1-1 is vulnerable to cross-site request forgery. Resolution ========== Upgrade to 1.10.1-1. # pacman -Syu "python2-django>=1.10.1-1" The problem has been fixed upstream in version 1.10.1. Workaround ========== None. Description =========== Sergey Bobrov found a vulnerability where an interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection. Impact ====== A remote attacker is able to perform cross-site request forgery by bypassing the protection under certain circumstances. References ========== https://www.djangoproject.com/weblog/2016/sep/26/security-releases/ https://access.redhat.com/security/cve/CVE-2016-7401

1 0

[arch-security] [ASA-201610-11] linux-lts: privilege escalation
by Levente Polyak 21 Oct '16

21 Oct '16

Arch Linux Security Advisory ASA-201610-11 ========================================== Severity: High Date : 2016-10-21 CVE-ID : CVE-2016-5195 Package : linux-lts Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-lts before version 4.4.26-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.4.26-1. # pacman -Syu "linux-lts>=4.4.26-1" The problem has been fixed upstream in version 4.4.26. Workaround ========== None. Description =========== A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system. Impact ====== An unprivileged local attacker is able to elevate their privileges on the system and gain root access. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1384344 https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://access.redhat.com/security/cve/CVE-2016-5195

1 0

[arch-security] [ASA-201610-10] guile: multiple issues
by Jelle van der Waa 16 Oct '16

16 Oct '16

Arch Linux Security Advisory ASA-201610-10 ========================================== Severity: High Date : 2016-10-16 CVE-ID : CVE-2016-8605 CVE-2016-8606 Package : guile Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package guile before version 2.0.13-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2.0.13-1. # pacman -Syu "guile>=2.0.13-1" The problems have been fixed upstream in version 2.0.13. Workaround ========== - CVE-2016-8606 (arbitrary code execution) Bind the REPL server to a Unix-domain socket. guile --listen=/tmp/guile-socket Description =========== - CVE-2016-8605 (information disclosure) The mkdir procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. - CVE-2016-8606 (arbitrary code execution) It was reported that the REPL server is vulnerable to the HTTP inter- protocol attack. This constitutes a remote code execution vulnerability for developers running a REPL server that listens on a loopback device or private network. Applications that do not run a REPL server, as is usually the case, are unaffected. Impact ====== A remote attacker is able to execute arbitrary code via a HTTP inter-protocol attack if the REPL server is listening on a loopback device or private network. Running a multi-threaded guile application can cause directories or files to be created with world readable/writable/executable permissions during a small window which leads to information disclosure. References ========== http://www.openwall.com/lists/oss-security/2016/10/11/1 http://www.openwall.com/lists/oss-security/2016/10/12/2 https://access.redhat.com/security/cve/CVE-2016-8605 https://access.redhat.com/security/cve/CVE-2016-8606 https://lists.gnu.org/archive/html/info-gnu/2016-10/msg00009.html

1 0

[arch-security] [ASA-201610-9] gdk-pixbuf2: arbitrary code execution
by Levente Polyak 13 Oct '16

13 Oct '16

Arch Linux Security Advisory ASA-201610-9 ========================================= Severity: Critical Date : 2016-10-13 CVE-ID : CVE-2016-6352 Package : gdk-pixbuf2 Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gdk-pixbuf2 before version 2.36.0+2+ga7c869a-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.36.0+2+ga7c869a-1. # pacman -Syu "gdk-pixbuf2>=2.36.0+2+ga7c869a-1" The problem has been fixed upstream in version 2.35.3. Workaround ========== None. Description =========== An out-of-bounds write has been discovered in the OneLine32() function while parsing an ico file. A maliciously crafted file can cause the application to crash or possibly execute arbitrary code. Impact ====== A remote attacker is able to use a specially crafted ico file that, when loaded, is leading to arbitrary code execution. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=769170 https://bugzilla.redhat.com/show_bug.cgi?id=1349751 https://git.gnome.org/browse/gdk-pixbuf/commit/?id=88af50a864195da1a4f7bda5… https://access.redhat.com/security/cve/CVE-2016-6352

1 0

[arch-security] [ASA-201610-8] crypto++: information disclosure
by Santiago Torres-Arias 12 Oct '16

12 Oct '16

Arch Linux Security Advisory ASA-201610-8 ========================================= Severity: Medium Date : 2016-10-12 CVE-ID : CVE-2016-7420 Package : crypto++ Type : information disclosure Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package crypto++ before version 5.6.5-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 5.6.5-1. # pacman -Syu "crypto++>=5.6.5-1" The problem has been fixed upstream in version 5.6.5. Workaround ========== None. Description =========== Crypto++ (aka cryptopp) through 5.6.4 does not document the requirement for a compile-time NDEBUG definition disabling the many assert calls that are unintended in production use, which might allow context- dependent attackers to obtain sensitive information by leveraging access to process memory after an assertion failure, as demonstrated by reading a core dump. Impact ====== An attacker can provide input to programs using crypto++ that may cause a crash and lead to the disclosure of sensitive information in a core dump. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7420 https://bugs.archlinux.org/task/51331 https://github.com/weidai11/cryptopp/issues/277 http://www.openwall.com/lists/oss-security/2016/09/15/12

1 0

[arch-security] [ASA-201610-7] wpa_supplicant: multiple issues
by Christian Rebischke 08 Oct '16

08 Oct '16

Arch Linux Security Advisory ASA-201610-7 ========================================= Severity: High Date : 2016-10-08 CVE-ID : CVE-2016-4476 CVE-2016-4477 Package : wpa_supplicant Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wpa_supplicant before version 1:2.6-1 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 1:2.6-1. # pacman -Syu "wpa_supplicant>=1:2.6-1" The problems have been fixed upstream in version 2.6. Workaround ========== None. Description =========== - CVE-2016-4476 (denial of service) A vulnerability was found in how hostapd and wpa_supplicant writes the configuration file update for the WPA/WPA2 passphrase parameter. If this parameter has been updated to include control characters either through a WPS operation or through local configuration change over the wpa_supplicant control interface, the resulting configuration file may prevent the hostapd and wpa_supplicant from starting when the updated file is used. - CVE-2016-4477 (privilege escalation) The local configuration update through the control interface SET_NETWORK command could allow privilege escalation for the local user to run code from a locally stored library file under the same privileges as the wpa_supplicant process has. The assumption here is that a not fully trusted user/application might have access through a connection manager to set network profile parameters like psk, but would not have access to set other configuration file parameters. If the connection manager in such a case does not filter out control characters from the psk value, it could have been possible to practically update the global parameters by embedding a newline character within the psk value. In addition, the untrusted user/application would need to be able to install a library file somewhere on the device from where the wpa_supplicant process has privileges to load the library. Impact ====== A remote attacker is able to perform a denial of service attack that prevents hostapd from starting. Furthermore a local attacker is able to elevate privileges by a local configuration update under certain circumstances. References ========== http://www.openwall.com/lists/oss-security/2016/05/03/2 https://access.redhat.com/security/cve/CVE-2016-4476 https://access.redhat.com/security/cve/CVE-2016-4477

1 0