- Arch-security - lists.archlinux.org

[arch-security] [ASA-201610-6] imagemagick: multiple issues
by Christian Rebischke 08 Oct '16

08 Oct '16

Arch Linux Security Advisory ASA-201610-6 ========================================= Severity: High Date : 2016-10-08 CVE-ID : CVE-2016-7799 CVE-2016-7906 Package : imagemagick Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imagemagick before version 6.9.6.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 6.9.6.0-1. # pacman -Syu "imagemagick>=6.9.6.0-1" The problems have been fixed upstream in version 6.9.6.0. Workaround ========== None. Description =========== - CVE-2016-7799 (denial of service) A buffer over-read vulnerability was found in ImageMagick. A malicious file could cause the application to crash. - CVE-2016-7906 (arbitrary code execution) An attacker is able to trigger a use-after-free when providing a crafted image to ImageMagick's mogrify function. Impact ====== A remote attacker is able to craft a malicious image to execute arbitrary code or crash the application. References ========== https://github.com/ImageMagick/ImageMagick/commit/a7bb158b7bedd1449a34432fe… http://www.openwall.com/lists/oss-security/2016/10/01/6 https://github.com/ImageMagick/ImageMagick/issues/280 https://github.com/ImageMagick/ImageMagick/issues/281 http://www.openwall.com/lists/oss-security/2016/10/02/3 https://github.com/ImageMagick/ImageMagick/commit/d63a3c5729df59f183e9e110d… https://access.redhat.com/security/cve/CVE-2016-7799 https://access.redhat.com/security/cve/CVE-2016-7906

1 0

[arch-security] [ASA-201610-5] messagelib: multiple issues
by Christian Rebischke 07 Oct '16

07 Oct '16

Arch Linux Security Advisory ASA-201610-5 ========================================= Severity: Medium Date : 2016-10-07 CVE-ID : CVE-2016-7967 CVE-2016-7968 Package : messagelib Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package messagelib before version 16.08.1-2 is vulnerable to multiple issues including cross-site scripting and insufficient validation. Resolution ========== Upgrade to 16.08.1-2. # pacman -Syu "messagelib>=16.08.1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2016-7967 (cross-site scripting) KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled. - CVE-2016-7968 (insufficient validation) KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed. Impact ====== An attacker is able to access local or remote urls via injected javascript. References ========== https://www.kde.org/info/security/advisory-20161006-1.txt https://www.kde.org/info/security/advisory-20161006-3.txt http://seclists.org/oss-sec/2016/q4/23 https://www.kde.org/info/security/advisory-20161006-2.txt http://seclists.org/oss-sec/2016/q4/21 https://access.redhat.com/security/cve/CVE-2016-7967 https://access.redhat.com/security/cve/CVE-2016-7968s

1 0

[arch-security] [ASA-201610-4] kcoreaddons: insufficient validation
by Christian Rebischke 07 Oct '16

07 Oct '16

Arch Linux Security Advisory ASA-201610-4 ========================================= Severity: Medium Date : 2016-10-07 CVE-ID : CVE-2016-7966 Package : kcoreaddons Type : insufficient validation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package kcoreaddons before version 5.26.0-2 is vulnerable to insufficient validation. Resolution ========== Upgrade to 5.26.0-2. # pacman -Syu "kcoreaddons>=5.26.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plain text viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content. Impact ====== A remote attacker is able to inject HTML code in KMail's plain text viewer. References ========== https://www.kde.org/info/security/advisory-20161006-1.txt http://seclists.org/oss-sec/2016/q4/23 https://access.redhat.com/security/cve/CVE-2016-7966

1 0

[arch-security] [ASA-201610-3] hostapd: multiple issues
by Levente Polyak 04 Oct '16

04 Oct '16

Arch Linux Security Advisory ASA-201610-3 ========================================= Severity: High Date : 2016-10-04 CVE-ID : CVE-2016-4476 CVE-2016-4477 Package : hostapd Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package hostapd before version 2.6-1 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 2.6-1. # pacman -Syu "hostapd>=2.6-1" The problems have been fixed upstream in version 2.6. Workaround ========== None. Description =========== - CVE-2016-4476 (denial of service) A vulnerability was found in how hostapd and wpa_supplicant writes the configuration file update for the WPA/WPA2 passphrase parameter. If this parameter has been updated to include control characters either through a WPS operation or through local configuration change over the wpa_supplicant control interface, the resulting configuration file may prevent the hostapd and wpa_supplicant from starting when the updated file is used. - CVE-2016-4477 (privilege escalation) The local configuration update through the control interface SET_NETWORK command could allow privilege escalation for the local user to run code from a locally stored library file under the same privileges as the wpa_supplicant process has. The assumption here is that a not fully trusted user/application might have access through a connection manager to set network profile parameters like psk, but would not have access to set other configuration file parameters. If the connection manager in such a case does not filter out control characters from the psk value, it could have been possible to practically update the global parameters by embedding a newline character within the psk value. In addition, the untrusted user/application would need to be able to install a library file somewhere on the device from where the wpa_supplicant process has privileges to load the library. Impact ====== A remote attacker is able to perform a denial of service attack that prevents hostapd from starting. Furthermore a local attacker is able to elevate privileges by a local configuration update under certain circumstances. References ========== http://www.openwall.com/lists/oss-security/2016/05/03/2 https://w1.fi/security/2016-1/psk-parameter-config-update.txt https://access.redhat.com/security/cve/CVE-2016-4476 https://access.redhat.com/security/cve/CVE-2016-4477

1 0

[arch-security] [ASA-201610-2] systemd: denial of service
by Levente Polyak 04 Oct '16

04 Oct '16

Arch Linux Security Advisory ASA-201610-2 ========================================= Severity: High Date : 2016-10-04 CVE-ID : CVE-2016-7795 Package : systemd Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package systemd before version 231-2 is vulnerable to denial of service. Resolution ========== Upgrade to 231-2. # pacman -Syu "systemd>=231-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== systemd fails an assertion in manager_invoke_notify_message when a zero-length message is received over its notification socket. After failing the assertion, PID 1 hangs in the pause system call. It is no longer possible to start and stop daemons or cleanly reboot the system. Inetd-style services managed by systemd no longer accept connections. Since the notification socket, /run/systemd/notify, is world-writable, this allows a local user to perform a denial-of-service attack against systemd. Proof-of-concept: NOTIFY_SOCKET=/run/systemd/notify systemd-notify "" Impact ====== A local attacker is able to perform a denial of service attack by obstructing start/stop of any daemons and clean reboot of the system. References ========== https://github.com/systemd/systemd/issues/4234 http://www.openwall.com/lists/oss-security/2016/09/28/9 https://access.redhat.com/security/cve/CVE-2016-7795

1 0

[arch-security] [ASA-201610-1] chromium: arbitrary code execution
by Christian Rebischke 03 Oct '16

03 Oct '16

rch Linux Security Advisory ASA-201610-1 ========================================= Severity: Critical Date : 2016-10-03 CVE-ID : CVE-2016-5177 CVE-2016-5178 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 53.0.2785.143-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 53.0.2785.143-1. # pacman -Syu "chromium>=53.0.2785.143-1" The problems have been fixed upstream in version 53.0.2785.143. Workaround ========== None. Description =========== - CVE-2016-5177 (arbitrary code execution) Use after free in V8. - CVE-2016-5178 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker could be able to execute arbitrary code. References ========== https://googlechromereleases.blogspot.fr/2016/09/stable-channel-update-for-… https://access.redhat.com/security/cve/CVE-2016-5177 https://access.redhat.com/security/cve/CVE-2016-5178

1 0

[arch-security] [ASA-201609-32] wordpress: multiple issues
by Levente Polyak 30 Sep '16

30 Sep '16

Arch Linux Security Advisory ASA-201609-32 ========================================== Severity: High Date : 2016-09-30 CVE-ID : CVE-2016-7168 CVE-2016-7169 Package : wordpress Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wordpress before version 4.6.1-1 is vulnerable to multiple issues including directory traversal and cross-site scripting. Resolution ========== Upgrade to 4.6.1-1. # pacman -Syu "wordpress>=4.6.1-1" The problems have been fixed upstream in version 4.6.1. Workaround ========== None. Description =========== - CVE-2016-7168 (cross-site scripting) A cross-site scripting vulnerability has been discovered via a malicious image filename, reported by SumOfPwn researcher Cengiz Han Sahin. A WordPress admin can be tricked into uploading a malicious image file requested by a user this admin trusts or a popular malicious image that was spread via social media. - CVE-2016-7169 (directory traversal) A path traversal vulnerability has been discovered in the upgrade package uploader, reported by Dominik Schilling from the WordPress security team. Impact ====== A remote attacker is able to take advantage of a directory traversal vulnerability via the upgrade package uploader or perform a persistent cross-site scripting attack by tricking an admin into uploading a malicious image filename. References ========== https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance… http://www.openwall.com/lists/oss-security/2016/09/08/24 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7168 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7169

1 0

[arch-security] [ASA-201609-31] c-ares: arbitrary code execution
by Levente Polyak 30 Sep '16

30 Sep '16

Arch Linux Security Advisory ASA-201609-31 ========================================== Severity: High Date : 2016-09-30 CVE-ID : CVE-2016-5180 Package : c-ares Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package c-ares before version 1.12.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.12.0-1. # pacman -Syu "c-ares>=1.12.0-1" The problem has been fixed upstream in version 1.12.0. Workaround ========== None. Description =========== When a string is passed in to ares_create_query or ares_mkquery and uses an escaped trailing dot, like "hello\.", c-ares calculates the string length wrong and subsequently writes outside of the the allocated buffer with one byte. The wrongly written byte is the least significant byte of the 'dnsclass' argument; most commonly 1. Impact ====== A remote attacker is able to perform a denial of service attack or possibly execute arbitrary code under certain circumstances. References ========== https://c-ares.haxx.se/adv_20160929.html https://c-ares.haxx.se/CVE-2016-5180.patch https://access.redhat.com/security/cve/CVE-2016-5180

1 0

[arch-security] [ASA-201609-30] openssl: denial of service
by Levente Polyak 28 Sep '16

28 Sep '16

Arch Linux Security Advisory ASA-201609-30 ========================================== Severity: Medium Date : 2016-09-28 CVE-ID : CVE-2016-7052 Package : openssl Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.j-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.2.j-1. # pacman -Syu "openssl>=1.0.2.j-1" The problem has been fixed upstream in version 1.0.2.j. Workaround ========== None. Description =========== A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0 but was omitted from OpenSSL 1.0.2i. As a result any attempt to use CRLs in OpenSSL 1.0.2i will crash with a null pointer exception. The issue was reported to OpenSSL on 22nd September 2016 by Bruce Stephens and Thomas Jakobi. Impact ====== A remote attacker is able to perform a denial of service attack by using a certificate revocation list. References ========== https://www.openssl.org/news/secadv/20160926.txt https://access.redhat.com/security/cve/CVE-2016-7052

1 0

[arch-security] [ASA-201609-29] bind: denial of service
by Levente Polyak 27 Sep '16

27 Sep '16

Arch Linux Security Advisory ASA-201609-29 ========================================== Severity: High Date : 2016-09-27 CVE-ID : CVE-2016-2776 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.4.P3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.4.P3-1. # pacman -Syu "bind>=9.10.4.P3-1" The problem has been fixed upstream in version 9.10.4.P3. Workaround ========== None. Description =========== Testing by ISC has uncovered a critical error condition which can occur when a nameserver is constructing a response. A defect in the rendering of messages into packets can cause 'named' to exit with an assertion failure in buffer.c while constructing a response to a query that meets certain criteria. This assertion can be triggered even if the apparent source address isn't allowed to make queries (i.e. doesn't match 'allow-query'). Impact ====== A remote attacker is able to perform a denial of service attack via a specially crafted request. References ========== https://kb.isc.org/article/AA-01419/0 https://access.redhat.com/security/cve/CVE-2016-2776

1 0