- Arch-security - lists.archlinux.org

[arch-security] [ASA-201609-18] lib32-curl: denial of service
by Jelle van der Waa 20 Sep '16

20 Sep '16

Arch Linux Security Advisory ASA-201609-18 ========================================== Severity: Low Date : 20916-09-20 CVE-ID : CVE-2016-7167 Package : lib32-curl Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-curl before version 7.50.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 7.50.3-1. # pacman -Syu "lib32-curl>=7.50.3-1" The problem has been fixed upstream in version 7.50.3. Workaround ========== None. Description =========== The four libcurl functions `curl_escape()`, `curl_easy_escape()`, `curl_unescape` and `curl_easy_unescape` perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments. (The functions having names without "easy" being the deprecated versions of the others.) The provided string length arguments were not properly checked and due to arithmetic in the functions, passing in the length 0xffffffff (2^32-1 or `UINT_MAX` or even just -1) would end up causing an allocation of zero bytes of heap memory that curl would attempt to write gigabytes of data into. The use of 'int' for this input type in the API is of course unwise but has remained so in order to maintain the API over the years. We are not aware of any exploit of this flaw. Impact ====== A remote attacker might cause a crash by providing a specially crafted URL, leading to a denial of service. References ========== http://www.openwall.com/lists/oss-security/2016/09/14/1 https://curl.haxx.se/docs/adv_20160914.html https://access.redhat.com/security/cve/CVE-2016-7167

1 0

[arch-security] [ASA-201609-17] lib32-jansson: denial of service
by Levente Polyak 20 Sep '16

20 Sep '16

Arch Linux Security Advisory ASA-201609-17 ========================================== Severity: Medium Date : 2016-09-20 CVE-ID : CVE-2016-4425 Package : lib32-jansson Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-jansson before version 2.8-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.8-1. # pacman -Syu "lib32-jansson>=2.8-1" The problem has been fixed upstream in version 2.8. Workaround ========== None. Description =========== A stack-exhaustion vulnerability has been found in jansson, causing a crash while parsing a crafted JSON document. Impact ====== A remote attacker might cause a crash by submitting a specially crafted JSON file to an application using jansson, leading to denial of service. References ========== http://marc.info/?l=oss-security&m=146219323703639&w=2 https://github.com/akheron/jansson/issues/282 https://access.redhat.com/security/cve/CVE-2016-4425

1 0

[arch-security] [ASA-201609-16] php: multiple issues
by Levente Polyak 18 Sep '16

18 Sep '16

Arch Linux Security Advisory ASA-201609-16 ========================================== Severity: Critical Date : 2016-09-18 CVE-ID : CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 Package : php Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package php before version 7.0.11-1 is vulnerable to multiple issues that can lead to arbitrary code execution and denial of service. Resolution ========== Upgrade to 7.0.11-1. # pacman -Syu "php>=7.0.11-1" The problems have been fixed upstream in version 7.0.11. Workaround ========== None. Description =========== - CVE-2016-7411 (arbitrary code execution) A memory Corruption vulnerability was found in php's unserialize method. This happened during the deserialized-object Destruction. - CVE-2016-7412 (arbitrary code execution) Php's mysqlnd extension assumes the `flags` returned for a BIT field necessarily contains UNSIGNED_FLAG; this might not be the case, with a rogue mysql server, or a MITM attack. A malicious mysql server or MITM can return field metadata for BIT fields that does not contain the UNSIGNED_FLAG, which leads to a heap overflow. - CVE-2016-7413 (arbitrary code execution) When WDDX tries to deserialize "recordset" element, use after free happens if close tag for the field is not found. This happens only when field names are set. - CVE-2016-7414 (arbitrary code execution) The entry.uncompressed_filesize* method does not properly verify the input parameters. An attacker can create a signature.bin with size less than 8, when this value is passed to phar_verify_signature as sig_len a heap buffer overflow occurs. - CVE-2016-7416 (arbitrary code execution) Big locale string causes stack based overflow inside libicu. - CVE-2016-7417 (insufficient validation) The return value of spl_array_get_hash_table is not properly checked and used on spl_array_get_dimension_ptr_ptr. - CVE-2016-7418 (denial of service) An attacker can trigger an Out-Of-Bounds Read in php_wddx_push_element of wddx.c. A DoS (null pointer dereference) vulnerability can be triggered in the wddx_deserialize function by providing a maliciously crafted XML string. Impact ====== A remote attacker can execute arbitrary code or cause a denial of service on the affected host through different attack vectors. References ========== http://www.openwall.com/lists/oss-security/2016/09/15/10 https://bugs.php.net/bug.php?id=73052 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7411 https://bugs.php.net/bug.php?id=72293 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7412 https://bugs.php.net/bug.php?id=72860 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7413 https://bugs.php.net/bug.php?id=72928 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7414 https://bugs.php.net/bug.php?id=73007 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7416 https://bugs.php.net/bug.php?id=73029 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7417 https://bugs.php.net/bug.php?id=73065 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7418

1 0

[arch-security] [ASA-201609-15] jansson: denial of service
by Remi Gacogne 17 Sep '16

17 Sep '16

Arch Linux Security Advisory ASA-201609-15 ========================================== Severity: Low Date : 2016-09-17 CVE-ID : CVE-2016-4425 Package : jansson Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jansson before version 2.8-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.8-1. # pacman -Syu "jansson>=2.8-1" The problem has been fixed upstream in version 2.8. Workaround ========== None. Description =========== A stack-exhaustion vulnerability has been found in jansson, causing a crash while parsing a crafted JSON document. Impact ====== A remote attacker might cause a crash by submitting a specially crafted JSON file to an application using jansson, leading to denial of service. References ========== http://marc.info/?l=oss-security&m=146219323703639&w=2 https://github.com/akheron/jansson/issues/282 https://access.redhat.com/security/cve/CVE-2016-4425

1 0

[arch-security] [ASA-201609-14] lib32-libgcrypt: information disclosure
by Remi Gacogne 17 Sep '16

17 Sep '16

Arch Linux Security Advisory ASA-201609-14 ========================================== Severity: Low Date : 2016-09-17 CVE-ID : CVE-2016-6313 Package : lib32-libgcrypt Type : information disclosure Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-libgcrypt before version 1.7.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.7.3-1. # pacman -Syu "lib32-libgcrypt>=1.7.3-1" The problem has been fixed upstream in version 1.7.3. Workaround ========== None. Description =========== Felix Dörre and Vladimir Klebanov from the Karlsruhe Institute of Technology found a bug in the mixing functions of Libgcrypt's random number generator: An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. This bug exists since 1998 in all GnuPG and Libgcrypt versions. Impact ====== A remote attacker, given access to enough entropy previously generated from the RNG, can predict its output. Such access to enough entropy has been found to be very unlikely in most situations, even for a local attacker. References ========== https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html https://access.redhat.com/security/cve/CVE-2016-6313

1 0

[arch-security] [ASA-201609-13] chromium: multiple issues
by Remi Gacogne 17 Sep '16

17 Sep '16

Arch Linux Security Advisory ASA-201609-13 ========================================== Severity: Critical Date : 2016-09-17 CVE-ID : CVE-2016-5170 CVE-2016-5171 CVE-2016-5172 CVE-2016-5173 CVE-2016-5174 CVE-2016-5175 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 53.0.2785.116-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 53.0.2785.116-1. # pacman -Syu "chromium>=53.0.2785.116-1" The problems have been fixed upstream in version 53.0.2785.116. Workaround ========== None. Description =========== - CVE-2016-5170, CVE-2016-5171 (arbitrary code execution) Use after free in Blink. - CVE-2016-5172 (information leakage) Arbitrary Memory Read in v8. - CVE-2016-5173 (access restriction bypass) Extension resource access. - CVE-2016-5174 Popup not correctly suppressed. - CVE-2016-5175 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can execute arbitrary code on the affected host, access sensitive information, bypass access restrictions or have other unspecified impact. References ========== https://googlechromereleases.blogspot.fr/2016/09/stable-channel-update-for-… https://access.redhat.com/security/cve/CVE-2016-5170 https://access.redhat.com/security/cve/CVE-2016-5171 https://access.redhat.com/security/cve/CVE-2016-5172 https://access.redhat.com/security/cve/CVE-2016-5173 https://access.redhat.com/security/cve/CVE-2016-5174 https://access.redhat.com/security/cve/CVE-2016-5175

1 0

[arch-security] [ASA-201609-12] lib32-flashplugin: multiple issues
by Levente Polyak 15 Sep '16

15 Sep '16

Arch Linux Security Advisory ASA-201609-12 ========================================== Severity: Critical Date : 2016-09-15 CVE-ID : CVE-2016-4271 CVE-2016-4272 CVE-2016-4274 CVE-2016-4275 CVE-2016-4276 CVE-2016-4277 CVE-2016-4278 CVE-2016-4279 CVE-2016-4280 CVE-2016-4281 CVE-2016-4282 CVE-2016-4283 CVE-2016-4284 CVE-2016-4285 CVE-2016-4287 CVE-2016-6921 CVE-2016-6922 CVE-2016-6923 CVE-2016-6924 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 CVE-2016-6932 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.635-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 11.2.202.635-1. # pacman -Syu "lib32-flashplugin>=11.2.202.635-1" The problems have been fixed upstream in version 11.2.202.635. Workaround ========== None. Description =========== - CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924 (arbitrary code execution) Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero, willJ of Tencent PC Manager, Yuki Chen of Qihoo 360 Vulcan Team, b0nd@garage4hackers working with Trend Micro's Zero Day Initiative, and Tao Yan (@Ga1ois) of Palo Alto Networks - CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932 (arbitrary code execution) Multiple use-after-free vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities have been discovered by, Mumei working with Trend Micro's Zero Day Initiative, Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program, willJ of Tencent PC Manager, JieZeng of Tencent Zhanlu Lab working with the Chromium Vulnerability Rewards Program, Nicolas Joly of Microsoft Vulnerability Research, and Yuki Chen of Qihoo 360 Vulcan Team - CVE-2016-4287 (arbitrary code execution) An integer overflow vulnerability that could lead to arbitrary code execution has been found. This vulnerability has been discovered by Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program. - CVE-2016-4271, CVE-2016-4277, CVE-2016-4278 (information disclosure) A Security bypass vulnerablity that could lead to information disclosure has been found. These vulnerabilities have been found by Leone Pontorieri, Soroush Dalili and Matthew Evans from NCC Group, and Nicolas Joly of Microsoft Vulnerability Research Impact ====== A remote attacker can execute arbitrary code, bypass security checks, or disclose information on the affected host via unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-29.html https://access.redhat.com/security/cve/CVE-2016-4271 https://access.redhat.com/security/cve/CVE-2016-4272 https://access.redhat.com/security/cve/CVE-2016-4274 https://access.redhat.com/security/cve/CVE-2016-4275 https://access.redhat.com/security/cve/CVE-2016-4276 https://access.redhat.com/security/cve/CVE-2016-4277 https://access.redhat.com/security/cve/CVE-2016-4278 https://access.redhat.com/security/cve/CVE-2016-4279 https://access.redhat.com/security/cve/CVE-2016-4280 https://access.redhat.com/security/cve/CVE-2016-4281 https://access.redhat.com/security/cve/CVE-2016-4282 https://access.redhat.com/security/cve/CVE-2016-4283 https://access.redhat.com/security/cve/CVE-2016-4284 https://access.redhat.com/security/cve/CVE-2016-4285 https://access.redhat.com/security/cve/CVE-2016-4287 https://access.redhat.com/security/cve/CVE-2016-6921 https://access.redhat.com/security/cve/CVE-2016-6922 https://access.redhat.com/security/cve/CVE-2016-6923 https://access.redhat.com/security/cve/CVE-2016-6924 https://access.redhat.com/security/cve/CVE-2016-6925 https://access.redhat.com/security/cve/CVE-2016-6926 https://access.redhat.com/security/cve/CVE-2016-6927 https://access.redhat.com/security/cve/CVE-2016-6929 https://access.redhat.com/security/cve/CVE-2016-6930 https://access.redhat.com/security/cve/CVE-2016-6931 https://access.redhat.com/security/cve/CVE-2016-6932

1 0

[arch-security] [ASA-201609-11] flashplugin: multiple issues
by Levente Polyak 15 Sep '16

15 Sep '16

Arch Linux Security Advisory ASA-201609-11 ========================================== Severity: Critical Date : 2016-09-15 CVE-ID : CVE-2016-4271 CVE-2016-4272 CVE-2016-4274 CVE-2016-4275 CVE-2016-4276 CVE-2016-4277 CVE-2016-4278 CVE-2016-4279 CVE-2016-4280 CVE-2016-4281 CVE-2016-4282 CVE-2016-4283 CVE-2016-4284 CVE-2016-4285 CVE-2016-4287 CVE-2016-6921 CVE-2016-6922 CVE-2016-6923 CVE-2016-6924 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 CVE-2016-6932 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.635-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 11.2.202.635-1. # pacman -Syu "flashplugin>=11.2.202.635-1" The problems have been fixed upstream in version 11.2.202.635. Workaround ========== None. Description =========== - CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924 (arbitrary code execution) Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero, willJ of Tencent PC Manager, Yuki Chen of Qihoo 360 Vulcan Team, b0nd@garage4hackers working with Trend Micro's Zero Day Initiative, and Tao Yan (@Ga1ois) of Palo Alto Networks - CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932 (arbitrary code execution) Multiple use-after-free vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities have been discovered by, Mumei working with Trend Micro's Zero Day Initiative, Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program, willJ of Tencent PC Manager, JieZeng of Tencent Zhanlu Lab working with the Chromium Vulnerability Rewards Program, Nicolas Joly of Microsoft Vulnerability Research, and Yuki Chen of Qihoo 360 Vulcan Team - CVE-2016-4287 (arbitrary code execution) An integer overflow vulnerability that could lead to arbitrary code execution has been found. This vulnerability has been discovered by Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program. - CVE-2016-4271, CVE-2016-4277, CVE-2016-4278 (information disclosure) A Security bypass vulnerablity that could lead to information disclosure has been found. These vulnerabilities have been found by Leone Pontorieri, Soroush Dalili and Matthew Evans from NCC Group, and Nicolas Joly of Microsoft Vulnerability Research Impact ====== A remote attacker can execute arbitrary code, bypass security checks, or disclose information on the affected host via unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-29.html https://access.redhat.com/security/cve/CVE-2016-4271 https://access.redhat.com/security/cve/CVE-2016-4272 https://access.redhat.com/security/cve/CVE-2016-4274 https://access.redhat.com/security/cve/CVE-2016-4275 https://access.redhat.com/security/cve/CVE-2016-4276 https://access.redhat.com/security/cve/CVE-2016-4277 https://access.redhat.com/security/cve/CVE-2016-4278 https://access.redhat.com/security/cve/CVE-2016-4279 https://access.redhat.com/security/cve/CVE-2016-4280 https://access.redhat.com/security/cve/CVE-2016-4281 https://access.redhat.com/security/cve/CVE-2016-4282 https://access.redhat.com/security/cve/CVE-2016-4283 https://access.redhat.com/security/cve/CVE-2016-4284 https://access.redhat.com/security/cve/CVE-2016-4285 https://access.redhat.com/security/cve/CVE-2016-4287 https://access.redhat.com/security/cve/CVE-2016-6921 https://access.redhat.com/security/cve/CVE-2016-6922 https://access.redhat.com/security/cve/CVE-2016-6923 https://access.redhat.com/security/cve/CVE-2016-6924 https://access.redhat.com/security/cve/CVE-2016-6925 https://access.redhat.com/security/cve/CVE-2016-6926 https://access.redhat.com/security/cve/CVE-2016-6927 https://access.redhat.com/security/cve/CVE-2016-6929 https://access.redhat.com/security/cve/CVE-2016-6930 https://access.redhat.com/security/cve/CVE-2016-6931 https://access.redhat.com/security/cve/CVE-2016-6932

1 0

[arch-security] [ASA-201609-10] mariadb: multiple issues
by Christian Rebischke 14 Sep '16

14 Sep '16

Arch Linux Security Advisory ASA-201609-10 ========================================== Severity: Critical Date : 2016-09-14 CVE-ID : CVE-2016-6662 CVE-2016-6663 Package : mariadb Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mariadb before version 10.1.17-1 is vulnerable to multiple issues including arbitrary code execution and access restriction bypass. Resolution ========== Upgrade to 10.1.17-1. # pacman -Syu "mariadb>=10.1.17-1" The problems have been fixed upstream in version 10.1.17. Workaround ========== None. Description =========== - CVE-2016-6662 (arbitrary code execution) Researcher Dawid Golunski discovered several security issues in the mariadb DBMS, including a vulnerability flaw that can be exploited by a remote attacker to inject malicious settings into my.cnf configuration files. The flaw can be triggered to fully compromise the DBMS by executing arbitrary code with root privileges if mysqld_safe is executed. - CVE-2016-6663 (access restriction bypass) In the past mariadb used to read the main configuration file from three different locations. One of them (the datadir) is unsafe because it's writeable by the sql-server. This way a remote attacker who could gain access to the sql-server could deploy a maliciously crafted configuration file. Impact ====== A remote attacker is able to inject malicious configuration into existing configuration files, create new configuration files, gain access to logging functions and execute arbitrary code with root privileges if mysqld_safe is executed. References ========== https://access.redhat.com/security/cve/CVE-2016-6662 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-6663 https://jira.mariadb.org/browse/MDEV-10465 http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution…

1 0

[arch-security] [ASA-201609-9] powerdns: denial of service
by Remi Gacogne 13 Sep '16

13 Sep '16

Arch Linux Security Advisory ASA-201609-9 ========================================= Severity: Medium Date : 2016-09-13 CVE-ID : CVE-2016-5426 CVE-2016-5427 Package : powerdns Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package powerdns before version 4.0.1-3 is vulnerable to denial of service. Resolution ========== Upgrade to 4.0.1-3. # pacman -Syu "powerdns>=4.0.1-3" The problems have been fixed upstream in version 4.0.0. Workaround ========== Running dnsdist in front of potentially affected servers prevents CVE-2016-5426, and can prevent CVE-2016-5427 with the use of custom rules described in the PowerDNS advisory. Description =========== Two issues have been found in PowerDNS Authoritative Server allowing a remote, unauthenticated attacker to cause an abnormal load on the PowerDNS backend by sending crafted DNS queries, which might result in a partial denial of service if the backend becomes overloaded. SQL backends for example are particularly vulnerable to this kind of unexpected load if they have not been dimensioned for it. - CVE-2016-5426 PowerDNS Authoritative Server accepts queries with a qname's length larger than 255 bytes. - CVE-2016-5427 PowerDNS Authoritative Server does not properly handle dot inside labels. Impact ====== A remote, unauthenticated attacker can cause an abnormal load on the backend by sending crafted DNS queries, resulting in denial of service. References ========== http://seclists.org/oss-sec/2016/q3/464 https://doc.powerdns.com/md/security/powerdns-advisory-2016-01/ https://access.redhat.com/security/cve/CVE-2016-5426 https://access.redhat.com/security/cve/CVE-2016-5427

1 0