- Arch-security - lists.archlinux.org

[arch-security] [ASA-201607-4] thunderbird: arbitrary code execution
by Remi Gacogne 10 Jul '16

10 Jul '16

Arch Linux Security Advisory ASA-201607-4 ========================================= Severity: Critical Date : 2016-07-10 CVE-ID : CVE-2016-2815 CVE-2016-2818 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.2.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 45.2.0-1. # pacman -Syu "thunderbird>=45.2.0-1" The problems have been fixed upstream in version 45.2.0. Workaround ========== None. Description =========== - CVE-2016-2815 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-2818 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://access.redhat.com/security/cve/CVE-2016-2815 https://access.redhat.com/security/cve/CVE-2016-2818

1 0

[arch-security] [ASA-201607-3] libreoffice-fresh: arbitrary code execution
by Levente Polyak 05 Jul '16

05 Jul '16

Arch Linux Security Advisory ASA-201607-3 ========================================= Severity: Critical Date : 2016-07-05 CVE-ID : CVE-2016-4324 Package : libreoffice-fresh Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libreoffice-fresh before version 5.1.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.1.4-1. # pacman -Syu "libreoffice-fresh>=5.1.4-1" The problem has been fixed upstream in version 5.1.4. Workaround ========== None. Description =========== A use after free vulnerability was found in the RTF parser of LibreOffice. The vulnerability lies in the parsing of documents containing both stylesheet and superscript tokens. A specially crafted RTF document containing both a stylesheet and superscript element causes LibreOffice to access an invalid pointer referencing previously used memory on the heap. By carefully manipulating the contents of the heap, this vulnerability can be used to execute arbitrary code. Impact ====== An attacker is able to use a specially crafted RTF document that, when opened locally, is leading to arbitrary code execution. References ========== https://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/ http://www.talosintelligence.com/reports/TALOS-2016-0126/ https://access.redhat.com/security/cve/CVE-2016-4324

1 0

[arch-security] [ASA-201607-2] xerces-c: denial of service
by Levente Polyak 05 Jul '16

05 Jul '16

Arch Linux Security Advisory ASA-201607-2 ========================================= Severity: Medium Date : 2016-07-05 CVE-ID : CVE-2016-4463 Package : xerces-c Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package xerces-c before version 3.1.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.1.4-1. # pacman -Syu "xerces-c>=3.1.4-1" The problem has been fixed upstream in version 3.1.4. Workaround ========== None. Description =========== The Xerces-C XML parser fails to successfully parse a DTD that is deeply nested, and this causes a stack overflow, which makes a denial of service attack against many applications possible by an unauthenticated attacker. Impact ====== A remote attacker is able to use a specially crafted XML document that, when processed, is leading to application crash resulting in denial of service. References ========== https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt http://seclists.org/bugtraq/2016/Jun/115 https://access.redhat.com/security/cve/CVE-2016-4463

1 0

[arch-security] [ASA-201607-1] libarchive: arbitrary code execution
by Levente Polyak 05 Jul '16

05 Jul '16

Arch Linux Security Advisory ASA-201607-1 ========================================= Severity: Critical Date : 2016-07-05 CVE-ID : CVE-2016-1541 Package : libarchive Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libarchive before version 3.2.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.2.0-1. # pacman -Syu "libarchive>=3.2.0-1" The problem has been fixed upstream in version 3.2.0. Workaround ========== None. Description =========== A vulnerability was found in libarchive. A specially crafted zip file can provide an incorrect compressed size, which may allow an attacker to place arbitrary code on the heap and execute it in the context of the application. Impact ====== A remote attacker is able to use a specially crafted zip file that, when processed, is leading to arbitrary code execution. References ========== https://github.com/libarchive/libarchive/commit/d0331e8e https://www.kb.cert.org/vuls/id/862384 https://access.redhat.com/security/cve/CVE-2016-1541

1 0

[arch-security] [ASA-201606-25] phpmyadmin: multiple issues
by Jelle van der Waa 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-25 ========================================== Severity: High Date : 2016-06-25 CVE-ID : CVE-2016-5701 CVE-2016-5702 CVE-2016-5703 CVE-2016-5704 CVE-2016-5705 CVE-2016-5706 CVE-2016-5730 CVE-2016-5731 CVE-2016-5732 CVE-2016-5732 CVE-2016-5733 CVE-2016-5739 Package : phpmyadmin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package phpmyadmin before version 4.6.3-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 4.6.3-1. # pacman -Syu "phpmyadmin>=4.6.3-1" The problems have been fixed upstream in version 4.6.3. Workaround ========== None. Description =========== - CVE-2016-5702 (cookie attribute injection) A vulnerability was found where, under some circumstances, an attacker can inject arbitrary values in the browser cookies. Only affected when PHP_SELF is not set. - CVE-2016-5703 (SQL injection) A vulnerability was discovered that allows an SQL injection attack to run arbitrary commands as the control user. This attack requires a controluser to exist and be configured in `config.inc.php`, therefore the attack can be mitigated by temporarily disabling the controluser. - CVE-2016-5704 (cross-side scripting) An cross-side scripting vulnerability was discovered on the table structure page - CVE-2016-5705 (cross-side scripting) * An cross-side scripting vulnerability was discovered on the user privileges page. * An cross-side scripting vulnerability was discovered in the error console. * An cross-side scripting vulnerability was discovered in the central columns feature. * An cross-side scripting vulnerability was discovered in the query bookmarks feature. * An cross-side scripting vulnerability was discovered in the user groups feature. - CVE-2016-5706 (denial of service) A Denial Of Service (DOS) attack was discovered in the way phpMyAdmin loads some JavaScript files. - CVE-2016-5730 (information disclosure) By specially crafting requests in the following areas, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. 1. Setup script 2. Example OpenID authentication script To mitigate these issues, it is possible to remove the setup script and examples subdirectories: ./setup/ and ./examples/. - CVE-2016-5731 (cross-side scripting) With a specially crafted request, it is possible to trigger an cross-side scripting attack through the example OpenID authentication script. Only affected when the default php.ini is changed and set html_errors = Off. - CVE-2016-5732 (cross-side scripting) A vulnerability was reported allowing a specially crafted table parameters to cause an cross-side scripting attack through the table structure page. - CVE-2016-57033 (cross-side scripting) * A vulnerability was reported allowing a specially crafted table name to cause an cross-side scripting attack through the functionality to check database privileges. * This cross-side scripting doesn't exist in some translations due to different quotes being used there (eg. Czech). * A vulnerability was reported allowing a specifically-configured MySQL server to execute an cross-side scripting attack. This particular attack requires configuring the MySQL server log_bin directive with the payload. * Several cross-side scripting vulnerabilities were found with the Transformation feature * Several cross-side scripting vulnerabilities were found in AJAX error handling * Several cross-side scripting vulnerabilities were found in the Designer feature * An cross-side scripting vulnerability was found in the charts feature * An cross-side scripting vulnerability was found in the zoom search feature - CVE-2016-5739 (information disclosure) A vulnerability was reported where a specially crafted Transformation could be used to leak information including the authentication token. This could be used to direct a CSRF attack against a user. Impact ====== A remote attacker might be able to access sensitive information, cause a denial of service, cause a cross-side scripting attack or cause an SQL injection. References ========== https://access.redhat.com/security/cve/CVE-2016-5701 https://access.redhat.com/security/cve/CVE-2016-5702 https://access.redhat.com/security/cve/CVE-2016-5703 https://access.redhat.com/security/cve/CVE-2016-5704 https://access.redhat.com/security/cve/CVE-2016-5705 https://access.redhat.com/security/cve/CVE-2016-5706 https://access.redhat.com/security/cve/CVE-2016-5730 https://access.redhat.com/security/cve/CVE-2016-5731 https://access.redhat.com/security/cve/CVE-2016-5732 https://access.redhat.com/security/cve/CVE-2016-5733 https://access.redhat.com/security/cve/CVE-2016-5739 https://www.phpmyadmin.net/security/PMASA-2016-17/ https://www.phpmyadmin.net/security/PMASA-2016-18/ https://www.phpmyadmin.net/security/PMASA-2016-19/ https://www.phpmyadmin.net/security/PMASA-2016-20/ https://www.phpmyadmin.net/security/PMASA-2016-21/ https://www.phpmyadmin.net/security/PMASA-2016-22/ https://www.phpmyadmin.net/security/PMASA-2016-23/ https://www.phpmyadmin.net/security/PMASA-2016-24/ https://www.phpmyadmin.net/security/PMASA-2016-25/ https://www.phpmyadmin.net/security/PMASA-2016-26/ https://www.phpmyadmin.net/security/PMASA-2016-27/ https://www.phpmyadmin.net/security/PMASA-2016-28/

1 0

[arch-security] [ASA-201606-24] libpurple: multiple issues
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-24 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-2365 CVE-2016-2366 CVE-2016-2367 CVE-2016-2368 CVE-2016-2369 CVE-2016-2370 CVE-2016-2371 CVE-2016-2372 CVE-2016-2373 CVE-2016-2374 CVE-2016-2375 CVE-2016-2376 CVE-2016-2377 CVE-2016-2378 CVE-2016-2380 CVE-2016-4323 Package : libpurple Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libpurple before version 2.11.0-1 is vulnerable to multiple issues including information leakage, denial of service, directory traversal and arbitrary code execution. Resolution ========== Upgrade to 2.11.0-1. # pacman -Syu "libpurple>=2.11.0-1" The problems have been fixed upstream in version 2.11.0. Workaround ========== All flaws have been found in the support for the MXit protocol. Therefore libpurple is only vulnerable when this protocol is used, so disabling MXit accounts until the package can be upgraded should be enough. Description =========== - CVE-2016-2365 (denial of service) Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. - CVE-2016-2366 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. - CVE-2016-2367 (information leakage, denial of service) Specially crafted MXIT data sent via the server could potentially result in an out of bounds read. This issue can also potentially leak sensitive information from memory into the data after the avatar which can then be transferred when the avatar is copied. - CVE-2016-2368 (arbitrary code execution) Specially crafted MXIT data sent via the server could potentially result in a buffer overflow. The MXIT plugin for Pidgin uses the function g_snprintf() in about 27 places where it receives the return value of the function. When g_snprintf() returns, it will return the number of bytes that would have been written had the buffer been large enough, not the amount of bytes that have actually been written. The MXIT plugin uses the return value of g_snprintf() as an index or an offset into the string that is being manipulated in multiple locations without making sure that the return value is within bounds. - CVE-2016-2369 (denial of service) Specially crafted MXIT data sent via the server could potentially result in a NULL pointer dereference. - CVE-2016-2370 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. - CVE-2016-2371 (arbitrary code execution) Specially crafted MXIT data sent via the server could potentially result in a buffer overflow. The function mxit_parse_cmd_extprofile() is called when extended profile packets are received from the server. A malicious server, an attacker who intercepts the network traffic or a potentially malicious user (if the data is not validated by the server) can send an invalid number of records, which could result in an out-of-bounds write of data. - CVE-2016-2372 (information leakage, denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. This issue can also potentially leak sensitive information by appending sensitive information from memory to the end of a received file. - CVE-2016-2373 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability. - CVE-2016-2374 (arbitrary code execution) Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution. - CVE-2016-2375 (information leakage) Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. In the function mxit_parse_cmd_suggestcontacts() in the file mxit/protocol.c at line 2020 the number of attributes will be read from the incoming packet into the variable count. - CVE-2016-2376 (arbitrary code execution) Specially crafted MXIT data sent from the server could potentially result in a buffer overflow. The function mxit_cb_rx in the file mxit/protocol.c is a callback function will be called by Pidgin whenever data is sent from the MXIT server. When data is received, the size of the incoming packet will also be received at line 2825. There is a check at line 2826 to ensure that this data isn't larger than the maximum size of that an MXIT packet can be which is defined as CP_MAX_PACKET. This is also the size of the buffer that the data is read into. However if the size is larger than CP_MAX_PACKET, an error will be logged but execution will simply continue. Moreover, if the size is negative (this is possible since rx_res is an int) then no error will be logged and execution will also continue. - CVE-2016-2377 (arbitrary code execution) Specially crafted MXIT data sent by the server could potentially result in an out of bounds write of one byte. - CVE-2016-2378 (arbitrary code execution) Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. - CVE-2016-2380 (information leakage) Specially crafted MXIT data sent to the server could potentially result in an out of bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read. - CVE-2016-4323 (directory traversal) Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image triggering the vulnerability. Impact ====== A remote attacker might be able to access sensitive information, cause a denial of service or execute arbitrary code on the affected host. References ========== http://blog.talosintel.com/2016/06/vulnerability-spotlight-pidgin.html https://access.redhat.com/security/cve/CVE-2016-2365 https://access.redhat.com/security/cve/CVE-2016-2366 https://access.redhat.com/security/cve/CVE-2016-2367 https://access.redhat.com/security/cve/CVE-2016-2368 https://access.redhat.com/security/cve/CVE-2016-2369 https://access.redhat.com/security/cve/CVE-2016-2370 https://access.redhat.com/security/cve/CVE-2016-2371 https://access.redhat.com/security/cve/CVE-2016-2372 https://access.redhat.com/security/cve/CVE-2016-2373 https://access.redhat.com/security/cve/CVE-2016-2374 https://access.redhat.com/security/cve/CVE-2016-2375 https://access.redhat.com/security/cve/CVE-2016-2376 https://access.redhat.com/security/cve/CVE-2016-2377 https://access.redhat.com/security/cve/CVE-2016-2378 https://access.redhat.com/security/cve/CVE-2016-2380 https://access.redhat.com/security/cve/CVE-2016-4323

1 0

[arch-security] [ASA-201606-23] libdwarf: arbitrary code execution
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-23 ========================================== Severity: High Date : 2016-06-25 CVE-ID : CVE-2016-5027 CVE-2016-5028 CVE-2016-5029 CVE-2016-5030 CVE-2016-5031 CVE-2016-5032 CVE-2016-5033 CVE-2016-5034 CVE-2016-5035 CVE-2016-5036 CVE-2016-5037 CVE-2016-5038 CVE-2016-5039 CVE-2016-5040 CVE-2016-5041 CVE-2016-5042 CVE-2016-5043 CVE-2016-5044 Package : libdwarf Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libdwarf before version 20160613-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 20160613-1. # pacman -Syu "libdwarf>=20160613-1" The problems have been fixed upstream in version 20160613. Workaround ========== None. Description =========== - CVE-2016-5027 (denial of service) Multiple NULL pointer dereference issues in several functions of libdwarf/dwarf_leb.c, where leb128_length was wrongly assumed non-NULL. - CVE-2016-5028 (denial of service) NULL pointer dereference issue in print_frame_inst_bytes(). - CVE-2016-5029 (denial of service) NULL pointer dereference issue in create_fullest_file_path(). - CVE-2016-5030 (denial of service) NULL pointer dereference issue in _dwarf_calculate_info_section_end_ptr(). - CVE-2016-5031 (denial of service) Out-of-bounds read bug in print_frame_inst_bytes(). - CVE-2016-5032 (denial of service) Out-of-bounds read bug in dwarf_get_xu_hash_entry(). - CVE-2016-5033 (denial of service) Out-of-bounds read bug in print_exprloc_content(). - CVE-2016-5034 (arbitrary code execution) Invalid write in dwarf_elf_access.c. - CVE-2016-5035 (denial of service) Out-of-bounds read bug in _dwarf_read_line_table_header(). - CVE-2016-5036 (denial of service) Out-of-bounds read bug in dump_block(). - CVE-2016-5037 (denial of service) NULL pointer dereference issue in _dwarf_load_section(). - CVE-2016-5038 (denial of service) NULL pointer dereference issue in dwarf_get_macro_startend_file(). - CVE-2016-5039 (denial of service) Out-of-bounds read bug in get_attr_value(). - CVE-2016-5040 (denial of service) Out-of-bounds read bug. - CVE-2016-5041 (denial of service) NULL pointer dereference issue. - CVE-2016-5042 (denial of service) Infinite loop leading to out-of-bounds read in dwarf_get_aranges_list(). - CVE-2016-5043 (denial of service) Out-of-bounds read bug in dwarf_dealloc(). - CVE-2016-5044 (arbitrary code execution) Heap-overflow. Impact ====== An attacker might be able to execute arbitrary code on the affected host with a crafted ELF file, or crafted dwarf sections in a object file. References ========== http://seclists.org/oss-sec/2016/q2/393 https://www.prevanders.net/dwarfbug.html https://access.redhat.com/security/cve/CVE-2016-5027 https://access.redhat.com/security/cve/CVE-2016-5028 https://access.redhat.com/security/cve/CVE-2016-5029 https://access.redhat.com/security/cve/CVE-2016-5030 https://access.redhat.com/security/cve/CVE-2016-5031 https://access.redhat.com/security/cve/CVE-2016-5032 https://access.redhat.com/security/cve/CVE-2016-5033 https://access.redhat.com/security/cve/CVE-2016-5034 https://access.redhat.com/security/cve/CVE-2016-5035 https://access.redhat.com/security/cve/CVE-2016-5036 https://access.redhat.com/security/cve/CVE-2016-5037 https://access.redhat.com/security/cve/CVE-2016-5038 https://access.redhat.com/security/cve/CVE-2016-5039 https://access.redhat.com/security/cve/CVE-2016-5040 https://access.redhat.com/security/cve/CVE-2016-5041 https://access.redhat.com/security/cve/CVE-2016-5042 https://access.redhat.com/security/cve/CVE-2016-5043 https://access.redhat.com/security/cve/CVE-2016-5044

1 0

[arch-security] [ASA-201606-22] xerces-c: arbitrary code execution
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-22 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-2099 Package : xerces-c Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package xerces-c before version 3.1.3-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.1.3-2. # pacman -Syu "xerces-c>=3.1.3-2" The problem has been fixed upstream in version 3.1.3. Workaround ========== None. Description =========== The DTDScanner fails to account for the fact that peeking characters in the XMLReader class can raise an exception if an invalid character is encountered, and the exception crosses stack frames in an unsafe way that causes a higher level exception handler to access an already-freed object. Impact ====== A remote attacker might be able to cause a denial of service or execute arbitrary code on the affected host by submitting a crafted DTD file. References ========== https://bugs.archlinux.org/task/49353 https://issues.apache.org/jira/browse/XERCESC-2066 http://www.openwall.com/lists/oss-security/2016/05/09/7 https://access.redhat.com/security/cve/CVE-2016-2099

1 0

[arch-security] [ASA-201606-21] vlc: arbitrary code execution
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-21 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-5108 Package : vlc Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package vlc before version 2.2.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.2.4-1. # pacman -Syu "vlc>=2.2.4-1" The problem has been fixed upstream in version 2.2.4. Workaround ========== None. Description =========== A buffer overflow has been found in the DecodeAdpcmImaQT() function of VLC's QuickTime IMA decoder. Impact ====== A remote attacker might be able to cause a denial of service or execute arbitrary code on the affected host via a crafted QuickTime IMA file. References ========== http://www.openwall.com/lists/oss-security/2016/05/27/7 https://access.redhat.com/security/cve/CVE-2016-5108

1 0

[arch-security] [ASA-201606-20] chromium: arbitrary code execution
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-20 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-1704 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 51.0.2704.103-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 51.0.2704.103-1. # pacman -Syu "chromium>=51.0.2704.103-1" The problem has been fixed upstream in version 51.0.2704.103. Workaround ========== None. Description =========== Various fixes from internal audits, fuzzing and other initiatives, including multiple issues in the processing of malformed web content. Impact ====== A remote attacker might be able to cause a denial of service, access sensitive information or execute arbitrary code on the affected host via a specially crafted web page. References ========== https://googlechromereleases.blogspot.fr/2016/06/stable-channel-update_16.h… https://access.redhat.com/security/cve/CVE-2016-1704

1 0