- Arch-security - lists.archlinux.org

[arch-security] [ASA-201606-19] wget: arbitrary file overwrite
by Levente Polyak 20 Jun '16

20 Jun '16

Arch Linux Security Advisory ASA-201606-19 ========================================== Severity: High Date : 2016-06-20 CVE-ID : CVE-2016-4971 Package : wget Type : arbitrary file overwrite Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wget before version 1.18-1 is vulnerable to arbitrary file overwrite that could lead to potential code execution. Resolution ========== Upgrade to 1.18-1. # pacman -Syu "wget>=1.18-1" The problem has been fixed upstream in version 1.18. Workaround ========== None. Description =========== GNU Wget when supplied with a malicious website link can be tricked into saving an arbitrary remote file supplied by an attacker, with arbitrary content and filename under the current directory. This can lead to potential code execution by creating system scripts (such as .bash_profile and others) within home directory as well as other unauthorized actions (such as request sniffing by proxy modification, or arbitrary system file retrieval) by uploading .wgetrc configuration file. Because of this vulnerability, an attacker is able to overwrite an arbitrary file in the victim's current directory. Impact ====== A remote attacker is able to overwrite an arbitrary file in the victim's current directory that could potentially lead to code execution by creating system scripts that are executed. References ========== https://access.redhat.com/security/cve/CVE-2016-4971 https://lists.gnu.org/archive/html/bug-wget/2016-06/msg00033.html https://bugs.archlinux.org/task/49730

1 0

[arch-security] [ASA-201606-18] lib32-flashplugin: multiple issues
by Levente Polyak 20 Jun '16

20 Jun '16

Arch Linux Security Advisory ASA-201606-18 ========================================== Severity: Critical Date : 2016-06-20 CVE-ID : CVE-2016-4122 CVE-2016-4123 CVE-2016-4124 CVE-2016-4125 CVE-2016-4127 CVE-2016-4128 CVE-2016-4129 CVE-2016-4130 CVE-2016-4131 CVE-2016-4132 CVE-2016-4133 CVE-2016-4134 CVE-2016-4135 CVE-2016-4136 CVE-2016-4137 CVE-2016-4138 CVE-2016-4139 CVE-2016-4140 CVE-2016-4141 CVE-2016-4142 CVE-2016-4143 CVE-2016-4144 CVE-2016-4145 CVE-2016-4146 CVE-2016-4147 CVE-2016-4148 CVE-2016-4149 CVE-2016-4150 CVE-2016-4151 CVE-2016-4152 CVE-2016-4153 CVE-2016-4154 CVE-2016-4155 CVE-2016-4156 CVE-2016-4166 CVE-2016-4171 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.626-1 is vulnerable to multiple issues including same-origin policy bypass and arbitrary code execution. Resolution ========== Upgrade to 11.2.202.626-1. # pacman -Syu "lib32-flashplugin>=11.2.202.626-1" The problems have been fixed upstream in version 11.2.202.626. Workaround ========== None. Description =========== - CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171 (arbitrary code execution) Memory corruptions leading to arbitrary code execution. - CVE-2016-4135, CVE-2016-4136, CVE-2016-4138 (arbitrary code execution) Heap-based buffer overflows leading to arbitrary code execution. - CVE-2016-4139 (information leak) Vulnerability that could be exploited to bypass the same-origin policy and lead to information disclosure. - CVE-2016-4140 (arbitrary code execution) Vulnerability in the directory search path used to find resources that could lead to code execution. - CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148 (arbitrary code execution) Use-after-free vulnerabilities leading to arbitrary code execution. - CVE-2016-4144, CVE-2016-4149 (arbitrary code execution) Type confusion vulnerabilities leading to arbitrary code execution. Impact ====== A remote attacker can bypass the same-origin policy to access sensitive information, or execute arbitrary code by using a crafted flash application. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-18.html https://access.redhat.com/security/cve/CVE-2016-4122 https://access.redhat.com/security/cve/CVE-2016-4123 https://access.redhat.com/security/cve/CVE-2016-4124 https://access.redhat.com/security/cve/CVE-2016-4125 https://access.redhat.com/security/cve/CVE-2016-4127 https://access.redhat.com/security/cve/CVE-2016-4128 https://access.redhat.com/security/cve/CVE-2016-4129 https://access.redhat.com/security/cve/CVE-2016-4130 https://access.redhat.com/security/cve/CVE-2016-4131 https://access.redhat.com/security/cve/CVE-2016-4132 https://access.redhat.com/security/cve/CVE-2016-4133 https://access.redhat.com/security/cve/CVE-2016-4134 https://access.redhat.com/security/cve/CVE-2016-4135 https://access.redhat.com/security/cve/CVE-2016-4136 https://access.redhat.com/security/cve/CVE-2016-4137 https://access.redhat.com/security/cve/CVE-2016-4138 https://access.redhat.com/security/cve/CVE-2016-4139 https://access.redhat.com/security/cve/CVE-2016-4140 https://access.redhat.com/security/cve/CVE-2016-4141 https://access.redhat.com/security/cve/CVE-2016-4142 https://access.redhat.com/security/cve/CVE-2016-4143 https://access.redhat.com/security/cve/CVE-2016-4144 https://access.redhat.com/security/cve/CVE-2016-4145 https://access.redhat.com/security/cve/CVE-2016-4146 https://access.redhat.com/security/cve/CVE-2016-4147 https://access.redhat.com/security/cve/CVE-2016-4148 https://access.redhat.com/security/cve/CVE-2016-4149 https://access.redhat.com/security/cve/CVE-2016-4150 https://access.redhat.com/security/cve/CVE-2016-4151 https://access.redhat.com/security/cve/CVE-2016-4152 https://access.redhat.com/security/cve/CVE-2016-4153 https://access.redhat.com/security/cve/CVE-2016-4154 https://access.redhat.com/security/cve/CVE-2016-4155 https://access.redhat.com/security/cve/CVE-2016-4156 https://access.redhat.com/security/cve/CVE-2016-4166 https://access.redhat.com/security/cve/CVE-2016-4171

1 0

[arch-security] [ASA-201606-17] lib32-glibc: denial of service
by Levente Polyak 19 Jun '16

19 Jun '16

Arch Linux Security Advisory ASA-201606-17 ========================================== Severity: Medium Date : 2016-06-19 CVE-ID : CVE-2016-4429 Package : lib32-glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-glibc before version 2.23-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.23-5. # pacman -Syu "lib32-glibc>=2.23-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== clntudp_call allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack (frame) overflow (denial of service). The size of the allocated buffer depends on the request size. If the request size is close to the page size or even larger, this could cause the stack pointer to step over the guard page, leading to additional impact beyond denial of service. Impact ====== A remote attacker is able to send specially crafted ICMP and UDP packets that are leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-4429 https://sourceware.org/bugzilla/show_bug.cgi?id=20112

1 0

[arch-security] [ASA-201606-16] glibc: denial of service
by Levente Polyak 19 Jun '16

19 Jun '16

Arch Linux Security Advisory ASA-201606-16 ========================================== Severity: Medium Date : 2016-06-19 CVE-ID : CVE-2016-4429 Package : glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.23-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.23-5. # pacman -Syu "glibc>=2.23-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== clntudp_call allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack (frame) overflow (denial of service). The size of the allocated buffer depends on the request size. If the request size is close to the page size or even larger, this could cause the stack pointer to step over the guard page, leading to additional impact beyond denial of service. Impact ====== A remote attacker is able to send specially crafted ICMP and UDP packets that are leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-4429 https://sourceware.org/bugzilla/show_bug.cgi?id=20112

1 0

[arch-security] [ASA-201606-15] flashplugin: multiple issues
by Remi Gacogne 19 Jun '16

19 Jun '16

Arch Linux Security Advisory ASA-201606-15 ========================================== Severity: Critical Date : 2016-06-19 CVE-ID : CVE-2016-4122 CVE-2016-4123 CVE-2016-4124 CVE-2016-4125 CVE-2016-4127 CVE-2016-4128 CVE-2016-4129 CVE-2016-4130 CVE-2016-4131 CVE-2016-4132 CVE-2016-4133 CVE-2016-4134 CVE-2016-4135 CVE-2016-4136 CVE-2016-4137 CVE-2016-4138 CVE-2016-4139 CVE-2016-4140 CVE-2016-4141 CVE-2016-4142 CVE-2016-4143 CVE-2016-4144 CVE-2016-4145 CVE-2016-4146 CVE-2016-4147 CVE-2016-4148 CVE-2016-4149 CVE-2016-4150 CVE-2016-4151 CVE-2016-4152 CVE-2016-4153 CVE-2016-4154 CVE-2016-4155 CVE-2016-4156 CVE-2016-4166 CVE-2016-4171 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.626-1 is vulnerable to multiple issues including same-origin policy bypass and arbitrary code execution. Resolution ========== Upgrade to 11.2.202.626-1. # pacman -Syu "flashplugin>=11.2.202.626-1" The problems have been fixed upstream in version 11.2.202.626. Workaround ========== None. Description =========== - CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171 (arbitrary code execution) Memory corruptions leading to arbitrary code execution. - CVE-2016-4135, CVE-2016-4136, CVE-2016-4138 (arbitrary code execution) Heap-based buffer overflows leading to arbitrary code execution. - CVE-2016-4139 (information leak) Vulnerability that could be exploited to bypass the same-origin policy and lead to information disclosure. - CVE-2016-4140 (arbitrary code execution) Vulnerability in the directory search path used to find resources that could lead to code execution. - CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148 (arbitrary code execution) Use-after-free vulnerabilities leading to arbitrary code execution. - CVE-2016-4144, CVE-2016-4149 (arbitrary code execution) Type confusion vulnerabilities leading to arbitrary code execution. Impact ====== A remote attacker can bypass the same-origin policy to access sensitive information, or execute arbitrary code by using a crafted flash application. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-18.html https://access.redhat.com/security/cve/CVE-2016-4122 https://access.redhat.com/security/cve/CVE-2016-4123 https://access.redhat.com/security/cve/CVE-2016-4124 https://access.redhat.com/security/cve/CVE-2016-4125 https://access.redhat.com/security/cve/CVE-2016-4127 https://access.redhat.com/security/cve/CVE-2016-4128 https://access.redhat.com/security/cve/CVE-2016-4129 https://access.redhat.com/security/cve/CVE-2016-4130 https://access.redhat.com/security/cve/CVE-2016-4131 https://access.redhat.com/security/cve/CVE-2016-4132 https://access.redhat.com/security/cve/CVE-2016-4133 https://access.redhat.com/security/cve/CVE-2016-4134 https://access.redhat.com/security/cve/CVE-2016-4135 https://access.redhat.com/security/cve/CVE-2016-4136 https://access.redhat.com/security/cve/CVE-2016-4137 https://access.redhat.com/security/cve/CVE-2016-4138 https://access.redhat.com/security/cve/CVE-2016-4139 https://access.redhat.com/security/cve/CVE-2016-4140 https://access.redhat.com/security/cve/CVE-2016-4141 https://access.redhat.com/security/cve/CVE-2016-4142 https://access.redhat.com/security/cve/CVE-2016-4143 https://access.redhat.com/security/cve/CVE-2016-4144 https://access.redhat.com/security/cve/CVE-2016-4145 https://access.redhat.com/security/cve/CVE-2016-4146 https://access.redhat.com/security/cve/CVE-2016-4147 https://access.redhat.com/security/cve/CVE-2016-4148 https://access.redhat.com/security/cve/CVE-2016-4149 https://access.redhat.com/security/cve/CVE-2016-4150 https://access.redhat.com/security/cve/CVE-2016-4151 https://access.redhat.com/security/cve/CVE-2016-4152 https://access.redhat.com/security/cve/CVE-2016-4153 https://access.redhat.com/security/cve/CVE-2016-4154 https://access.redhat.com/security/cve/CVE-2016-4155 https://access.redhat.com/security/cve/CVE-2016-4156 https://access.redhat.com/security/cve/CVE-2016-4166 https://access.redhat.com/security/cve/CVE-2016-4171

1 0

[arch-security] [ASA-201606-14] lib32-expat: multiple issues
by Levente Polyak 12 Jun '16

12 Jun '16

Arch Linux Security Advisory ASA-201606-14 ========================================== Severity: Medium Date : 2016-06-13 CVE-ID : CVE-2012-6702 CVE-2016-5300 Package : lib32-expat Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-expat before version 2.1.1-3 is vulnerable to multiple issues including predictable random numbers and insufficient hash entropy leading to denial of service. Resolution ========== Upgrade to 2.1.1-3. # pacman -Syu "lib32-expat>=2.1.1-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2012-6702 (predictable random numbers) It was found that when calling XML_Parse ahead of rand(), it causes the pseudo random generator to generate non-random predictable numbers. - CVE-2016-5300 (denial of service) It was found that original fix for CVE-2012-0876 used too little entropy for the hash initialization. This issue can be used to perform a hash collision based denial of service attack. Impact ====== A remote attacker is able to predict random numbers from the PRNG or perform a hash based collision attack resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2012-6702 https://access.redhat.com/security/cve/CVE-2016-5300

1 0

[arch-security] [ASA-201606-13] expat: multiple issues
by Levente Polyak 12 Jun '16

12 Jun '16

Arch Linux Security Advisory ASA-201606-13 ========================================== Severity: Medium Date : 2016-06-13 CVE-ID : CVE-2012-6702 CVE-2016-5300 Package : expat Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package expat before version 2.1.1-3 is vulnerable to multiple issues including predictable random numbers and insufficient hash entropy leading to denial of service. Resolution ========== Upgrade to 2.1.1-3. # pacman -Syu "expat>=2.1.1-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2012-6702 (predictable random numbers) It was found that when calling XML_Parse ahead of rand(), it causes the pseudo random generator to generate non-random predictable numbers. - CVE-2016-5300 (denial of service) It was found that original fix for CVE-2012-0876 used too little entropy for the hash initialization. This issue can be used to perform a hash collision based denial of service attack. Impact ====== A remote attacker is able to predict random numbers from the PRNG or perform a hash based collision attack resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2012-6702 https://access.redhat.com/security/cve/CVE-2016-5300

1 0

[arch-security] [ASA-201606-12] lib32-gnutls: arbitrary file overwrite
by Levente Polyak 10 Jun '16

10 Jun '16

Arch Linux Security Advisory ASA-201606-12 ========================================== Severity: Medium Date : 2016-06-10 CVE-ID : CVE-2016-4456 Package : lib32-gnutls Type : arbitrary file overwrite Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-gnutls before version 3.4.13-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 3.4.13-1. # pacman -Syu "lib32-gnutls>=3.4.13-1" The problem has been fixed upstream in version 3.4.13. Workaround ========== None. Description =========== Setuid programs using GnuTLS could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem. This issue was introduced in GnuTLS 3.4.12 with the GNUTLS_KEYLOGFILE environment variable handling via getenv() and fixed in GnuTLS 3.4.13 by switching to secure_getenv() where available. Impact ====== A local attacker is able to overwrite arbitrary files with a setuid program using GnuTLS by setting the GNUTLS_KEYLOGFILE environment variable. References ========== https://access.redhat.com/security/cve/CVE-2016-4456 http://gnutls.org/security.html#GNUTLS-SA-2016-1

1 0

[arch-security] [ASA-201606-11] haproxy: denial of service
by Levente Polyak 10 Jun '16

10 Jun '16

Arch Linux Security Advisory ASA-201606-11 ========================================== Severity: Medium Date : 2016-06-10 CVE-ID : CVE-2016-5360 Package : haproxy Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package haproxy before version 1.6.5-4 is vulnerable to denial of service. Resolution ========== Upgrade to 1.6.5-4. # pacman -Syu "haproxy>=1.6.5-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A problem has been discovered with the new field "rule_deny_status" into struct http_txn, which is filled only by actions "http-request deny" and "http-request tarpit". It's then used in the deny code path to emit the proper error message, but is used uninitialized when the deny comes from a "reqdeny" rule, causing random behaviours ranging from returning a 200, an empty response, or crashing the process. Impact ====== A remote attacker is able to use a specially crafted request to crash the process resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-5360 http://www.openwall.com/lists/oss-security/2016/06/09/5 https://bugs.archlinux.org/task/49638

1 0

[arch-security] [ASA-201606-10] gnutls: arbitrary file overwrite
by Levente Polyak 10 Jun '16

10 Jun '16

Arch Linux Security Advisory ASA-201606-10 ========================================== Severity: Medium Date : 2016-06-10 CVE-ID : CVE-2016-4456 Package : gnutls Type : arbitrary file overwrite Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gnutls before version 3.4.13-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 3.4.13-1. # pacman -Syu "gnutls>=3.4.13-1" The problem has been fixed upstream in version 3.4.13. Workaround ========== None. Description =========== Setuid programs using GnuTLS could potentially allow an attacker to overwrite and corrupt arbitrary files in the filesystem. This issue was introduced in GnuTLS 3.4.12 with the GNUTLS_KEYLOGFILE environment variable handling via getenv() and fixed in GnuTLS 3.4.13 by switching to secure_getenv() where available. Impact ====== A local attacker is able to overwrite arbitrary files with a setuid program using GnuTLS by setting the GNUTLS_KEYLOGFILE environment variable. References ========== https://access.redhat.com/security/cve/CVE-2016-4456 http://gnutls.org/security.html#GNUTLS-SA-2016-1

1 0