- Arch-security - lists.archlinux.org

[arch-security] [ASA-201604-12] thunderbird: multiple issues
by Levente Polyak 23 Apr '16

23 Apr '16

Arch Linux Security Advisory ASA-201604-12 ========================================== Severity: Medium Date : 2016-04-23 CVE-ID : CVE-2016-1955 CVE-2016-1956 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.0-1 is vulnerable to multiple issues including denial of service and same-origin policy bypass. Resolution ========== Upgrade to 45.0-1. # pacman -Syu "thunderbird>=45.0-1" The problems have been fixed upstream in version 45.0. Workaround ========== None. Description =========== - CVE-2016-1955 (same-origin policy bypass) A vulnerability allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element. - CVE-2016-1956 (denial of service) Security researcher Ucha Gobejishvili reported a denial of service (DOS) attack when doing certain WebGL operations in a canvas requiring an unusually large amount buffer to be allocated from video memory. This resulted memory resource exhaustion with some Intel video cards, requiring the computer to be rebooted to return functionality. This was resolved by putting in additional checks on the amount of memory to be allocated during graphics processing. Impact ====== A remote attacker is able to bypass the same-origin policy restriction or perform a denial of service attack via memory consumption. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-19/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-18/ https://access.redhat.com/security/cve/CVE-2016-1955 https://access.redhat.com/security/cve/CVE-2016-1956

1 0

[arch-security] [ASA-201604-11] pgpdump: denial of service
by Levente Polyak 22 Apr '16

22 Apr '16

Arch Linux Security Advisory ASA-201604-11 ========================================== Severity: Low Date : 2016-04-22 CVE-ID : CVE-2016-4021 Package : pgpdump Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pgpdump before version 0.30-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.30-1. # pacman -Syu "pgpdump>=0.30-1" The problem has been fixed upstream in version 0.30. Workaround ========== None. Description =========== When pgpdump is run on specially crafted input, a denial of service condition occurs. The program runs with 100% CPU usage for an indefinite amount of time. This can be abused in scenarios where users can supply input to pgpdump, e.g. in http://www.pgpdump.net/. Impact ====== A remote attacker is able to create a specially crafted input that is leading to CPU resource consumption resulting in denial of service. References ========== https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4021

1 0

[arch-security] [ASA-201604-10] chromium: multiple issues
by Remi Gacogne 17 Apr '16

17 Apr '16

Arch Linux Security Advisory ASA-201604-10 ========================================== Severity: High Date : 2016-04-17 CVE-ID : CVE-2016-1651 CVE-2016-1652 CVE-2016-1653 CVE-2016-1654 CVE-2016-1655 CVE-2016-1657 CVE-2016-1658 CVE-2016-1659 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 50.0.2661.75-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 50.0.2661.75-1. # pacman -Syu "chromium>=50.0.2661.75-1" The problem has been fixed upstream in version 50.0.2661.75. Workaround ========== None. Description =========== - CVE-2016-1651: Out-of-bounds read in Pdfium JPEG2000 decoding. Credit to kdot working with HP's Zero Day Initiative. - CVE-2016-1652: Universal XSS in extension bindings. Credit to anonymous. - CVE-2016-1653: Out-of-bounds write in V8. Credit to Choongwoo Han. - CVE-2016-1654: Uninitialized memory read in media. Credit to Atte Kettunen of OUSPG. - CVE-2016-1655: Use-after-free related to extensions. Credit to Rob Wu. - CVE-2016-1657: Address bar spoofing. Credit to Luan Herrera. - CVE-2016-1658: Potential leak of sensitive information to malicious extensions. Credit to Antonio Sanso (@asanso) of Adobe. - CVE-2016-1659: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can access sensitive information, bypass security measures, cause a denial of service or have another unspecified impact on the affected host. References ========== http://googlechromereleases.blogspot.fr/2016/04/stable-channel-update_13.ht… https://access.redhat.com/security/cve/CVE-2016-1651 https://access.redhat.com/security/cve/CVE-2016-1652 https://access.redhat.com/security/cve/CVE-2016-1653 https://access.redhat.com/security/cve/CVE-2016-1654 https://access.redhat.com/security/cve/CVE-2016-1655 https://access.redhat.com/security/cve/CVE-2016-1657 https://access.redhat.com/security/cve/CVE-2016-1658 https://access.redhat.com/security/cve/CVE-2016-1659

1 0

[arch-security] [ASA-201604-9] libtasn1: denial of service
by Remi Gacogne 17 Apr '16

17 Apr '16

Arch Linux Security Advisory ASA-201604-9 ========================================= Severity: Medium Date : 2016-04-17 CVE-ID : CVE-2016-4008 Package : libtasn1 Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libtasn1 before version 4.8-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.8-1. # pacman -Syu "libtasn1>=4.8-1" The problem has been fixed upstream in version 4.8. Workaround ========== None. Description =========== The libtasn1 library, in its 4.7 version, can loop for a long time or indefinitely when it is used to parse DER representations of X.509 certificates, leading to a denial of service. Some of these loops may in addition increase heap or stack usage, leading to more issues. Impact ====== A remote attacker can cause an application using a vulnerable version of libtasn1 to loop indefinitely by sending a crafted X.509 certificate, causing a denial of service. References ========== http://article.gmane.org/gmane.comp.security.oss.general/19286 https://access.redhat.com/security/cve/CVE-2016-4008 https://bugzilla.redhat.com/show_bug.cgi?id=1325965

1 0

[arch-security] [ASA-201604-8] lhasa: arbitrary code execution
by Levente Polyak 14 Apr '16

14 Apr '16

Arch Linux Security Advisory ASA-201604-8 ========================================= Severity: High Date : 2016-04-14 CVE-ID : CVE-2016-2347 Package : lhasa Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lhasa before version 0.3.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.3.1-1. # pacman -Syu "lhasa>=0.3.1-1" The problems has been fixed upstream in version 0.3.1 Workaround ========== None. Description =========== An exploitable integer underflow exists during calculation size for all headers in decode_level3_header function of Lhasa (lha) application. Smaller value of header_len than LEVEL_3_HEADER_LEN ( 32 ) cause during subtraction integer underflow and lead later to memory corruption via heap based buffer overflow. Impact ====== A remote attacker is able to create a specially crafted LHA archive that results in a heap based buffer overflow leading to arbitrary code execution. References ========== http://www.talosintel.com/reports/TALOS-2016-0095/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2347

1 0

[arch-security] [ASA-201604-7] flashplugin: multiple issues
by Levente Polyak 10 Apr '16

10 Apr '16

Arch Linux Security Advisory ASA-201604-7 ========================================= Severity: Critical Date : 2016-04-10 CVE-ID : CVE-2016-1006 CVE-2016-1011 CVE-2016-1012 CVE-2016-1013 CVE-2016-1014 CVE-2016-1015 CVE-2016-1016 CVE-2016-1017 CVE-2016-1018 CVE-2016-1019 CVE-2016-1020 CVE-2016-1021 CVE-2016-1022 CVE-2016-1023 CVE-2016-1024 CVE-2016-1025 CVE-2016-1026 CVE-2016-1027 CVE-2016-1028 CVE-2016-1029 CVE-2016-1030 CVE-2016-1031 CVE-2016-1032 CVE-2016-1033 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.616-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, JIT spraying mitigation bypass and sandbox restriction bypass. Resolution ========== Upgrade to 11.2.202.616-1. # pacman -Syu "flashplugin>=11.2.202.616-1" The problems have been fixed upstream in version 11.2.202.616. Workaround ========== None. Description =========== - CVE-2016-1006 (JIT spraying mitigation bypass) These updates harden a mitigation against JIT spraying attacks that could be used to bypass memory layout randomization mitigations. - CVE-2016-1015 CVE-2016-1019 (arbitrary code execution) These updates resolve type confusion vulnerabilities that could lead to code execution. - CVE-2016-1011 CVE-2016-1013 CVE-2016-1016 CVE-2016-1017 CVE-2016-1031 (arbitrary code execution) These updates resolve use-after-free vulnerabilities that could lead to code execution. - CVE-2016-1012 CVE-2016-1020 CVE-2016-1021 CVE-2016-1022 CVE-2016-1023 CVE-2016-1024 CVE-2016-1025 CVE-2016-1026 CVE-2016-1027 CVE-2016-1028 CVE-2016-1029 CVE-2016-1032 CVE-2016-1033 (arbitrary code execution) These updates resolve memory corruption vulnerabilities that could lead to code execution. - CVE-2016-1018 (arbitrary code execution) These updates resolve a stack overflow vulnerability that could lead to code execution. - CVE-2016-1030 (sandbox restriction bypass) These updates resolve a security bypass vulnerability. - CVE-2016-1014 (arbitrary code execution) These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution. Impact ====== A remote attacker is able to execute arbitrary code, bypass JIT spraying mitigations and bypass sandbox restrictions via multiple vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsa16-01.html https://helpx.adobe.com/security/products/flash-player/apsb16-10.html https://access.redhat.com/security/cve/CVE-2016-1006 https://access.redhat.com/security/cve/CVE-2016-1011 https://access.redhat.com/security/cve/CVE-2016-1012 https://access.redhat.com/security/cve/CVE-2016-1013 https://access.redhat.com/security/cve/CVE-2016-1014 https://access.redhat.com/security/cve/CVE-2016-1015 https://access.redhat.com/security/cve/CVE-2016-1016 https://access.redhat.com/security/cve/CVE-2016-1017 https://access.redhat.com/security/cve/CVE-2016-1018 https://access.redhat.com/security/cve/CVE-2016-1019 https://access.redhat.com/security/cve/CVE-2016-1020 https://access.redhat.com/security/cve/CVE-2016-1021 https://access.redhat.com/security/cve/CVE-2016-1022 https://access.redhat.com/security/cve/CVE-2016-1023 https://access.redhat.com/security/cve/CVE-2016-1024 https://access.redhat.com/security/cve/CVE-2016-1025 https://access.redhat.com/security/cve/CVE-2016-1026 https://access.redhat.com/security/cve/CVE-2016-1027 https://access.redhat.com/security/cve/CVE-2016-1028 https://access.redhat.com/security/cve/CVE-2016-1029 https://access.redhat.com/security/cve/CVE-2016-1030 https://access.redhat.com/security/cve/CVE-2016-1031 https://access.redhat.com/security/cve/CVE-2016-1032 https://access.redhat.com/security/cve/CVE-2016-1033

1 0

[arch-security] [ASA-201604-6] mercurial: arbitrary code execution
by Levente Polyak 06 Apr '16

06 Apr '16

Arch Linux Security Advisory ASA-201604-6 ========================================= Severity: Critical Date : 2016-04-06 CVE-ID : CVE-2016-3068 CVE-2016-3069 CVE-2016-3630 Package : mercurial Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mercurial before version 3.7.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.7.3-1. # pacman -Syu "mercurial>=3.7.3-1" The problems have been fixed upstream in version 3.7.3. Workaround ========== None. Description =========== - CVE-2016-3068 (arbitrary code execution) It was reported that in mercurial, there is similar vulnerability as CVE-2015-7545 in git. Git's git-remote-ext remote helper provides an ext:: URL scheme that allows running arbitrary shell commands. Mercurial allows specifying git repositories as subrepositories. Git ext:: URLs can be specified as Mercurial subrepositories allowing arbitrary shell commands to be run on `hg clone`. - CVE-2016-3069 (arbitrary code execution) It was reported that Convert extension in mercurial is vulnerable to command execution. Incorrect handling of command line parameters allows passing a full Git remote URL via a directory name. The Git ext:: URL scheme can be used to obtain arbitrary command execution. Furthermore, lack of escaping of shell metacharacters allows arbitrary command injection, which is another way of exploiting the vulnerable code. - CVE-2016-3630 (arbitrary code execution) Two bounds-checking errors have been discovered in the binary delta decoder that may be exploitable via clone, push, or pull leading to arbitrary code execution. Impact ====== A remote attacker is able to execute arbitrary code via the mercurial convert extension, git subrepositories or a vulnerability in the binary delta decoder. References ========== https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29 https://access.redhat.com/security/cve/CVE-2016-3068 https://access.redhat.com/security/cve/CVE-2016-3069 https://access.redhat.com/security/cve/CVE-2016-3630 https://bugs.archlinux.org/task/48821

1 0

[arch-security] [ASA-201604-5] optipng: arbitrary code execution
by Levente Polyak 04 Apr '16

04 Apr '16

Arch Linux Security Advisory ASA-201604-5 ========================================= Severity: High Date : 2016-04-04 CVE-ID : CVE-2016-2191 Package : optipng Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package optipng before version 0.7.6-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.7.6-1. # pacman -Syu "optipng>=0.7.6-1" The problem has been fixed upstream in version 0.7.6. Workaround ========== None. Description =========== An invalid write may occur in optipng before version 0.7.6 while processing bitmap images due to `crt_row' being (inc|dec)remented without any boundary checking when encountering delta escapes. This issue can possibly be used to execute arbitrary code. Impact ====== A remote attacker is able to use a specially crafted bitmap image file to execute arbitrary code. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2191 https://sourceforge.net/p/optipng/bugs/59/ http://www.openwall.com/lists/oss-security/2016/04/04/2

1 0

[arch-security] [ASA-201604-4] Squid: denial of service
by Jelle van der Waa 02 Apr '16

02 Apr '16

Arch Linux Security Advisory ASA-201604-4 ========================================= Severity: Low, Medium, High, Critical Date : 2016-04-02 CVE-ID : CVE-2016-3947 Package : squid Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package squid before version 3.5.16-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.5.16-1. # pacman -Syu "squid>=3.5.16-1" The problem has been fixed upstream in version 3.5.16. Workaround ========== None. Description =========== Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses. Impact ====== This problem allows a malicious client script and remote server delivering certain unusual HTTP response syntax to trigger a denial of service for all clients accessing the Squid service. References ========== http://article.gmane.org/gmane.comp.security.oss.general/19234 http://www.squid-cache.org/Advisories/SQUID-2016_4.txt

1 0

[arch-security] [ASA-201604-3] jre7-openjdk-headless: sandbox escape
by Levente Polyak 01 Apr '16

01 Apr '16

Arch Linux Security Advisory ASA-201604-3 ========================================= Severity: Critical Date : 2016-04-01 CVE-ID : CVE-2016-0636 Package : jre7-openjdk-headless Type : sandbox escape Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk-headless before version 7.u99_2.6.5-1 is vulnerable to sandbox escape leading to execution of unintended operations. Resolution ========== Upgrade to 7.u99_2.6.5-1. # pacman -Syu "jre7-openjdk-headless>=7.u99_2.6.5-1" The problem has been fixed upstream in version 7.u99_2.6.5. Workaround ========== None. Description =========== It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two different Class Loader namespaces. A part of the original patch was to use the "loadersAreRelated()" method to ensure that the two Class Loaders are related, which is a condition for correct type safety. However, this condition could be easily fulfilled by abusing certain behaviors in the class loading process, which could allow an attacker to bypass the type safety checks and ultimately escape the security sandbox mechanism. Impact ====== A remote attacker who is able to run an untrusted Java application or applet is able to bypass Java sandbox restrictions and execute unintended operations. References ========== http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-29494… https://access.redhat.com/security/cve/CVE-2016-0636

1 0