- Arch-security - lists.archlinux.org

[arch-security] [ASA-201603-19] dropbear: command injection
by Levente Polyak 14 Mar '16

14 Mar '16

Arch Linux Security Advisory ASA-201603-19 ========================================== Severity: Medium Date : 2016-03-14 CVE-ID : CVE-2016-3116 Package : dropbear Type : command injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package dropbear before version 2016.72-1 is vulnerable to command injection leading to information disclosure, directory traversal and possibly other impact. Resolution ========== Upgrade to 2016.72-1. # pacman -Syu "dropbear>=2016.72-1" The problem has been fixed upstream in version 2016.72. Workaround ========== Set X11Forwarding=no in sshd_config. This is the default. For authorized_keys that specify a "command" restriction, also set the "restrict" or "no-x11-forwarding" restrictions. Description =========== A vulnerability was found in a way dropbear processed X11 forwarding input. By using a specially crafted request, an attacker could bypass the authorized_keys command restrictions. xauth is run under the user's privilege, so this vulnerability offers no additional access to unrestricted accounts, but could circumvent key or account restrictions such as sshd_config ForceCommand, authorized_keys command="..." or restricted shells. Impact ====== A remote authenticated user who is able to request X11 forwarding can inject commands leading to information disclosure, directory traversal and possibly other impact. References ========== https://matt.ucc.asn.au/dropbear/CHANGES https://access.redhat.com/security/cve/CVE-2016-3116

1 0

[arch-security] [ASA-201603-18] pcre: arbitrary code execution
by Levente Polyak 13 Mar '16

13 Mar '16

Arch Linux Security Advisory ASA-201603-18 ========================================== Severity: High Date : 2016-03-13 CVE-ID : CVE-2016-1283 Package : pcre Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pcre before version 8.38-3 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.38-3. # pacman -Syu "pcre>=8.38-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex. Exploits with advanced Heap Fengshui techniques may allow an attacker to execute arbitrary code in the context of the user running the affected application. Impact ====== A remote attacker is able to execute arbitrary code by crafting a special regular expression that triggers a heap buffer overflow. References ========== https://access.redhat.com/security/cve/CVE-2016-1283 https://bugs.exim.org/show_bug.cgi?id=1767 https://bugs.archlinux.org/48484

1 0

[arch-security] [ASA-201603-17] wireshark-gtk: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-17 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-gtk Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-gtk before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-gtk>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-16] wireshark-qt: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-16 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-qt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-qt before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-qt>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-15] wireshark-cli: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-15 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-cli before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-cli>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing a vulnerable user to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-14] pidgin-otr: arbitrary code execution
by Levente Polyak 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-14 ========================================== Severity: High Date : 2016-03-12 CVE-ID : CVE-2015-8833 Package : pidgin-otr Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pidgin-otr before version 4.0.2-1 is vulnerable to use-after-free leading to denial of service or possible arbitrary code execution. Resolution ========== Upgrade to 4.0.2-1. # pacman -Syu "pidgin-otr>=4.0.2-1" The problem has been fixed upstream in version 4.0.2. Workaround ========== None. Description =========== The pidgin-otr plugin fixes a heap use after free error. The bug is triggered when a user tries to authenticate a buddy and happens in the function create_smp_dialog. This issue is leading to denial of service or possibly remote code execution. Impact ====== A remote attacker is able to trigger a user-after-free during otr authentication and possibly execute arbitrary code References ========== https://access.redhat.com/security/cve/CVE-2015-8833 http://seclists.org/oss-sec/2016/q1/572 https://bugs.otr.im/issues/88 https://bugs.archlinux.org/task/48537

1 0

[arch-security] [ASA-201603-13] bind: denial of service
by Christian Rebischke 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-13 ========================================== Severity: Low Date : 2016-03-12 CVE-ID : CVE-2016-2088 CVE-2016-1286 CVE-2016-1285 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.3.P4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.3.P4-1 . # pacman -Syu "bind>=9.10.3.P4-1" The problem has been fixed upstream in version 9.10.3-P4. Workaround ========== None. Description =========== - CVE-2016-2088 (denial of service) Allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option. - CVE-2016-1286 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c. - CVE-2016-1285 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c Impact ====== A remote attacker is able to crash the application. References ========== https://access.redhat.com/security/cve/CVE-2016-2088 https://access.redhat.com/security/cve/CVE-2016-1286 https://access.redhat.com/security/cve/CVE-2016-1285 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2088 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1286 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1285

1 0

[arch-security] [ASA-201603-12] openssh: command injection
by Levente Polyak 11 Mar '16

11 Mar '16

Arch Linux Security Advisory ASA-201603-12 ========================================== Severity: Medium Date : 2016-03-11 CVE-ID : CVE-2016-3115 Package : openssh Type : command injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssh before version 7.2p2-1 is vulnerable to command injection leading to information disclosure, directory traversal and possibly other impact. Resolution ========== Upgrade to 7.2p2-1. # pacman -Syu "openssh>=7.2p2-1" The problem has been fixed upstream in version 7.2p2. Workaround ========== Set X11Forwarding=no in sshd_config. This is the default. For authorized_keys that specify a "command" restriction, also set the "restrict" or "no-x11-forwarding" restrictions. Description =========== Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth. Injection of xauth commands grants the ability to read arbitrary files under the authenticated user's privilege. Other xauth commands allow limited information leakage, file overwrite, port probing and generally expose xauth, which was not written with a hostile user in mind, as an attack surface. xauth is run under the user's privilege, so this vulnerability offers no additional access to unrestricted accounts, but could circumvent key or account restrictions such as sshd_config ForceCommand, authorized_keys command="..." or restricted shells. Impact ====== A remote authenticated user who is able to request X11 forwarding can inject commands to xauth leading to information disclosure, directory traversal and possibly other impact. References ========== http://www.openssh.com/txt/x11fwd.adv https://access.redhat.com/security/cve/CVE-2016-3115

1 0

[arch-security] [ASA-201603-11] lib32-flashplugin: arbitrary code execution
by Christian Rebischke 11 Mar '16

11 Mar '16

Arch Linux Security Advisory ASA-201603-11 ========================================== Severity: Critical Date : 2016-03-11 CVE-ID : CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Package : lib32-flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.577-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.577-1. # pacman -Syu "lib32-flashplugin>=11.2.202.577-1" The problem has been fixed upstream in version 11.2.202.577. Workaround ========== None. Description =========== - CVE-2016-0963 CVE-2016-0993 CVE-2016-1010 (arbitrary code execution) Integer overflow vulnerabilities that could lead to code execution. - CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 (arbitrary code execution) Use-after-free vulnerabilities that could lead to code execution. - CVE-2016-1001 (arbitrary code execution) Heap overflow vulnerability that could lead to code execution. - CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0986 CVE-2016-0989 CVE-2016-0992 CVE-2016-1002 CVE-2016-1005 (arbitrary code execution) Memory corruption vulnerabilities that could lead to code execution. Impact ====== A remote attacker is able to craft a special flash file that, when visited, executes arbitrary code via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-0960 https://access.redhat.com/security/cve/CVE-2016-0961 https://access.redhat.com/security/cve/CVE-2016-0962 https://access.redhat.com/security/cve/CVE-2016-0963 https://access.redhat.com/security/cve/CVE-2016-0986 https://access.redhat.com/security/cve/CVE-2016-0987 https://access.redhat.com/security/cve/CVE-2016-0988 https://access.redhat.com/security/cve/CVE-2016-0989 https://access.redhat.com/security/cve/CVE-2016-0990 https://access.redhat.com/security/cve/CVE-2016-0991 https://access.redhat.com/security/cve/CVE-2016-0992 https://access.redhat.com/security/cve/CVE-2016-0993 https://access.redhat.com/security/cve/CVE-2016-0994 https://access.redhat.com/security/cve/CVE-2016-0995 https://access.redhat.com/security/cve/CVE-2016-0996 https://access.redhat.com/security/cve/CVE-2016-0997 https://access.redhat.com/security/cve/CVE-2016-0998 https://access.redhat.com/security/cve/CVE-2016-0999 https://access.redhat.com/security/cve/CVE-2016-1000 https://access.redhat.com/security/cve/CVE-2016-1001 https://access.redhat.com/security/cve/CVE-2016-1002 https://access.redhat.com/security/cve/CVE-2016-1005 https://access.redhat.com/security/cve/CVE-2016-1010 https://helpx.adobe.com/security/products/flash-player/apsb16-08.html

1 0

[arch-security] [ASA-201603-10] flashplugin: arbitrary code execution
by Christian Rebischke 11 Mar '16

11 Mar '16

Arch Linux Security Advisory ASA-201603-10 ========================================== Severity: Critical Date : 2016-03-11 CVE-ID : CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0963 CVE-2016-0986 CVE-2016-0987 CVE-2016-0988 CVE-2016-0989 CVE-2016-0990 CVE-2016-0991 CVE-2016-0992 CVE-2016-0993 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 CVE-2016-1001 CVE-2016-1002 CVE-2016-1005 CVE-2016-1010 Package : flashplugin Type : abitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.577-1 is vulnerable to multiple issues including remote code execution. Resolution ========== Upgrade to 11.2.202.577-1. # pacman -Syu "flashplugin>=11.2.202.577-1" The problems have been fixed upstream in version 11.2.202.577. Workaround ========== None. Description =========== - CVE-2016-0963 CVE-2016-0993 CVE-2016-1010 (arbitrary code execution) Integer overflow vulnerabilities that could lead to code execution. - CVE-2016-0987 CVE-2016-0988 CVE-2016-0990 CVE-2016-0991 CVE-2016-0994 CVE-2016-0995 CVE-2016-0996 CVE-2016-0997 CVE-2016-0998 CVE-2016-0999 CVE-2016-1000 (abitrary code execution) Use-after-free vulnerabilities that could lead to code execution. - CVE-2016-1001 (abitrary code execution) Heap overflow vulnerability that could lead to code execution. - CVE-2016-0960 CVE-2016-0961 CVE-2016-0962 CVE-2016-0986 CVE-2016-0989 CVE-2016-0992 CVE-2016-1002 CVE-2016-1005 (arbitrary code execution) Memory corruption vulnerabilities that could lead to code execution. Impact ====== A remote attacker is able to craft a special flash file that, when visited, executes arbitrary code via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2016-0960 https://access.redhat.com/security/cve/CVE-2016-0961 https://access.redhat.com/security/cve/CVE-2016-0962 https://access.redhat.com/security/cve/CVE-2016-0963 https://access.redhat.com/security/cve/CVE-2016-0986 https://access.redhat.com/security/cve/CVE-2016-0987 https://access.redhat.com/security/cve/CVE-2016-0988 https://access.redhat.com/security/cve/CVE-2016-0989 https://access.redhat.com/security/cve/CVE-2016-0990 https://access.redhat.com/security/cve/CVE-2016-0991 https://access.redhat.com/security/cve/CVE-2016-0992 https://access.redhat.com/security/cve/CVE-2016-0993 https://access.redhat.com/security/cve/CVE-2016-0994 https://access.redhat.com/security/cve/CVE-2016-0995 https://access.redhat.com/security/cve/CVE-2016-0996 https://access.redhat.com/security/cve/CVE-2016-0997 https://access.redhat.com/security/cve/CVE-2016-0998 https://access.redhat.com/security/cve/CVE-2016-0999 https://access.redhat.com/security/cve/CVE-2016-1000 https://access.redhat.com/security/cve/CVE-2016-1001 https://access.redhat.com/security/cve/CVE-2016-1002 https://access.redhat.com/security/cve/CVE-2016-1005 https://access.redhat.com/security/cve/CVE-2016-1010 https://helpx.adobe.com/security/products/flash-player/apsb16-08.html

1 0