- Arch-security - lists.archlinux.org

[arch-security] [ASA-201601-28] chromium: multiple issues
by Remi Gacogne 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-28 ========================================== Severity: Critical Date : 2016-01-25 CVE-ID : CVE-2016-1612 CVE-2016-1613 CVE-2016-1614 CVE-2016-1615 CVE-2016-1616 CVE-2016-1617 CVE-2016-1618 CVE-2016-1619 CVE-2016-1620 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 48.0.2564.82-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 48.0.2564.82-1. # pacman -Syu "chromium>=48.0.2564.82-1" The problem has been fixed upstream in version 48.0.2564.82. Workaround ========== None. Description =========== - CVE-2016-1612: The LoadIC::UpdateCaches function in ic/ic.cc in Google V8 does not ensure receiver compatibility before performing a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code. Credit to cloudfuzzer. - CVE-2016-1613: Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to improper tracking of the destruction of (1) IPWL_FocusHandler and (2) IPWL_Provider objects. - CVE-2016-1614: The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink mishandles the initialization mode, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. Credit to Christoph Diehl. - CVE-2016-1615: The Omnibox implementation allows remote attackers to spoof a document's origin via unspecified vectors. Credit to Ron Masas. - CVE-2016-1616: The CustomButton::AcceleratorPressed function in ui/views/controls/button/custom_button.cc allows remote attackers to spoof URLs via vectors involving an unfocused custom button. Credit to Luan Herrera. - CVE-2016-1617: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. Credit to Yan Zhu. - CVE-2016-1618: Blink does not ensure that a proper cryptographicallyRandomValues random number generator is used, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors. Credit to Aaron Toponce. - CVE-2016-1619: Multiple integer overflows in the sycc422_to_rgb and sycc444_to_rgb functions in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium allow remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document. Credit to Keve Nagy. - CVE-2016-1620: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker might be able to cause a denial of service, access sensitive information or execute arbitrary code on the affected host. References ========== http://googlechromereleases.blogspot.fr/2016/01/stable-channel-update_20.ht… https://access.redhat.com/security/cve/CVE-2016-1612 https://access.redhat.com/security/cve/CVE-2016-1613 https://access.redhat.com/security/cve/CVE-2016-1614 https://access.redhat.com/security/cve/CVE-2016-1615 https://access.redhat.com/security/cve/CVE-2016-1616 https://access.redhat.com/security/cve/CVE-2016-1617 https://access.redhat.com/security/cve/CVE-2016-1618 https://access.redhat.com/security/cve/CVE-2016-1619 https://access.redhat.com/security/cve/CVE-2016-1620

1 0

[arch-security] [ASA-201601-27] privoxy: denial of service
by Levente Polyak 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-27 ========================================== Severity: Medium Date : 2016-01-25 CVE-ID : CVE-2016-1982 CVE-2016-1983 Package : privoxy Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package privoxy before version 3.0.24-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.0.24-1. # pacman -Syu "privoxy>=3.0.24-1" The problems have been fixed upstream in version 3.0.24. Workaround ========== None. Description =========== - CVE-2016-1982 (denial of service) A vulnerability was discovered in a way the privoxy deals with corrupted chunk-encoded content. A maliciously crafted input can result in a remote denial of service. - CVE-2016-1983 (denial of service) A vulnerability was found in a way the privoxy processes specific client requests. A request with "Host" header empty could result in an invalid read. Impact ====== A remote attacker is able to craft special input that, when processed, is leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-1982 https://access.redhat.com/security/cve/CVE-2016-1983 http://seclists.org/oss-sec/2016/q1/179

1 0

[arch-security] [ASA-201601-26] linux-lts: privilege escalation
by Levente Polyak 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-26 ========================================== Severity: Critical Date : 2016-01-25 CVE-ID : CVE-2016-0728 Package : linux-lts Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-lts before version 4.1.16-1 is vulnerable to local privilege escalation. Resolution ========== Upgrade to 4.1.16-1. # pacman -Syu "linux-lts>=4.1.16-1" The problem has been fixed upstream in version 4.1.16. Workaround ========== None. Description =========== It was reported that possible use-after-free vulnerability in keyring facility, possibly leading to local privilege escalation, was found. Function join_session_keyring in security/keys/process_keys.c holds a reference to the requested keyring, but if that keyring is the same as the one being currently used by the process, the kernel wouldn't decrease keyring->usage before returning to userspace. The usage field can be possibly overflowed causing use-after-free on the keyring object. Impact ====== A local attacker is able to make use of this vulnerability to elevate privileges and gain root access to the underlying system. References ========== https://access.redhat.com/security/cve/CVE-2016-0728 http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-… https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://bugs.archlinux.org/task/47820

1 0

[arch-security] [ASA-201601-25] ecryptfs-utils: privilege escalation
by Levente Polyak 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-25 ========================================== Severity: Critical Date : 2016-01-25 CVE-ID : CVE-2016-1572 Package : ecryptfs-utils Type : privilege escalation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ecryptfs-utils before version 108-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 108-2. # pacman -Syu "ecryptfs-utils>=108-2" The problem has been fixed upstream and the patch has been applied. Workaround ========== None. Description =========== An unprivileged user can mount an ecryptfs over /proc/$pid because according to stat(), it is a normal directory and owned by the user. However, the user is not actually permitted to create arbitrary directory entries in /proc/$pid, and ecryptfs' behavior might be enabling privilege escalation attacks with the help of other programs that use procfs. Impact ====== A remote attacker is able to elevate the privileges and gain unauthorized root access. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1572 https://bugs.launchpad.net/ecryptfs/+bug/1530566 https://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/870

1 0

[arch-security] [ASA-201601-24] python2-rsa: signature forgery
by Levente Polyak 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-24 ========================================== Severity: Medium Date : 2016-01-25 CVE-ID : CVE-2016-1494 Package : python2-rsa Type : signature forgery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-rsa before version 3.3-1 is vulnerable to signature forgery. Resolution ========== Upgrade to 3.3-1. # pacman -Syu "python2-rsa>=3.3-1" The problem has been fixed upstream in version 3.3. Workaround ========== None. Description =========== The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack. Impact ====== A remote attacker is able to spoof certain signatures via crafted signature padding. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494 https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/ https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-…

1 0

[arch-security] [ASA-201601-23] python-rsa: signature forgery
by Levente Polyak 25 Jan '16

25 Jan '16

Arch Linux Security Advisory ASA-201601-23 ========================================== Severity: Medium Date : 2016-01-25 CVE-ID : CVE-2016-1494 Package : python-rsa Type : signature forgery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-rsa before version 3.3-1 is vulnerable to signature forgery. Resolution ========== Upgrade to 3.3-1. # pacman -Syu "python-rsa>=3.3-1" The problem has been fixed upstream in version 3.3. Workaround ========== None. Description =========== The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack. Impact ====== A remote attacker is able to spoof certain signatures via crafted signature padding. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1494 https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/ https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-…

1 0

[arch-security] [ASA-201601-22] libdwarf: denial of service
by Levente Polyak 21 Jan '16

21 Jan '16

Arch Linux Security Advisory ASA-201601-22 ========================================== Severity: Low Date : 2016-01-21 CVE-ID : CVE-2015-8750 Package : libdwarf Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libdwarf before version 20160115-1 is vulnerable to denial of service. Resolution ========== Upgrade to 20160115-1. # pacman -Syu "libdwarf>=20160115-1" The problem has been fixed upstream in version 20160115. Workaround ========== None. Description =========== A problem has been discovered when the debug_abbrev section is marked as NOBITS in the ELF file - in other words as a zero-init section rather than a section with contents in the file. Such a crafted section is leading to a null pointer dereference resulting in denial of service. Impact ====== A local attacker is able to create a specially crafted file with zero-init section that, when processed, is leading to a denial of service. References ========== https://access.redhat.com/security/cve/CVE-2015-8750 https://bugzilla.redhat.com/show_bug.cgi?id=1294264 https://github.com/tomhughes/libdwarf/commit/11750a2838e

1 0

[arch-security] [ASA-201601-21] bind: denial of service
by Levente Polyak 21 Jan '16

21 Jan '16

Arch Linux Security Advisory ASA-201601-21 ========================================== Severity: High Date : 2016-01-21 CVE-ID : CVE-2015-8704 CVE-2015-8705 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.3.P3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.3.P3-1. # pacman -Syu "bind>=9.10.3.P3-1" The problems have been fixed upstream in version 9.10.3.P3. Workaround ========== None. Description =========== - CVE-2015-8704 (denial of service) A buffer size check used to guard against overflow could cause named to exit with an INSIST failure In apl_42.c. A server could exit while performing certain string formatting operations. Examples include (but may not be limited to): 1) Slaves using text-format db files could be vulnerable if receiving a malformed record in a zone transfer from their master. 2) Masters using text-format db files could be vulnerable if they accept a malformed record in a DDNS update message. 3) Recursive resolvers are potentially vulnerable when debug logging, if they are fed a deliberately malformed record by a malicious server. 4) A server which has cached a specially constructed record could encounter this condition while performing 'rndc dumpdb'. - CVE-2015-8705 (denial of service) In versions of BIND 9.10, errors can occur when OPT pseudo-RR data or ECS options are formatted to text. In 9.10.3 through 9.10.3-P2, the issue may result in a REQUIRE assertion failure in buffer.c resulting in application exit. This issue can affect both authoritative and recursive servers if they are performing debug logging. It may also crash related tools which use the same code, such as dig or delv. Impact ====== A remote attacker is able to use specially crafted records that, when processed, are leading to application crash resulting in denial of service. This issue affects slaves, masters, recursive resolvers as well as related tools which use the same code. References ========== https://access.redhat.com/security/cve/CVE-2015-8704 https://access.redhat.com/security/cve/CVE-2015-8705 https://kb.isc.org/article/AA-01335 https://kb.isc.org/article/AA-0133

1 0

[arch-security] [ASA-201601-20] linux: privilege escalation
by Levente Polyak 20 Jan '16

20 Jan '16

Arch Linux Security Advisory ASA-201601-20 ========================================== Severity: Critical Date : 2016-01-20 CVE-ID : CVE-2016-0728 Package : linux Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux before version 4.3.3-3 is vulnerable to local privilege escalation. Resolution ========== Upgrade to 4.3.3-3. # pacman -Syu "linux>=4.3.3-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was reported that possible use-after-free vulnerability in keyring facility, possibly leading to local privilege escalation, was found. Function join_session_keyring in security/keys/process_keys.c holds a reference to the requested keyring, but if that keyring is the same as the one being currently used by the process, the kernel wouldn't decrease keyring->usage before returning to userspace. The usage field can be possibly overflowed causing use-after-free on the keyring object. Impact ====== A local attacker is able to make use of this vulnerability to elevate privileges and gain root access to the underlying system. References ========== https://access.redhat.com/security/cve/CVE-2016-0728 http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-… https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… https://bugs.archlinux.org/task/47820

1 0

[arch-security] [ASA-201601-19] ntp: time alteration
by Remi Gacogne 17 Jan '16

17 Jan '16

Arch Linux Security Advisory ASA-201601-19 ========================================== Severity: Medium Date : 2016-01-17 CVE-ID : CVE-2015-5300 Package : ntp Type : time alteration Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ntp before version 4.2.8.p5-1 is vulnerable to time alteration. Resolution ========== Upgrade to 4.2.8.p5-1. # pacman -Syu "ntp>=4.2.8.p5-1" The problem has been fixed upstream in version 4.2.8.p5. Workaround ========== Removing -g from the ntpd startup options limits the time modification to 900s per attack. This can be done by editing the ExecStart line of the /usr/lib/systemd/system/ntpd.service file to remove the -g option, then issuing: # systemctl daemon-reload # systemctl restart ntpd Description =========== If ntpd is always started with the -g option, which is common and against long-standing recommendation, and if at the moment ntpd is restarted an attacker can immediately respond to enough requests from enough sources trusted by the target, which is difficult and not common, there is a window of opportunity where the attacker can cause ntpd to set the time to an arbitrary value. Similarly, if an attacker is able to respond to enough requests from enough sources trusted by the target, the attacker can cause ntpd to abort and restart, at which point it can tell the target to set the time to an arbitrary value if and only if ntpd was re-started against long-standing recommendation with the -g flag, or if ntpd was not given the -g flag, the attacker can move the target system's time by at most 900 seconds' time per attack. Impact ====== As the ntpd default startup options on Arch contain -g, a remote attacker might be able to alter the system time to an arbitrary value, bypassing checks based on the time, like for example X.509 certificates expiration dates. References ========== https://access.redhat.com/security/cve/CVE-2015-5300 http://support.ntp.org/bin/view/Main/NtpBug2956 https://www.cs.bu.edu/~goldbe/NTPattack.html

1 0