- Arch-security - lists.archlinux.org

[arch-security] [ASA-201511-5] flashplugin: multiple issues
by Levente Polyak 11 Nov '15

11 Nov '15

Arch Linux Security Advisory ASA-201511-5 ========================================= Severity: Critical Date : 2015-11-11 CVE-ID : CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.548-1 is vulnerable to multiple issues including but not limited to arbitrary code execution and access restriction bypass. Resolution ========== Upgrade to 11.2.202.548-1. # pacman -Syu "flashplugin>=11.2.202.548-1" The problems have been fixed upstream in version 11.2.202.548. Workaround ========== None. Description =========== - CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7660 CVE-2015-7661 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 (arbitrary code execution) It has been discovered that multiple use-after-free vulnerabilities could lead to arbitrary code execution. - CVE-2015-7659 (arbitrary code execution) A type confusion vulnerability has been discovered that could lead to arbitrary code execution. - CVE-2015-7662 (access restriction bypass) A security bypass vulnerability has been discovered that could be exploited to write arbitrary data to the file system under user permissions. Impact ====== A remote attacker is able to craft a special flash file that, when visited, executes arbitrary code via multiple vectors or writes arbitrary data to the file system. References ========== https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://helpx.adobe.com/security/products/flash-player/apsb15-28.html

1 0

[arch-security] [ASA-201511-4] nspr: arbitrary code execution
by Remi Gacogne 06 Nov '15

06 Nov '15

Arch Linux Security Advisory ASA-201511-4 ========================================= Severity: Critical Date : 2015-11-06 CVE-ID : CVE-2015-7183 Package : nspr Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nspr before version 4.10.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.10.10-1. # pacman -Syu "nspr>=4.10.10-1" The problem has been fixed upstream in version 4.10.10. Workaround ========== None. Description =========== A logic bug in the handling of large allocations would allow exceptionally large allocations to be reported as successful, without actually allocating the requested memory. This may allow attackers to bypass security checks and obtain control of arbitrary memory. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.org/msg12386.html https://access.redhat.com/security/cve/CVE-2015-7183

1 0

[arch-security] [ASA-201511-3] nss: arbitrary code execution
by Remi Gacogne 06 Nov '15

06 Nov '15

Arch Linux Security Advisory ASA-201511-3 ========================================= Severity: Critical Date : 2015-11-06 CVE-ID : CVE-2015-7181 CVE-2015-7182 Package : nss Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nss before version 3.20.1-1 is vulnerable to a heap-overflow vulnerability leading to arbitrary code execution. Resolution ========== Upgrade to 3.20.1-1. # pacman -Syu "nss>=3.20.1-1" The problem has been fixed upstream in version 3.20.1. Workaround ========== None. Description =========== Several issues existed within the ASN.1 decoder used by NSS for handling streaming BER data. While the majority of NSS uses a separate, unaffected DER decoder, several public routines also accept BER data, and thus are affected. An attacker that successfully exploited these issues can overflow the heap and may be able to obtain remote code execution. Impact ====== A remote attacker, by submitting crafted ASN.1 data in BER format, can execute arbitrary code on the affected host. References ========== http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.org/msg12386.html https://access.redhat.com/security/cve/CVE-2015-7181 https://access.redhat.com/security/cve/CVE-2015-7182

1 0

[arch-security] [ASA-201511-2] firefox: multiple issues
by Remi Gacogne 04 Nov '15

04 Nov '15

Arch Linux Security Advisory ASA-201511-2 ========================================= Severity: Critical Date : 2015-11-04 CVE-ID : CVE-2015-4513 CVE-2015-4514 CVE-2015-4515 CVE-2015-4518 CVE-2015-7181 CVE-2015-7182 CVE-2015-7183 CVE-2015-7187 CVE-2015-7188 CVE-2015-7189 CVE-2015-7193 CVE-2015-7194 CVE-2015-7195 CVE-2015-7196 CVE-2015-7197 CVE-2015-7198 CVE-2015-7199 CVE-2015-7200 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 42.0-1 is vulnerable to multiple issues, including but no limited to information leak, policy bypass and remote code execution. Resolution ========== Upgrade to 42.0-1. # pacman -Syu "firefox>=42.0-1" The problem has been fixed upstream in version 42.0. Workaround ========== None. Description =========== - CVE-2015-4513 (Miscellaneous memory safety hazards): Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky, Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, and Gary Kwong reported memory safety problems and crashes that affect Firefox ESR 38.3 and Firefox 41. - CVE-2015-4514 (Miscellaneous memory safety hazards): Christian Holler, Andrew McCreight, Georg Fritzsche, Tyson Smith, and Carsten Book reported crash and memory safety problems that affect Firefox 41. - CVE-2015-4515 (Information disclosure through NTLM authentication): Security researcher Tim Brown reported that Firefox discloses the hostname and possibly the Windows domain through NTLM-based HTTP authentication when sending type 3 messages as part of the authentication exchange. This is because the Workstation field is populated with the hostname of the system making the request. An attacker can craft a malicious page to send a silent NTLM request that will disclose the information without visibility in the client, leading to information disclosure. This is mitigated because NTLM v1 is disabled by default configurations. - CVE-2015-4518 (CSP bypass due to permissive Reader mode whitelist): Security researcher Mario Heiderich reported an issue where the security protections of Reader mode in Firefox can be bypassed, allowing scripts to be run. Mozilla developer Frederik Braun independently discovered and reported this same issue as well. This issue happens even though Reader View explicitly disables script for rendered pages through a whitelist of allowed HTML content. Mario discovered that the whitelist was too permissive and a malicious site could manipulate content to bypass CSP protections, allowing for possible cross-site scripting (XSS) attacks. - CVE-2015-7181, CVE-2015-7182 (NSS memory corruption issues): Mozilla engineers Tyson Smith and David Keeler reported a use-after-poison and buffer overflow in the ASN.1 decoder in Network Security Services (NSS). These issues were in octet string parsing and were found through fuzzing and code inspection. If these issues were triggered, they would lead to a potentially exploitable crash. These issues were fixed in NSS version 3.19.2.1 and 3.19.4, shipped in Firefox and Firefox ESR, respectively, as well as NSS 3.20.1. - CVE-2015-7183 (NSPR overflow in PL_ARENA_ALLOCATE can lead to crash, potential memory corruption): Google security engineer Ryan Sleevi reported an integer overflow in the Netscape Portable Runtime (NSPR) due to a lack of checks during memory allocation. This leads to a potentially exploitable crash. This issue is fixed in NSPR 4.10.10. - CVE-2015-7187 (Disabling scripts in Add-on SDK panels has no effect): Add-on authors Jason Hamilton and Peter Arremann with AMO editor Sylvain Giroux reported a vulnerability when a panel is created using the Add-on SDK in a browser extension. Defining a panel with script: false is supposed to disable script execution but it was found that inline script would still execute. This flaw allows for the potential execution of script content in an extension when it was been explicitly disallowed. The potential impact of this flaw would depend on whether the add-on was relying on script: false as a security mechanism and from location the panel content was loaded. No add-ons served from addons.mozilla.org are vulnerable to this flaw but add-ons installed from third party sites may be. - CVE-2015-7188 (Trailing whitespace in IP address hostnames can bypass same-origin policy): Security researcher Michał Bentkowski reported that adding white-space characters to hostnames that are IP addresses can bypass same-origin policy. This flaw was caused by trailing whitespaces being evaluated differently when parsing IP addresses instead of alphanumeric hostnames. This could lead to a cross-site script (XSS) attack. - CVE-2015-7189 (Buffer overflow during image interactions in canvas): Security researcher Looben Yang reported a buffer overflow in the JPEGEncoder function during script interactions with a canvas element. This is caused by a race condition and incorrectly matched sizes following image interactions. This leads to a potentially exploitable crash. - CVE-2015-7193 (CORS preflight is bypassed when non-standard Content-Type headers are received): Security researcher Shinto K Anto reported an issue with cross-origin resource sharing (CORS) "preflight" requests when receiving certain Content-Type headers. This is due to an error in implementation resulting in trying to process multiple media types when they are returned in the Content-Type headers from a server. This is disallowed in the CORS specification and results in a simple instead of a "preflight" request, leading to potential same-origin policy violation. - CVE-2015-7194 (Memory corruption in libjar through zip files): Security researcher Gustavo Grieco reported a buffer underflow in libjar triggered through a maliciously crafted ZIP format file. This results in a potentially exploitable crash. - CVE-2015-7195 (Certain escaped characters in host of Location-header are being treated as non-escaped): Security researcher Frans Rosén reported that URLs with certain escaped characters in hostnames are parsed incorrectly. This leads to parsing being abandoned when an effected escaped character is encountered followed by a navigation to the previously parsed version of the URL. When combined with a site allowing for navigation redirection that allows for escaped characters, this could lead to potential extraction of site specific tokens. - CVE-2015-7196 (JavaScript garbage collection crash with Java applet): Mozilla community member Vytautas Staraitis reported an issue with the interaction of Java applets and JavaScript. The Java plugin can deallocate a JavaScript wrapper when it is still in use, which leads to a JavaScript garbage collection crash. This crash is potentially exploitable. This issue only affects systems where Java is installed and enabled as a browser plugin. Other systems are unaffected. - CVE-2015-7197 (Mixed content WebSocket policy bypass through workers): Mozilla developer Ehsan Akhgari reported a mechanism through which a web worker could be used to bypass secure requirements for WebSockets when workers are used to create WebSockets. This allows for the bypassing of mixed content WebSocket policy. - CVE-2015-7198, CVE-2015-7199 CVE-2015-7200 (Vulnerabilities found through code inspection): Security researcher Ronald Crane reported three vulnerabilities affecting released code that were found through code inspection. These included a buffer overflow in the ANGLE graphics library and two issues of missing status checks in SVG rendering and during cryptographic key manipulation. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them. Impact ====== A remote attacker can cause a denial of service, access sensitive information or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2015-116/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-117/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-118/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-121/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-122/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-123/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-127/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-128/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-129/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-130/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-131/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-132/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-133/ https://access.redhat.com/security/cve/CVE-2015-4513 https://access.redhat.com/security/cve/CVE-2015-4514 https://access.redhat.com/security/cve/CVE-2015-4515 https://access.redhat.com/security/cve/CVE-2015-4518 https://access.redhat.com/security/cve/CVE-2015-7181 https://access.redhat.com/security/cve/CVE-2015-7182 https://access.redhat.com/security/cve/CVE-2015-7183 https://access.redhat.com/security/cve/CVE-2015-7187 https://access.redhat.com/security/cve/CVE-2015-7188 https://access.redhat.com/security/cve/CVE-2015-7189 https://access.redhat.com/security/cve/CVE-2015-7193 https://access.redhat.com/security/cve/CVE-2015-7194 https://access.redhat.com/security/cve/CVE-2015-7195 https://access.redhat.com/security/cve/CVE-2015-7196 https://access.redhat.com/security/cve/CVE-2015-7197 https://access.redhat.com/security/cve/CVE-2015-7198 https://access.redhat.com/security/cve/CVE-2015-7199 https://access.redhat.com/security/cve/CVE-2015-7200

1 0

[arch-security] [ASA-201511-1] unzip: multiple issues
by Levente Polyak 03 Nov '15

03 Nov '15

Arch Linux Security Advisory ASA-201511-1 ========================================= Severity: High Date : 2015-11-03 CVE-ID : CVE-2015-7696 CVE-2015-7697 Package : unzip Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package unzip before version 6.0-11 is vulnerable to arbitrary code execution and denial of service. Resolution ========== Upgrade to 6.0-11. # pacman -Syu "unzip>=6.0-11" The problems have been fixed by applying proper patches. Workaround ========== None. Description =========== - CVE-2015-7696 (arbitrary code execution) A heap buffer overflow triggered by unzipping a file with password that can lead to arbitrary code execution. - CVE-2015-7697 (denial of service) A denial of service with a file that never finishes unzipping. Impact ====== A remote attacker is able to create a specially crafted zip archive with a password that is leading to arbitrary code execution or denial of service via an infinite loop while unzipping. References ========== https://access.redhat.com/security/cve/CVE-2015-7696 https://access.redhat.com/security/cve/CVE-2015-7697 http://seclists.org/oss-sec/2015/q3/512 https://bugs.archlinux.org/task/46955

1 0

[arch-security] [ASA-201510-26] mariadb: denial of service
by Christian Rebischke 30 Oct '15

30 Oct '15

Arch Linux Security Advisory ASA-201510-26 ========================================= Severity: Low Date : 2015-10-30 CVE-ID : CVE-2015-4913 CVE-2015-4870 CVE-2015-4861 CVE-2015-4858 CVE-2015-4836 CVE-2015-4830 CVE-2015-4826 CVE-2015-4815 CVE-2015-4802 CVE-2015-4792 Package : mysql Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mysql before version 10.0.22-1 is vulnerable against different denial of service vulnerabilities. Resolution ========== Upgrade to version 10.0.22-1. # pacman -Syu "mariadb>=10.0.22-1" The problems have been fixed upstream in version 10.0.22. Workaround ========== None. Description =========== - CVE-2015-4913 (denial of service) allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858. - CVE-2015-4870 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : Parser. - CVE-2015-4861 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. - CVE-2015-4858 (denial of service) allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913. - CVE-2015-4836 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : SP. - CVE-2015-4830 (denial of service) allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. - CVE-2015-4826 (denial of service) allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types. - CVE-2015-4815 (denial of service) allows remote authenticated users to affect availability via vectors related to Server : DDL. - CVE-2015-4802 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792. - CVE-2015-4792 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802. Impact ====== An authenticated remote attacker is able to affect the availability via different attack vectors. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4913 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4870 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4861 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4858 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4836 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4830 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4826 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4815 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4802 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4792 https://mariadb.com/kb/en/mariadb/security/

1 0

[arch-security] [ASA-201510-25] lldpd: denial of service
by Levente Polyak 30 Oct '15

30 Oct '15

Arch Linux Security Advisory ASA-201510-25 ========================================== Severity: Medium Date : 2015-10-30 CVE-ID : CVE-2015-8011 CVE-2015-8012 Package : lldpd Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lldpd before version 0.7.19-1 is vulnerable denial of service. Resolution ========== Upgrade to 0.7.19-1. # pacman -Syu "lldpd>=0.7.19-1" The problems have been fixed upstream in version 0.7.19. Workaround ========== None. Description =========== - CVE-2015-5714 (denial of service) A buffer overflow has been discovered when handling management address TLV. When a remote device was advertising a too large management address while still respecting TLV boundaries, lldpd would crash due to a buffer overflow. - CVE-2015-5715 (denial of service) A vulnerability has been discovered that is triggering an application crash while using assert() if a malformed packet is handled. Impact ====== A remote attacker is able to crash the application leading to denial of service. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8011 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8012 http://seclists.org/oss-sec/2015/q4/198

1 0

[arch-security] [ASA-201510-24] wordpress: multiple issues
by Levente Polyak 30 Oct '15

30 Oct '15

Arch Linux Security Advisory ASA-201510-24 ========================================== Severity: Medium Date : 2015-10-30 CVE-ID : 2015-5714 2015-5715 CVE-2015-7989 Package : wordpress Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wordpress before version 4.3.1-1 is vulnerable to cross-side scripting and insufficient permission restriction. Resolution ========== Upgrade to 4.3.1-1. # pacman -Syu "wordpress>=4.3.1-1" The problems have been fixed upstream in version 4.3.1. Workaround ========== None. Description =========== - CVE-2015-5714 (cross-side scripting) A cross-site scripting vulnerability has been discovered when processing shortcode tags. - CVE-2015-5715 (insufficient permission restriction) A vulnerability has been discovered, allowing users without proper permissions to publish private posts and make them sticky. - CVE-2015-7989 (cross-side scripting) A cross-site scripting vulnerability has been discovered in the user list tables. Impact ====== A remote attacker is able do perform cross-side scripting attacks or publish private posts and make them sticky. References ========== https://access.redhat.com/security/cve/CVE-2015-5714 https://access.redhat.com/security/cve/CVE-2015-5715 https://access.redhat.com/security/cve/CVE-2015-7989 https://codex.wordpress.org/Version_4.3.1 http://seclists.org/oss-sec/2015/q4/178

1 0

[arch-security] [ASA-201510-23] phpmyadmin: content spoofing
by Levente Polyak 30 Oct '15

30 Oct '15

Arch Linux Security Advisory ASA-201510-23 ========================================== Severity: Low Date : 2015-10-30 CVE-ID : CVE-2015-7873 Package : phpmyadmin Type : content spoofing Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package phpmyadmin before version 4.5.1-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 4.5.1-1. # pacman -Syu "phpmyadmin>=4.5.1-1" The problem has been fixed upstream in version 4.5.1. Workaround ========== None. Description =========== This vulnerability allows an attacker to perform a content spoofing attack using the phpMyAdmin's redirection mechanism to external sites. This vulnerability is not considered to be critical since the spoofed content is escaped and no HTML injection is possible. Impact ====== A remote attacker is able do perform content spoofing using the redirection mechanism to external sites. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7873 https://www.phpmyadmin.net/security/PMASA-2015-5/

1 0

[arch-security] [ASA-201510-22] vorbis-tools: denial of service
by Levente Polyak 27 Oct '15

27 Oct '15

Arch Linux Security Advisory ASA-201510-22 ========================================== Severity: Low Date : 2015-10-27 CVE-ID : CVE-2015-6749 Package : vorbis-tools Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package vorbis-tools before version 1.4.0-6 is vulnerable to denial of service. Resolution ========== Upgrade to 1.4.0-6. # pacman -Syu "vorbis-tools>=1.4.0-6" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Buffer overflow in the aiff_open function in oggenc/audio.c allows local attackers to cause a denial of service (crash) via a crafted AIFF file. Impact ====== A local attacker is able to craft a special AIFF file that crashes the application leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2015-6749 https://trac.xiph.org/ticket/2212 https://bugs.archlinux.org/task/46269

1 0