- Arch-security - lists.archlinux.org

[arch-security] [ASA-201510-21] drupal: open redirect
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-21 ========================================== Severity: Low Date : 2015-10-23 CVE-ID : CVE-2015-7943 Package : drupal Type : open redirect Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package drupal before version 7.41-1 is vulnerable to open redirect. Resolution ========== Upgrade to 7.41-1. # pacman -Syu "drupal>=7.41-1" The problems have been fixed upstream in version 7.41. Workaround ========== None. Description =========== The Overlay module in Drupal core displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability. This vulnerability is mitigated by the fact that it can only be used against site users who have the "Access the administrative overlay" permission, and that the Overlay module must be enabled. Impact ====== A remote attacker is able to make use of the insufficient URL validation to misuse it as an open redirect relay and display the content of arbitrary URLs. References ========== https://www.drupal.org/SA-CORE-2015-004 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7943

1 0

[arch-security] [ASA-201510-20] jre8-openjdk-headless: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-20 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 Package : jre8-openjdk-headless Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre8-openjdk-headless before version 8.u65-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 8.u65-1. # pacman -Syu "jre8-openjdk-headless>=8.u65-1" The problems have been fixed upstream in version 8.u65. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4868 (security policy bypass) A flaw was found in the way the Libraries component of OpenJDK handled certificate revocation lists (CRL). In certain cases, CRL checking code could fail to report that a certificate was revoked, causing the application to accept it as trusted. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4901 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4906 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors related to JavaFX. - CVE-2015-4908 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4916 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4868 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4901 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4906 https://access.redhat.com/security/cve/CVE-2015-4908 https://access.redhat.com/security/cve/CVE-2015-4911 https://access.redhat.com/security/cve/CVE-2015-4916

1 0

[arch-security] [ASA-201510-19] jre8-openjdk: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-19 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 Package : jre8-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre8-openjdk before version 8.u65-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 8.u65-1. # pacman -Syu "jre8-openjdk>=8.u65-1" The problems have been fixed upstream in version 8.u65. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4868 (security policy bypass) A flaw was found in the way the Libraries component of OpenJDK handled certificate revocation lists (CRL). In certain cases, CRL checking code could fail to report that a certificate was revoked, causing the application to accept it as trusted. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4901 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4906 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors related to JavaFX. - CVE-2015-4908 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4916 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4868 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4901 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4906 https://access.redhat.com/security/cve/CVE-2015-4908 https://access.redhat.com/security/cve/CVE-2015-4911 https://access.redhat.com/security/cve/CVE-2015-4916

1 0

[arch-security] [ASA-201510-18] jdk8-openjdk: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-18 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 Package : jdk8-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk8-openjdk before version 8.u65-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 8.u65-1. # pacman -Syu "jdk8-openjdk>=8.u65-1" The problems have been fixed upstream in version 8.u65. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4868 (security policy bypass) A flaw was found in the way the Libraries component of OpenJDK handled certificate revocation lists (CRL). In certain cases, CRL checking code could fail to report that a certificate was revoked, causing the application to accept it as trusted. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4901 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4906 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors related to JavaFX. - CVE-2015-4908 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4916 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4868 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4901 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4906 https://access.redhat.com/security/cve/CVE-2015-4908 https://access.redhat.com/security/cve/CVE-2015-4911 https://access.redhat.com/security/cve/CVE-2015-4916

1 0

[arch-security] [ASA-201510-17] jre7-openjdk-headless: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-17 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 Package : jre7-openjdk-headless Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk7-openjdk-headless before version 7.u91_2.6.2-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 7.u91_2.6.2-1. # pacman -Syu "jre7-openjdk-headless>=7.u91_2.6.2-1" The problems have been fixed upstream in version 7.u91. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4871 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-October/033972.h… http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4871 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4911

1 0

[arch-security] [ASA-201510-16] jre7-openjdk: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-16 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 Package : jre7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk before version 7.u91_2.6.2-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 7.u91_2.6.2-1. # pacman -Syu "jre7-openjdk>=7.u91_2.6.2-1" The problems have been fixed upstream in version 7.u91. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4871 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-October/033972.h… http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4871 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4911

1 0

[arch-security] [ASA-201510-15] jdk7-openjdk: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-15 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 Package : jdk7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk7-openjdk before version 7.u91_2.6.2-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 7.u91_2.6.2-1. # pacman -Syu "jdk7-openjdk>=7.u91_2.6.2-1" The problems have been fixed upstream in version 7.u91. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4871 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-October/033972.h… http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4871 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4911

1 0

[arch-security] [ASA-201510-14] ntp: multiple issues
by Christian Rebischke 22 Oct '15

22 Oct '15

Arch Linux Security Advisory ASA-201510-14 ========================================== Severity: Critical Date : 2015-10-22 CVE-ID : CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 Package : ntp Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ntp before version 4.2.8.p4-1 is vulnerable to multiple issues including denial of service, memory corruption, directory traversal, memory leaks and authentication bypass. Resolution ========== Upgrade to 4.2.8.p4-1. # pacman -Syu "ntp>=4.2.8.p4-1" The problems have been fixed upstream in version 4.2.8.p4. Workaround ========== None. Description =========== - CVE-2015-7871 (authentication bypass) An error handling logic error exists within ntpd that manifests due to improper error condition handling associated with certain crypto-NAK packets. An unauthenticated, off-path attacker can force ntpd processes on targeted servers to peer with time sources of the attacker's choosing by transmitting symmetric active crypto-NAK packets to ntpd. This attack bypasses the authentication typically required to establish a peer association and allows an attacker to make arbitrary changes to system time. Matthew Van Gundy of Cisco ASIG is credited with discovering this vulnerability. [1] - CVE-2015-7855 (denial of service) decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values. This can cause a denial of service. - CVE-2015-7854 (memory corruption) A potential buffer overflow vulnerability exists in the password management functionality of ntp. A specially crafted key file could cause a buffer overflow potentially resulting in memory being modified. An attacker could provide a malicious password to trigger this vulnerability. [2] - CVE-2015-7849 (memory corruption) An exploitable use-after-free vulnerability exists in the password management functionality of the Network Time Protocol. A specially crafted key file could cause a buffer overflow resulting in memory corruption. An attacker could provide a malicious password file to trigger this vulnerability. [3] - CVE-2015-7852 (memory corruption) A potential off by one vulnerability exists in the cookedprint functionality of ntpq. A specially crafted buffer could cause a buffer overflow potentially resulting in null byte being written out of bounds. [4] - CVE-2015-7853 (memory corruption) A potential buffer overflow vulnerability exists in the refclock of ntpd. An invalid length provided by a hardware reference clock could cause a buffer overflow potentially resulting in memory being modified. A malicious reflock could provide a negative length to trigger this vulnerability. [5] - CVE-2015-7848 (denial of service) When processing a specially crafted private mode packet, an integer overflow can occur leading to out of bounds memory copy operation. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash. [6] - CVE-2015-7850 (denial of service) An exploitable denial of service vulnerability exists in the remote configuration functionality of the Network Time Protocol. A specially crafted configuration file could cause an endless loop resulting in a denial of service. An attacker could provide a the malicious configuration file to trigger this vulnerability. [7] - CVE-2015-7851 (directory traversal) A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability. [8] - CVE-2015-7701 (memory leak) Slow memory leak in CRYPTO_ASSOC. - CVE-2015-7702 (denial of service). Incomplete autokey data packet length checks. - CVE-2015-7703 (directory traversal) configuration directives "pidfile" and "driftfile" should only be allowed locally. - CVE-2015-7704 (denial of service) Clients that receive a KoD should validate the origin timestamp field. - CVE-2015-7705 (denial of service) Clients that receive a KoD should validate the origin timestamp field. - CVE-2015-7691 (denial of service) Incomplete autokey data packet length checks. - CVE-2015-7692 (denial of service Incomplete autokey data packet length checks. Impact ====== A remote attacker is able to crash the NTP-Server, change the system time, overwrite configuration file or can corrupt the memory. References ========== http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities http://blog.talosintel.com/2015/10/ntpd-vulnerabilities.html http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7691 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7692 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7701 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7702 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7703 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7704 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7705 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7848 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7849 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7850 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7851 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7852 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7853 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7854 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7855 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7871 [1] http://talosintel.com/reports/TALOS-2015-0069/ [2] http://talosintel.com/reports/TALOS-2015-0065/ [3] http://talosintel.com/reports/TALOS-2015-0054/ [4] http://talosintel.com/reports/TALOS-2015-0063/ [5] http://talosintel.com/reports/TALOS-2015-0064/ [6] http://talosintel.com/reports/TALOS-2015-0052/ [7] http://talosintel.com/reports/TALOS-2015-0055/ [8] http://talosintel.com/reports/TALOS-2015-0062/

1 0

[arch-security] [ASA-201510-13] spice: multiple issues
by Remi Gacogne 19 Oct '15

19 Oct '15

Arch Linux Security Advisory ASA-201510-13 ========================================== Severity: High Date : 2015-10-19 CVE-ID : CVE-2015-3247 CVE-2015-5260 CVE-2015-5261 Package : spice Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package spice before version 0.12.6-1 is vulnerable to multiple issues, including denial of service and privilege escalation. Resolution ========== Upgrade to 0.12.6-1. # pacman -Syu "spice>=0.12.6-1" The problem has been fixed upstream in version 0.12.6. Workaround ========== None. Description =========== - CVE-2015-3247 (race condition flaw): A race condition flaw was found in spice's worker_update_monitors_config() function, leading to a heap-based memory corruption. A user in a guest could leverage this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process. - CVE-2015-5260 (heap-based buffer overflow): A heap-based buffer overflow flaw was found in the way spice handled certain QXL commands related to the "surface_id" parameter. A user in a guest could use this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of the host QEMU-KVM process. - CVE-2015-5261 (heap-based buffer overflow): A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation. A user in a guest could use this flaw to read and write arbitrary memory locations on the host. Impact ====== A rogue guest user can cause a denial of service to the host or execute arbitrary command with the privileges of the host QEMU-KVM process. References ========== https://bugs.archlinux.org/task/46738 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3247 https://access.redhat.com/security/cve/CVE-2015-5260 https://access.redhat.com/security/cve/CVE-2015-5261 http://lists.freedesktop.org/archives/spice-devel/2015-October/022168.html

1 0

[arch-security] [ASA-201510-12] flashplugin: arbitrary code execution
by Remi Gacogne 18 Oct '15

18 Oct '15

Arch Linux Security Advisory ASA-201510-12 ========================================== Severity: Critical Date : 2015-10-18 CVE-ID : CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.540-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 11.2.202.540-1. # pacman -Syu "flashplugin>=11.2.202.540-1" The problem has been fixed upstream in version 11.2.202.540. Workaround ========== None. Description =========== Several critical type confusion vulnerabilities (CVE-2015-7645, CVE-2015-7647, CVE-2015-7648) have been identified in Adobe Flash Player 11.2.202.535 and earlier 11.x versions for Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for the CVE-2015-7645 vulnerability is being used in limited, targeted attacks. Impact ====== A remote attacker can execute arbitrary code by supplying a crafted SWF flash file on a website. These vulnerabilities are currently exploited in the wild. References ========== https://helpx.adobe.com/security/products/flash-player/apsa15-05.html https://helpx.adobe.com/security/products/flash-player/apsb15-27.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7645

1 0