- Arch-security - lists.archlinux.org

[arch-security] [ASA-201510-11] miniupnpc: arbitrary code execution
by Levente Polyak 18 Oct '15

18 Oct '15

Arch Linux Security Advisory ASA-201510-11 ========================================== Severity: Critical Date : 2015-10-18 CVE-ID : CVE-2015-6031 Package : miniupnpc Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package miniupnpc before version 1.9.20151008-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.9.20151008-1. # pacman -Syu "miniupnpc>=1.9.20151008-1" The problem has been fixed upstream but no release is available. Workaround ========== None. Description =========== An exploitable buffer overflow vulnerability exists in the XML parser functionality of the MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this vulnerability. Impact ====== A remote attacker is able to create a specially crafted XML response on a server set up on the local network to execute arbitrary code on the client. References ========== http://talosintel.com/reports/TALOS-2015-0035/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6031 https://bugs.archlinux.org/task/46612

1 0

[arch-security] [ASA-201510-10] firefox: cross-origin restriction bypass
by Remi Gacogne 16 Oct '15

16 Oct '15

Arch Linux Security Advisory ASA-201510-10 ========================================== Severity: High Date : 2015-10-16 CVE-ID : CVE-2015-7184 Package : firefox Type : cross-origin restriction bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 41.0.2-1 is vulnerable to cross-origin restriction bypass. Resolution ========== Upgrade to 41.0.2-1. # pacman -Syu "firefox>=41.0.2-1" The problem has been fixed upstream in version 41.0.2. Workaround ========== None. Description =========== Security researcher Abdulrahman Alqabandi reported that the fetch() API did not correctly implement the Cross-Origin Resource Sharing (CORS) specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue. Impact ====== A remote attacker can bypass the cross-origin resource sharing policy to access sensitive information. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2015-115/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7184

1 0

[arch-security] [ASA-201510-9] mbedtls: arbitrary code execution
by Remi Gacogne 15 Oct '15

15 Oct '15

Arch Linux Security Advisory ASA-201510-9 ========================================= Severity: Critical Date : 2015-10-15 CVE-ID : CVE-2015-5291 Package : mbedtls Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mbedtls before version 2.1.2-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 2.1.2-1. # pacman -Syu "mbedtls>=2.1.2-1" The problem has been fixed upstream in versions 2.1.2, 1.3.14 and 1.2.17. Workaround ========== To be protected against this vulnerability, you need to apply both of the following work-arounds: - Do not use ticket-based session resumption. This can be achieved in two ways: (1) do not attempt to resume a saved session (do not use mbedtls_get_session() / mbedtls_set_session()), or (2) if you want to resume sessions, make sure you're not using tickets by calling ssl_set_session_tickets( SSL_SESSION_TICKETS_DISABLED ) in 1.3.x or mbedtls_ssl_conf_session_tickets( MBEDTLS_SSL_SESSION_TICKETS_DISABLED ) in 2.x. - If you accept hostnames from untrusted parties, validate that they are at most 255 bytes long (limit defined by RFC 1305) before passing them to ssl_set_hostname(). Description =========== When the client creates its ClientHello message, due to insufficient bounds checking it can overflow the heap-based buffer containing the message while writing some extensions. Two extensions in particular could be used by a remote attacker to trigger the overflow: the session ticket extension and the server name indication (SNI) extension. Starting with PolarSSL 1.3.0 which added support for session tickets, any server the client connects to can send an overlong session ticket which will cause a buffer overflow if and when the client attempts to resume the connection with the server. Clients that disabled session tickets or never attempt to reconnect to a server using a saved session are not vulnerable to this attack vector. Starting with PolarSSL 1.0.0, this overflow could also be triggered by an attacker convincing a client to use an overlong hostname for the SNI extension. The hostname needs to be almost as long at SSL_MAX_CONTENT_LEN, which as 16KB by default, but could be smaller if a custom configuration is used. Clients that do not accept hostnames from untrusted parties are not vulnerable to this attack vector. Impact ====== A malicious server could cause a denial of service or execute arbitrary code on a vulnerable client by sending an overlong session ticket. An attacker could cause a denial of service or execute arbitrary code on a vulnerable client by convincing it to connect to an overlong hostname. References ========== https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://access.redhat.com/security/cve/CVE-2015-5291

1 0

[arch-security] [ASA-201510-8] chromium: multiple issues
by Remi Gacogne 14 Oct '15

14 Oct '15

Arch Linux Security Advisory ASA-201510-8 ========================================= Severity: High Date : 2015-10-14 CVE-ID : CVE-2015-6755 CVE-2015-6756 CVE-2015-6757 CVE-2015-6758 CVE-2015-6759 CVE-2015-6760 CVE-2015-6761 CVE-2015-6762 CVE-2015-6763 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 46.0.2490.71-1 is vulnerable to multiple issues including but not limited to cross-origin bypass, information leakage and denial of service. Resolution ========== Upgrade to 46.0.2490.71-1. # pacman -Syu "chromium>=46.0.2490.71-1" The problem has been fixed upstream in version 46.0.2490.71. Workaround ========== None. Description =========== - CVE-2015-6755 (cross-origin bypass): Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2015-6756 (use-after-free): Use-after-free in PDFium. - CVE-2015-6757 (use-after-free): Use-after-free in ServiceWorker. Credit to Collin Payne. - CVE-2015-6758: Bad-cast in PDFium. Credit to Atte Kettunen of OUSPG. - CVE-2015-6759 (information leakage): Information leakage in LocalStorage. Credit to Muneaki Nishimura (nishimunea). - CVE-2015-6760 (improper error handling): Improper error handling in libANGLE. Credit to lastland.net. - CVE-2015-6761 (memory corruption): Memory corruption in FFMpeg. Credit to Aki Helin of OUSPG and anonymous. - CVE-2015-6762 (cross-origin resource sharing bypass): CORS bypass via CSS fonts. Credit to Muneaki Nishimura (nishimunea). - CVE-2015-6763: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass the cross-origin restrictions, get access to sensitive information, cause a denial of service or possibly have unspecified other impact. References ========== http://googlechromereleases.blogspot.fr/2015/10/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2015-6755 https://access.redhat.com/security/cve/CVE-2015-6756 https://access.redhat.com/security/cve/CVE-2015-6757 https://access.redhat.com/security/cve/CVE-2015-6758 https://access.redhat.com/security/cve/CVE-2015-6759 https://access.redhat.com/security/cve/CVE-2015-6760 https://access.redhat.com/security/cve/CVE-2015-6761 https://access.redhat.com/security/cve/CVE-2015-6762 https://access.redhat.com/security/cve/CVE-2015-6763

1 0

[arch-security] [ASA-201510-7] flashplugin: multiple issues
by Levente Polyak 14 Oct '15

14 Oct '15

Arch Linux Security Advisory ASA-201510-7 ========================================= Severity: Critical Date : 2015-10-14 CVE-ID : CVE-2015-5569 CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7628 CVE-2015-7629 CVE-2015-7630 CVE-2015-7631 CVE-2015-7632 CVE-2015-7633 CVE-2015-7634 CVE-2015-7643 CVE-2015-7644 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.535-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, same-origin-policy bypass and information disclosure. Resolution ========== Upgrade to 11.2.202.535-1. # pacman -Syu "flashplugin>=11.2.202.535-1" The problems have been fixed upstream in version 11.2.202.535. Workaround ========== None. Description =========== - CVE-2015-5569 (information leak, insufficient hardening) These updates include a defense-in-depth feature in the Flash broker API. - CVE-2015-7625 CVE-2015-7626 CVE-2015-7627 CVE-2015-7630 CVE-2015-7633 CVE-2015-7634 (arbitrary code execution) These updates resolve memory corruption vulnerabilities that could lead to code execution. - CVE-2015-7628 (same-origin-policy bypass, information disclosure) These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure. - CVE-2015-7629 CVE-2015-7631 CVE-2015-7643 CVE-2015-7644 (arbitrary code execution) These updates resolve use-after-free vulnerabilities that could lead to code execution. - CVE-2015-7632 (arbitrary code execution) These updates resolve a buffer overflow vulnerability that could lead to code execution. Impact ====== A remote attacker is able to execute arbitrary code, bypass the same-origin-policy and disclose sensitive information via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-5569 https://access.redhat.com/security/cve/CVE-2015-7625 https://access.redhat.com/security/cve/CVE-2015-7626 https://access.redhat.com/security/cve/CVE-2015-7627 https://access.redhat.com/security/cve/CVE-2015-7628 https://access.redhat.com/security/cve/CVE-2015-7629 https://access.redhat.com/security/cve/CVE-2015-7630 https://access.redhat.com/security/cve/CVE-2015-7631 https://access.redhat.com/security/cve/CVE-2015-7632 https://access.redhat.com/security/cve/CVE-2015-7633 https://access.redhat.com/security/cve/CVE-2015-7634 https://access.redhat.com/security/cve/CVE-2015-7643 https://access.redhat.com/security/cve/CVE-2015-7644 https://helpx.adobe.com/security/products/flash-player/apsb15-25.html

1 0

[arch-security] [ASA-201510-6] gdk-pixbuf2: multiple issues
by Levente Polyak 10 Oct '15

10 Oct '15

Arch Linux Security Advisory ASA-201510-6 ========================================= Severity: Medium Date : 2015-10-10 CVE-ID : CVE-2015-7673 CVE-2015-7674 Package : gdk-pixbuf2 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gdk-pixbuf2 before version 2.32.1-1 is vulnerable to denial of service and heap buffer overflow. Resolution ========== Upgrade to 2.32.1-1. # pacman -Syu "gdk-pixbuf2>=2.32.1-1" The problems have been fixed upstream in version 2.32.1. Workaround ========== None. Description =========== - CVE-2015-7673 (denial of service) It has been discovered that under certain circumstances while scaling a tga file a heap memory allocation may fail which is later used and leads to a denial of service. - CVE-2015-7673 (heap buffer overflow) It has been discovered that under certain circumstances while scaling a gif file a heap buffer overflow can occur. The cause of this issue was that the integer data type was incompatible with the details of how bitwise shifts were used. Impact ====== A remote attacker is able to use specially crafted tga or gif files to perform a denial of service attack or take advantage of a heap buffer overflow to possibly have other impact. References ========== https://access.redhat.com/security/cve/CVE-2015-7673 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7674 http://seclists.org/oss-sec/2015/q4/18 http://seclists.org/oss-sec/2015/q4/19

1 0

[arch-security] [ASA-201510-5] opensmtpd: multiple issues
by Levente Polyak 08 Oct '15

08 Oct '15

Arch Linux Security Advisory ASA-201510-5 ========================================= Severity: Critical Date : 2015-10-08 CVE-ID : CVE-2015-7687 Package : opensmtpd Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package opensmtpd before version 5.7.3p1-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 5.7.3p1-1. # pacman -Syu "opensmtpd>=5.7.3p1-1" The problems have been fixed upstream in version 5.7.3p1. Workaround ========== None. Description =========== - an oversight in the portable version of fgetln() that allows attackers to read and write out-of-bounds memory - multiple denial-of-service vulnerabilities that allow local users to kill or hang OpenSMTPD - a stack-based buffer overflow that allows local users to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user - a hardlink attack (or race-conditioned symlink attack) that allows local users to unset the chflags() of arbitrary files - a hardlink attack that allows local users to read the first line of arbitrary files (for example, root's hash from /etc/master.passwd) - a denial-of-service vulnerability that allows remote attackers to fill OpenSMTPD's queue or mailbox hard-disk partition - an out-of-bounds memory read that allows remote attackers to crash OpenSMTPD, or leak information and defeat the ASLR protection - a use-after-free vulnerability that allows remote attackers to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user - fix an mda buffer truncation bug which allows a user to create forward files that pass session checks but fail delivery later down the chain, within the user mda - fix remote buffer overflow in unprivileged pony process - reworked offline enqueue to better protect against hardlink attacks Impact ====== A remote attacker is able to execute arbitrary code, crash the process to perform a denial of service attack, read arbitrary memory to disclose information and defeat ASLR or have other unspecified impact via various vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-7687 https://www.opensmtpd.org/announces/release-5.7.2.txt https://www.opensmtpd.org/announces/release-5.7.3.txt http://seclists.org/oss-sec/2015/q4/17 https://bugs.archlinux.org/task/46605

1 0

[arch-security] [ASA-201510-4] bugzilla: unauthorized account creation
by Levente Polyak 08 Oct '15

08 Oct '15

Arch Linux Security Advisory ASA-201510-4 ========================================= Severity: High Date : 2015-10-08 CVE-ID : CVE-2015-4499 Package : bugzilla Type : unauthorized account creation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bugzilla before version 5.0.1-1 is vulnerable to unauthorized account creation. Resolution ========== Upgrade to 5.0.1-1. # pacman -Syu "bugzilla>=5.0.1-1" The problem has been fixed upstream in version 5.0.1. Workaround ========== None. Description =========== Login names (usually an email address) longer than 127 characters are silently truncated in MySQL which could cause the domain name of the email address to be corrupted. An attacker could use this vulnerability to create an account with an email address different from the one originally requested. The login name could then be automatically added to groups based on the group's regular expression setting. This vulnerability has been demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address that resulted in an unauthorized account creation with the default privileges of the mozilla group. Impact ====== A remote attacker is able to obtain default privileges for an arbitrary domain name by placing that name in a substring of an address resulting in unauthorized account creation. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4499 https://www.bugzilla.org/security/4.2.14/ https://bugzilla.mozilla.org/show_bug.cgi?id=1202447 https://bugs.archlinux.org/task/46573

1 0

[arch-security] [ASA-201510-3] nodejs: denial of service
by Levente Polyak 06 Oct '15

06 Oct '15

Arch Linux Security Advisory ASA-201510-3 ========================================= Severity: Medium Date : 2015-10-06 CVE-ID : CVE-2015-7384 Package : nodejs Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nodejs before version 4.1.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.1.2-1. # pacman -Syu "nodejs>=4.1.2-1" The problem has been fixed upstream in version 4.1.2. Workaround ========== None. Description =========== A vulnerability has been discovered in the HTTP pipeline handling that is leading to an application crash. This problem is caused by out-of-order responses being sent to the client within a single pipelined connection. Impact ====== A remote attacker is able to crash the process when out-of-order responses are sent within a single pipelined connection resulting in denial of service. References ========== https://github.com/nodejs/node/issues/3138 https://access.redhat.com/security/cve/CVE-2015-7384 https://nodejs.org/en/blog/release/v4.1.2/

1 0

[arch-security] [ASA-201510-2] hostapd: denial of service
by Christian Rebischke 05 Oct '15

05 Oct '15

Arch Linux Security Advisory ASA-201510-2 ========================================= Severity: Medium Date : 2015-10-05 CVE-ID : CVE-2015-4141 CVE-2015-4142 CVE-2015-4143 CVE-2015-4144 CVE-2015-4145 CVE-2015-4146 Package : hostapd Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package hostapd before version 2.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.5-1 # pacman -Syu "hostapd>=2.5-1" The problem has been fixed upstream in version 2.5. Workaround ========== None. Description =========== - CVE-2015-4141 (denial of service) A vulnerability was found in the WPS UPnP function shared by hostapd (WPS AP) and wpa_supplicant (WPS external registrar). This may allow a possible denial of service attack through - CVE-2015-4142 (denial of service) A vulnerability was found in WMM Action frame processing in a case where hostapd or wpa_supplicant is used to implement AP mode MLME/SME functionality (i.e., Host AP driver of a mac80211-based driver on Linux). This vulnerability can be used to perform denial of service attacks by an attacker that is within radio range of the AP that uses hostapd of wpa_supplicant for MLME/SME operations. - CVE-2015-4143 (denial of service) The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) Commit or (2) Confirm message payload. - CVE-2015-4144 (denial of service) The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which allows remote attackers to cause a denial of service (crash) via a crafted message. - CVE-2015-4145 (denial of service) The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to cause a denial of service (memory leak) via a crafted message. - CVE-2015-4146 (denial of service) The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service (crash) via a crafted message. Impact ====== A remote attacker is able to crash the wifi access point. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4141 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4142 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4143 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4144 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4145 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4146 http://w1.fi/security/2015-2/ http://w1.fi/security/2015-3/ http://w1.fi/security/2015-4/ http://w1.fi/security/2015-5/

1 0