- Arch-security - lists.archlinux.org

[arch-security] [ASA-201510-1] libunwind: denial of service
by Christian Rebischke 05 Oct '15

05 Oct '15

Arch Linux Security Advisory ASA-201510-1 ========================================= Severity: Low Date : 2015-10-05 CVE-ID : CVE-2015-3239 Package : libunwind Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libunwind before version 1.1-3 is vulnerable to denial of service due to an off-by-one error. Resolution ========== Upgrade to 1.1-3. # pacman -Syu "libunwind>=1.1-3" Workaround ========== None. Description =========== - CVE-2015-3239 (Unspecified Impact): Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact via invalid dwarf opcodes. Impact ====== An attacker could crash the library. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3239 https://bugzilla.redhat.com/show_bug.cgi?id=1232265 https://bugs.archlinux.org/task/46474

1 0

[arch-security] Fwd: [lxc-users] LXC security issue - affects all supported releases
by Leonid Isaev 29 Sep '15

29 Sep '15

Hi, This is a heads-up about a recent CVE which affects our community/lxc, please see the description below. Cheers, L. ----- Forwarded message from Stéphane Graber <stgraber(a)ubuntu.com> ----- Date: Tue, 29 Sep 2015 11:29:17 -0400 From: Stéphane Graber <stgraber(a)ubuntu.com> To: lxc-devel(a)lists.linuxcontainers.org, lxc-users(a)lists.linuxcontainers.org Subject: [lxc-users] LXC security issue - affects all supported releases User-Agent: Mutt/1.5.23 (2014-03-12) Reply-To: LXC users mailing-list <lxc-users(a)lists.linuxcontainers.org> Hello, During a recent security audit of LXC, Roman Fiedler identified a security vulnerability in LXC. CVE 2015-1335: When a container starts up, lxc sets up the container's inital fstree by doing a bunch of mounting, guided by the container configuration file. The container config is owned by the admin or user on the host, so we do not try to guard against bad entries. However, since the mount target is in the container, it's possible that the container admin could divert the mount with symbolic links. This could bypass proper container startup (i.e. confinement of a root-owned container by the restrictive apparmor policy, by diverting the required write to /proc/self/attr/current), or bypass the (path-based) apparmor policy by diverting, say, /proc to /mnt in the container. To prevent this, 1. do not allow mounts to paths containing symbolic links 2. do not allow bind mounts from relative paths containing symbolic links. The fix for LXC 1.0 is: https://github.com/lxc/lxc/commit/6bbb8100c4dec4b1c71758c27104985a694a4eac The fix for LXC 1.1 is: https://github.com/lxc/lxc/commit/6de26af93d3dd87c8b21a42fdf20f30fa1c1948d The fix for LXC master is: https://github.com/lxc/lxc/commit/592fd47a6245508b79fe6ac819fe6d3b2c1289be Patches for a few recent LXC releases are also attached to this e-mail. The fix will be included in the upcoming stable releases for both branches. That will be LXC 1.1.4 and LXC 1.0.8 which will both be released very soon. The security teams from the various Linux distributions have been informed of those security issues ahead of time and so should have or soon will be pushing security updates to their supported releases. I'd like to thank Roman for his great work at finding and responsibly disclosing those issues to us. The fix for this issue has been developed by Serge Hallyn with the help of Tyler Hicks and myself. -- Stéphane Graber Ubuntu developer http://www.ubuntu.com ----- End forwarded message ----- -- Leonid Isaev GPG fingerprints: DA92 034D B4A8 EC51 7EA6 20DF 9291 EE8A 043C B8C4 C0DF 20D0 C075 C3F1 E1BE 775A A7AE F6CB 164B 5A6D

1 0

[arch-security] [ASA-201509-11] chromium: cross-origin bypass
by Remi Gacogne 28 Sep '15

28 Sep '15

Arch Linux Security Advisory ASA-201509-11 ========================================== Severity: High Date : 2015-09-28 CVE-ID : CVE-2015-1303 CVE-2015-1304 Package : chromium Type : cross-origin bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 45.0.2454.101-1 is vulnerable to cross-origin bypass. Resolution ========== Upgrade to 45.0.2454.101-1. # pacman -Syu "chromium>=45.0.2454.101-1" The problem has been fixed upstream in version 45.0.2454.101. Workaround ========== None. Description =========== - CVE-2015-1303: Cross-origin bypass in DOM. Credit to Mariusz Mlynski. - CVE-2015-1304: Cross-origin bypass in V8. Credit to Mariusz Mlynski. Impact ====== A remote attacker can bypass the cross-origin resource sharing policy, thus getting access to sensitive data. References ========== http://googlechromereleases.blogspot.fr/2015/09/stable-channel-update_24.ht… https://access.redhat.com/security/cve/CVE-2015-1303 https://access.redhat.com/security/cve/CVE-2015-1304

1 0

[arch-security] [ASA-201509-10] rpcbind: denial of service
by Remi Gacogne 25 Sep '15

25 Sep '15

Arch Linux Security Advisory ASA-201509-10 ========================================== Severity: High Date : 2015-09-25 CVE-ID : CVE-2015-7236 Package : rpcbind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package rpcbind before version 0.2.3-2 is vulnerable to denial of service. Resolution ========== Upgrade to 0.2.3-2. # pacman -Syu "rpcbind>=0.2.3-2" The problem has not been fixed upstream yet. Workaround ========== None. Description =========== A use-after-free vulnerability has been found in rpcbind, leading to memory corruption then crash in the svc_dodestroy() function while trying to free a corrupted xprt->xp_netid pointer. Impact ====== A remote unauthenticated attacker can crash the rpcbind process, causing a denial of service of RPC-based services. References ========== https://access.redhat.com/security/cve/CVE-2015-7236 https://bugs.archlinux.org/task/46341 http://seclists.org/oss-sec/2015/q3/561

1 0

[arch-security] [ASA-201509-9] firefox: multiple issues
by Remi Gacogne 23 Sep '15

23 Sep '15

Arch Linux Security Advisory ASA-201509-9 ========================================= Severity: Critical Date : 2015-09-23 CVE-ID : CVE-2015-4500 CVE-2015-4501 CVE-2015-4502 CVE-2015-4504 CVE-2015-4506 CVE-2015-4507 CVE-2015-4508 CVE-2015-4509 CVE-2015-4510 CVE-2015-4511 CVE-2015-4512 CVE-2015-4516 CVE-2015-4517 CVE-2015-4519 CVE-2015-4520 CVE-2015-4521 CVE-2015-4522 CVE-2015-7174 CVE-2015-7175 CVE-2015-7176 CVE-2015-7177 CVE-2015-7180 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 41.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 41.0-1. # pacman -Syu "firefox>=41.0-1" The problem has been fixed upstream in version 41.0. Workaround ========== None. Description =========== - CVE-2015-4500 (Memory safety bugs fixed in Firefox ESR 38.3 and Firefox 41): Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David Major, Andrew McCreight and Cameron McCormack reported memory safety problems and crashes that affect Firefox ESR 38.2 and Firefox 40. Some of these bugs showed evidence of memory corruption under certain circumstances, and Mozilla presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2015-4501 (Memory safety bugs fixed in Firefox 41): Bob Clary and Randell Jesup reported crash and memory safety problems that affect Firefox 40. Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and Mozilla presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2015-4502 (Scripted proxies can access inner window): Security researcher André Bargull reported that when a web page creates a scripted proxy for the window with a handler defined a certain way, a reference to the inner window will be passed, rather than that of the outer window in violation of the specification. - CVE-2015-4504 (Out of bounds read in QCMS library with ICC V4 profile attributes): Security researcher Felix Gröbert of Google discovered an out of bounds read in the QCMS color management library while manipulating an image with specific attributes in its ICC V4 profile. This causes a crash and could lead to information disclosure. - CVE-2015-4506 (Buffer overflow in libvpx while parsing vp9 format video): Security researcher Khalil Zhani reported that a maliciously crafted vp9 format video could be used to trigger a buffer overflow while parsing the file. This leads to a potentially exploitable crash due to a flaw in the libvpx library. - CVE-2015-4507 (Crash when using debugger with SavedStacks in JavaScript): Security researcher Spandan Veggalam reported a crash while using the debugger API with SavedStacks in JavaScript. This crash can only occurs when the debugger is in use but may be potentially exploitable. - CVE-2015-4508 (URL spoofing in reader mode): Security researcher Juho Nurminen reported a mechanism to spoof the URL displayed in the address bar in reader mode by manipulating the loaded URL. This flaw allows for the URL displayed to be different than that the web content rendered. This allows for potential spoofing but the effects are mitigated due to the restrictions reader mode places when rendering content. - CVE-2015-4509 (Use-after-free while manipulating HTML media content): An anonymous researcher reported, via HP's Zero Day Initiative, a use-after-free vulnerability with HTML media elements on a page during script manipulation of the URI table of these elements. This results in a potentially exploitable crash. - CVE-2015-4510 (Use-after-free with shared workers and IndexedDB): Security researcher Looben Yang discovered a use-after-free vulnerability when using a shared worker with IndexedDB due to a race condition with the worker. This results in a potentially exploitable crash that can be triggered through web content. - CVE-2015-4511 (Buffer overflow while decoding WebM video): Using the Address Sanitizer tool, security researcher Atte Kettunen discovered a buffer overflow in the nestegg library when decoding a WebM format video with maliciously formatted headers. This leads to a potentially exploitable crash. - CVE-2015-4512 (Out-of-bounds read during 2D canvas display on Linux 16-bit color depth systems): Security researcher Francisco Alonso of the NowSecure Research Team used the Address Sanitizer tool to discover an out-of-bounds read issue during 2D canvas rendering. This was due to an issue in the cairo graphics library when surfaces are created with 32-bit color depth but displayed on a 16-bit color depth system, which is unsupported. This allows an attacker to read an amount of random memory following the heap for the 16-bit surface leading to information disclosure. - CVE-2015-4516 (JavaScript immutable property enforcement can be bypassed): Mozilla developer Jeff Walden reported that in Gecko's implementation of ECMAScript 5 API's enforces non-configurable properties with logic specific to each API. Scripts that do not go through these APIs can bypass these protections and make changes to the immutable properties in violation of security protections. This could potentially allow for web content to run in a privileged context leading to arbitrary code execution. - CVE-2015-4519 (Dragging and dropping images exposes final URL after redirects): Security researcher Mario Gomes reported that when a previously loaded image on a page is drag and dropped into content after a redirect, the redirected URL is available to scripts. This is a violation of the Fetch specification's defined behavior for "Atomic HTTP redirect handling" which states that redirected URLs are not exposed to any APIs. This can allow for information leakage. - CVE-2015-4520 (Errors in the handling of CORS preflight request headers): Mozilla developer Ehsan Akhgari reported two issues with Cross-origin resource sharing (CORS) "preflight" requests. The first issue is that in some circumstances the same cache key can be generated for two preflight requests on a site. As a result, if a second request is made that will match the cached key generated by an earlier request, CORS checks will be bypassed because the system will see the previously cached request as applicable. In the second issue, when some Access-Control- headers are missing from CORS responses, the values from different Access-Control- headers can be used that present in the same response. - CVE-2015-4517 (Memory-safety bugs in NetworkUtils.cpp generally), CVE-2015-4521 (Memory-safety bugs in ConvertDialogOptions), CVE-2015-4522 (Overflow in nsUnicodeToUTF8::GetMaxLength can create memory-safety bugs in callers), CVE-2015-7174 (Overflow in nsAttrAndChildArray::GrowBy causes memory-safety bug), CVE-2015-7175 (Overflow in XULContentSinkImpl::AddText causes memory-safety bug), CVE-2015-7176 (Bad sscanf argument in AnimationThread overruns stack variable), CVE-2015-7177 (Memory-safety bug in InitTextures), CVE-2015-7180 (Mishandling return status in ReadbackResultWriterD3D11::Run might cause memory-safety bug): Security researcher Ronald Crane reported eight vulnerabilities affecting released code that were found through code inspection. These included several potential memory safety issues resulting from the use of snprintf, one use of unowned memory, one use of a string without overflow checks, and five memory safety bugs. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them. Impact ====== A remote attacker might be able to spoof the URL displayed in the address bar, steal sensitive information, crash the browser or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://access.redhat.com/security/cve/CVE-2015-4500 https://access.redhat.com/security/cve/CVE-2015-4501 https://access.redhat.com/security/cve/CVE-2015-4502 https://access.redhat.com/security/cve/CVE-2015-4504 https://access.redhat.com/security/cve/CVE-2015-4506 https://access.redhat.com/security/cve/CVE-2015-4507 https://access.redhat.com/security/cve/CVE-2015-4508 https://access.redhat.com/security/cve/CVE-2015-4509 https://access.redhat.com/security/cve/CVE-2015-4510 https://access.redhat.com/security/cve/CVE-2015-4511 https://access.redhat.com/security/cve/CVE-2015-4512 https://access.redhat.com/security/cve/CVE-2015-4516 https://access.redhat.com/security/cve/CVE-2015-4517 https://access.redhat.com/security/cve/CVE-2015-4519 https://access.redhat.com/security/cve/CVE-2015-4520 https://access.redhat.com/security/cve/CVE-2015-4521 https://access.redhat.com/security/cve/CVE-2015-4522 https://access.redhat.com/security/cve/CVE-2015-7174 https://access.redhat.com/security/cve/CVE-2015-7175 https://access.redhat.com/security/cve/CVE-2015-7176 https://access.redhat.com/security/cve/CVE-2015-7177 https://access.redhat.com/security/cve/CVE-2015-7180

1 0

[arch-security] [ASA-201509-8] flashplugin: multiple issues
by Levente Polyak 22 Sep '15

22 Sep '15

Arch Linux Security Advisory ASA-201509-8 ========================================= Severity: Critical Date : 2015-09-22 CVE-ID : CVE-2015-5567 CVE-2015-5568 CVE-2015-5570 CVE-2015-5571 CVE-2015-5572 CVE-2015-5573 CVE-2015-5574 CVE-2015-5575 CVE-2015-5576 CVE-2015-5577 CVE-2015-5578 CVE-2015-5579 CVE-2015-5580 CVE-2015-5581 CVE-2015-5582 CVE-2015-5584 CVE-2015-5587 CVE-2015-5588 CVE-2015-6676 CVE-2015-6677 CVE-2015-6678 CVE-2015-6679 CVE-2015-6682 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.521-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 11.2.202.521-1. # pacman -Syu "flashplugin>=11.2.202.521-1" The problem has been fixed upstream in version 11.2.202.521. Workaround ========== None. Description =========== - CVE-2015-5573 (arbitrary code execution) These updates resolve a type confusion vulnerability that could lead to code execution. - CVE-2015-5570 CVE-2015-5574 CVE-2015-5581 CVE-2015-5584 CVE-2015-6682 (arbitrary code execution) These updates resolve use-after-free vulnerabilities that could lead to code execution. - CVE-2015-6676 CVE-2015-6678 (arbitrary code execution) These updates resolve buffer overflow vulnerabilities that could lead to code execution. - CVE-2015-5575 CVE-2015-5577 CVE-2015-5578 CVE-2015-5580 CVE-2015-5582 CVE-2015-5588 CVE-2015-6677 (arbitrary code execution) These updates resolve memory corruption vulnerabilities that could lead to code execution. - CVE-2015-5571 (insufficient validation) These updates include additional validation checks to ensure that Flash Player rejects malicious content from vulnerable JSONP callback APIs. - CVE-2015-5576 (denial of service) These updates resolve a memory leak vulnerability. - CVE-2015-5568 (denial of service) These updates include further hardening to a mitigation to defend against vector length corruptions. - CVE-2015-5567 CVE-2015-5579 (arbitrary code execution) These updates resolve stack corruption vulnerabilities that could lead to code execution. - CVE-2015-5587 (arbitrary code execution) These updates resolve a stack overflow vulnerability that could lead to code execution. - CVE-2015-5572 (information disclosure) These updates resolve a security bypass vulnerability that could lead to information disclosure. - CVE-2015-6679 (information disclosure) These updates resolve a vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure. Impact ====== A remote attacker is able to execute arbitrary code, obtain sensitive information or perform a denial of service attack via various vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-23.html https://access.redhat.com/security/cve/CVE-2015-5567 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2015-5568 https://access.redhat.com/security/cve/CVE-2015-5570 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5571 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5572 https://access.redhat.com/security/cve/CVE-2015-5573 https://access.redhat.com/security/cve/CVE-2015-5574 https://access.redhat.com/security/cve/CVE-2015-5575 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5576 https://access.redhat.com/security/cve/CVE-2015-5577 https://access.redhat.com/security/cve/CVE-2015-5578 https://access.redhat.com/security/cve/CVE-2015-5579 https://access.redhat.com/security/cve/CVE-2015-5580 https://access.redhat.com/security/cve/CVE-2015-5581 https://access.redhat.com/security/cve/CVE-2015-5582 https://access.redhat.com/security/cve/CVE-2015-5584 https://access.redhat.com/security/cve/CVE-2015-5587 https://access.redhat.com/security/cve/CVE-2015-5588 https://access.redhat.com/security/cve/CVE-2015-6676 https://access.redhat.com/security/cve/CVE-2015-6677 https://access.redhat.com/security/cve/CVE-2015-6678 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6679 https://access.redhat.com/security/cve/CVE-2015-6682

1 0

[arch-security] [ASA-201509-7] wordpress: multiple issues
by Levente Polyak 21 Sep '15

21 Sep '15

Arch Linux Security Advisory ASA-201509-7 ========================================= Severity: Medium Date : 2015-09-21 CVE-ID : CVE-2015-5714 CVE-2015-5715 Package : wordpress Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wordpress before version 4.3.1-1 is vulnerable to multiple issues including cross-side scripting and permission bypass. Resolution ========== Upgrade to 4.3.1-1. # pacman -Syu "wordpress>=4.3.1-1" The problem has been fixed upstream in version 4.3.1. Workaround ========== None. Description =========== - CVE-2015-5714 (cross-side scripting) A cross-site scripting vulnerability has been discovered when processing shortcode tags. - CVE-2015-5715 (permission bypass) It has been discovered that users without proper permissions could publish private posts and make them sticky. Impact ====== A remote attacker is able to perform a cross-side scripting attack via shortcode tags or create sticky notes without proper permissions. References ========== https://wordpress.org/news/2015/09/wordpress-4-3-1/ https://access.redhat.com/security/cve/CVE-2015-5714 https://access.redhat.com/security/cve/CVE-2015-5715 https://bugs.archlinux.org/task/46340

1 0

[arch-security] wordpress 4.3.1
by G. Schlisio 18 Sep '15

18 Sep '15

hi security concerned archers, the security update for wordpress 4.3.1 [0] is not in the repos yet, but building from abs with a simple version bumb works well. i just wanted to notify about this, in case somebody didnt notice. regards [0] https://wordpress.org/news/2015/09/wordpress-4-3-1/

1 0

[arch-security] [ASA-201509-6] icedtea-web: multiple issues
by Levente Polyak 13 Sep '15

13 Sep '15

Arch Linux Security Advisory ASA-201509-6 ========================================= Severity: Medium Date : 2015-09-14 CVE-ID : CVE-2015-5234 CVE-2015-5235 Package : icedtea-web Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package icedtea-web before version 1.6.1-1 is vulnerable to multiple authorization bypass vulnerabilities. Resolution ========== Upgrade to 1.6.1-1. # pacman -Syu "icedtea-web>=1.6.1-1" The problem has been fixed upstream in version 1.6.1. Workaround ========== None. Description =========== - CVE-2015-5234 (unexpected permanent authorization of unsigned applets) It was discovered that IcedTea-Web did not properly sanitize applet URLs when storing applet trust settings. A malicious web page could use this flaw to inject trust-settings configuration, and cause applets to be executed without user approval. - CVE-2015-5235 (applet origin spoofing) It was discovered that IcedTea-Web did not properly determine an applet's origin when asking the user if the applet should be run. A malicious page could use this flaw to cause IcedTea-Web to execute the applet without user approval, or confuse the user into approving applet execution based on an incorrectly indicated applet origin. Impact ====== A remote attacker is able to execute a malicious applet without user approval via multiple vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546… https://access.redhat.com/security/cve/CVE-2015-5234 https://access.redhat.com/security/cve/CVE-2015-5235

1 0

[arch-security] [ASA-201509-5] libvdpau lib32vdpau: multiple issues
by chris.rebischke＠gmail.com 12 Sep '15

12 Sep '15

Arch Linux Security Advisory ASA-201509-5 ========================================= Severity: Medium Date : 2015-09-12 CVE-ID : CVE-2015-5198 CVE-2015-5199 CVE-2015-5200 Package : libvdpau lib32-libvdpau Type : multiple issues Remote : no Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages libvdpau and lib32-libvdpau before version 1.1.1-1 are vulnerable to multiple issues. Resolution ========== Upgrade to 1.1.1-1 # pacman -Syu "libvdpau>=1.1.1-1" if you need lib32-libvdpau: # pacman -Syu "libvdpau>=1.1.1-1" "lib32-libvdpau>=1.1.1-1" Workaround ========== None. Description =========== - CVE-2015-5198 (Local Privilege Escalation) When used in a setuid or setgid application, libvdpau/lib32-libvdpau allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable. - CVE-2015-5199 (Directory Traversal) Directory traversal vulnerability in dlopen in libvdpau/lib32/libvdpau allows local users to gain privileges via the VDPAU_DRIVER environment variable. - CVE-2015-5200 (Directory Traversal) The trace functionality in libvdpau/lib32-libvdpau, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors. Impact ====== An attacker can gain root-access or write to arbitrary files without permission. References ========== http://lists.x.org/archives/xorg-announce/2015-August/002630.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5198 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5199 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5200 http://cgit.freedesktop.org/~aplattner/libvdpau/commit/?id=d1f9c16b1a818711…

1 0