- Arch-security - lists.archlinux.org

[arch-security] [ASA-201509-4] openldap: denial of service
by Levente Polyak 12 Sep '15

12 Sep '15

Arch Linux Security Advisory ASA-201509-4 ========================================= Severity: High Date : 2015-09-12 CVE-ID : CVE-2015-6908 Package : openldap Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openldap before version 2.4.42-2 is vulnerable to a remote denial of service. Resolution ========== Upgrade to 2.4.42-2. # pacman -Syu "openldap>=2.4.42-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== By sending a crafted packet, an attacker can cause the OpenLDAP daemon to crash with a SIGABRT. This is due to an assert() call within the ber_get_next method (io.c line 682) that is hit when decoding tampered BER data. The following proof of concept exploit can be used to trigger the condition: # echo "/4SEhISEd4MKYj5ZMgAAAC8=" | base64 -d | nc -v 127.0.0.1 389 The above causes slapd to abort as follows when running with '-d3', however it should be noted that this will crash the server even when running in daemon mode. Impact ====== A remote attacker is able to send specially crafted packets that cause the OpenLDAP server to crash, leading to denial of service. References ========== http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240 http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=6fe5… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6908 https://bugs.archlinux.org/task/46265

1 0

[arch-security] [ASA-201509-3] powerdns: denial of service
by Remi Gacogne 07 Sep '15

07 Sep '15

Arch Linux Security Advisory ASA-201509-3 ========================================= Severity: High Date : 2015-09-07 CVE-ID : CVE-2015-5230 Package : powerdns Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package powerdns before version 3.4.6-1 is vulnerable to a remote denial of service. Resolution ========== Upgrade to 3.4.6-1. # pacman -Syu "powerdns>=3.4.6-1" The problem has been fixed upstream in version 3.4.6. Workaround ========== A complete denial of service may be prevented by running the server inside a supervisor and setting distributor-threads to 1. The service may still be degraded though. Description =========== A bug was found in the PowerDNS Authoritative Server DNS packet parsing/generation code, which, when exploited, can cause individual threads (disabling service) or whole processes (allowing a supervisor to restart them) to crash with just one or a few query packets. Impact ====== A remote attacker can cause a denial of service by sending specially crafted DNS queries. References ========== https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/ https://access.redhat.com/security/cve/CVE-2015-5230

1 0

[arch-security] [ASA-201509-2] bind: denial of service
by Remi Gacogne 03 Sep '15

03 Sep '15

Arch Linux Security Advisory ASA-201509-2 ========================================= Severity: High Date : 2015-09-03 CVE-ID : CVE-2015-5722 CVE-2015-5986 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.2.P4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.2.P4-1. # pacman -Syu "bind>=9.10.2.P4-1" The problem has been fixed upstream in versions 9.9.7-P3 and 9.10.2-P4. Workaround ========== CVE-2015-5722 might be mitigated by disabling DNSSEC validation. However this is not recommended by ISC as it would increase the risk of other types of DNS attacks. Description =========== - CVE-2015-5722 (Parsing malformed keys may cause BIND to exit due to a failed assertion in buffer.c): Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example by using a query which requires a response from a zone containing a deliberately malformed key. - CVE-2015-5986 (An incorrect boundary check can trigger a REQUIRE assertion failure in openpgpkey_61.c): An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query. Impact ====== A remote attacker can crash a recursive server by causing a query to be sent for a specially crafted DNS zone she controls, causing denial of service. A remote attacker might be able to crash an authoritative server if she controls a zone the server must query against to perform its zone service, causing denial of service. References ========== https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bi… https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-tri… https://access.redhat.com/security/cve/CVE-2015-5722 https://access.redhat.com/security/cve/CVE-2015-5986

1 0

[arch-security] [ASA-201509-1] chromium: multiple issues
by Remi Gacogne 02 Sep '15

02 Sep '15

Arch Linux Security Advisory ASA-201509-1 ========================================= Severity: High Date : 2015-09-02 CVE-ID : CVE-2015-1291 CVE-2015-1292 CVE-2015-1293 CVE-2015-1294 CVE-2015-1295 CVE-2015-1296 CVE-2015-1297 CVE-2015-1298 CVE-2015-1299 CVE-2015-1300 CVE-2015-1301 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 45.0.2454.85-1 is vulnerable to multiple issues including cross-origin bypass, use-after-free, character spoofing and information leak. Resolution ========== Upgrade to 45.0.2454.85-1. # pacman -Syu "chromium>=45.0.2454.85-1" The problem has been fixed upstream in version 45.0.2454.85. Workaround ========== None. Description =========== - CVE-2015-1291, CVE-2015-1293: Cross-origin bypass in DOM. - CVE-2015-1292: Cross-origin bypass in ServiceWorker. - CVE-2015-1294: Use-after-free in Skia. - CVE-2015-1295: Use-after-free in Printing. - CVE-2015-1296: Character spoofing in omnibox. - CVE-2015-1297: Permission scoping error in WebRequest. - CVE-2015-1298: URL validation error in extensions. - CVE-2015-1299: Use-after-free in Blink. - CVE-2015-1300: Information leak in Blink. - CVE-2015-1301: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass the Same-Origin Policy of a website, spoof character in omnibox to trick the user, leak information, cause a denial of service or have other unspecified impact. References ========== http://googlechromereleases.blogspot.fr/2015/09/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2015-1291 https://access.redhat.com/security/cve/CVE-2015-1292 https://access.redhat.com/security/cve/CVE-2015-1293 https://access.redhat.com/security/cve/CVE-2015-1294 https://access.redhat.com/security/cve/CVE-2015-1295 https://access.redhat.com/security/cve/CVE-2015-1296 https://access.redhat.com/security/cve/CVE-2015-1297 https://access.redhat.com/security/cve/CVE-2015-1298 https://access.redhat.com/security/cve/CVE-2015-1299 https://access.redhat.com/security/cve/CVE-2015-1300 https://access.redhat.com/security/cve/CVE-2015-1301

1 0

[arch-security] [ASA-201508-12] firefox: multiple issues
by Remi Gacogne 28 Aug '15

28 Aug '15

Arch Linux Security Advisory ASA-201508-12 ========================================== Severity: Critical Date : 2015-08-28 CVE-ID : CVE-2015-4497 CVE-2015-4498 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 40.0.3-1 is vulnerable to arbitrary code execution and add-on dialog bypass/spoof. Resolution ========== Upgrade to 40.0.3-1. # pacman -Syu "firefox>=40.0.3-1" The problem has been fixed upstream in version 40.0.3. Workaround ========== None. Description =========== - CVE-2015-4497 (use-after-free when resizing canvas element during restyling): Mozilla community member Jean-Max Reymond discovered a use-after-free vulnerability with a <canvas> element on a page. This occurs when a resize event is triggered in concert with style changes but the canvas references have been recreated in the meantime, destroying the originally referenced context. This results in an exploitable crash. Ucha Gobejishvili, working with HP's Zero Day Initiative, subsequently reported this same issue. - CVE-2015-4498 (add-on bypass dialog and spoof): Security researcher Bas Venis reported a mechanism where add-ons could be installed from a different source than user expectations. Normally, when a user enters the URL to an add-on directly in the addressbar, warning prompts are bypassed because it is the result of direct user action. He discovered that a data: URL could be manipulated on a loaded page to simulate this direct user input of the add-on's URL, which would result in a bypassing of the install permission prompt. He also reported that in the absence of the permission prompt, it is possible to cause the actual installation prompt to appear above another site's location by causing a page navigation immediately after triggering add-on installation. This could manipulate a user into falsely believing a trusted site (such as addons.mozilla.org) has initiated the installation. This could lead to users installing an add-on from a malicious source. Impact ====== A remote attacker can execute arbitrary code on the affected host if the user can be led to visit a crafted website. A remote attacker can also trick a user into installing an add-on from a malicious source. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2015-94/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-95/ https://access.redhat.com/security/cve/CVE-2015-4497 https://access.redhat.com/security/cve/CVE-2015-4498

1 0

[arch-security] [ASA-201508-11] pcre: arbitrary code execution
by Levente Polyak 25 Aug '15

25 Aug '15

Arch Linux Security Advisory ASA-201508-11 ========================================== Severity: Critical Date : 2015-08-26 CVE-ID : None Package : pcre Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pcre before version 8.37-3 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.37-3. # pacman -Syu "pcre>=8.37-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap overflow has been discovered when compiling certain regular expressions with named references. This issue may lead to arbitrary code execution. Impact ====== A remote attacker able to compile a special regular expression with named references may be able to execute arbitrary code. References ========== http://seclists.org/oss-sec/2015/q3/295 https://bugs.exim.org/show_bug.cgi?id=1667

1 0

[arch-security] [ASA-201508-10] jasper: denial of service
by Levente Polyak 25 Aug '15

25 Aug '15

Arch Linux Security Advisory ASA-201508-10 ========================================== Severity: Medium Date : 2015-08-26 CVE-ID : CVE-2015-5203 Package : jasper Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages jasper before version 1.900.1-14 is vulnerable to denial of service. Resolution ========== Upgrade to 1.900.1-14. # pacman -Syu "jasper>=1.900.1-14" The problem has not been fixed upstream yet. Workaround ========== None. Description =========== A double free issue has been discovered in the function jasper_image_stop_load. This vulnerability can be triggered by loading a specially crafted image through jasper. Impact ====== A remote attacker is able to send a specially crafted image that triggers a double free leading to denial of service. References ========== http://seclists.org/oss-sec/2015/q3/366 https://access.redhat.com/security/cve/CVE-2015-5203

1 0

[arch-security] [ASA-201508-9] python-django, python2-django: denial of service
by Remi Gacogne 25 Aug '15

25 Aug '15

Arch Linux Security Advisory ASA-201508-9 ========================================= Severity: Medium Date : 2015-08-25 CVE-ID : CVE-2015-5963 Package : python-django Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages python-django and python2-django before version 1.8.4-1 are vulnerable to remote denial of service. Resolution ========== Upgrade to 1.8.4-1. # pacman -Syu "python-django>=1.8.4-1" # pacman -Syu "python2-django>=1.8.4-1" The problem has been fixed upstream in version 1.8.4, 1.7.10 and 1.4.22. Workaround ========== None. Description =========== Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view (provided it wasn't decorated with django.contrib.auth.decorators.login_required as done in the admin). This could allow an attacker to easily create many new session records by sending repeated requests, potentially filling up the session store or causing other users' session records to be evicted. The django.contrib.sessions.middleware.SessionMiddleware has been modified to no longer create empty session records. Impact ====== A remote attacker might be able to fill the session store, causing a denial of service. References ========== https://www.djangoproject.com/weblog/2015/aug/18/security-releases/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5963

1 0

[arch-security] [ASA-201508-8] gnutls: denial of service
by Remi Gacogne 25 Aug '15

25 Aug '15

Arch Linux Security Advisory ASA-201508-8 ========================================= Severity: Medium Date : 2015-08-25 CVE-ID : CVE-2015-6251 Package : gnutls Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gnutls before version 3.4.4.1-1 is vulnerable to remote denial of service. Resolution ========== Upgrade to 3.4.4.1-1. # pacman -Syu "gnutls>=3.4.4.1-1" The problem has been fixed upstream in version 3.4.4 and 3.3.17. Workaround ========== None. Description =========== Kurt Roeckx reported that decoding a specific certificate with very long DistinguishedName (DN) entries leads to double free, which may result to a denial of service. Since the DN decoding occurs in almost all applications using certificates it is recommended to upgrade the latest GnuTLS version fixing the issue. Impact ====== A remote attacker might be able to remotely crash a vulnerable application by supplying a crafted certificate with a very long DN. References ========== http://www.gnutls.org/security.html#GNUTLS-SA-2015-3 https://access.redhat.com/security/cve/CVE-2015-6251

1 0

[arch-security] [ASA-201508-7] glibc: denial of service
by Remi Gacogne 16 Aug '15

16 Aug '15

Arch Linux Security Advisory ASA-201508-7 ========================================= Severity: Low Date : 2015-08-16 CVE-ID : CVE-2014-8121 Package : glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.22-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.22-1. # pacman -Syu "glibc>=2.22-1" The problem has been fixed upstream in version 2.22. Workaround ========== None. Description =========== It was found that the files backend of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. Impact ====== A remote attacker might be able to force a vulnerable application to enter an infinite loop, thus causing denial of service. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8121 https://sourceware.org/ml/libc-alpha/2015-02/msg00617.html https://bugzilla.redhat.com/show_bug.cgi?id=1165192

1 0