- Arch-security - lists.archlinux.org

[arch-security] [ASA-201505-15] nbd: denial of service
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-15 ========================================== Severity: Low Date : 2015-05-26 CVE-ID : CVE-2015-0847 Package : nbd Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nbd before version 3.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.11-1. # pacman -Syu "nbd>=3.11-1" The problem has been fixed upstream in version 3.11. Workaround ========== None. Description =========== Signal handlers themselves were entered only once, but they called posixly unsafe, non-reentrant functions, such as syslog(). If a signal was caught in the middle of the execution of such function, consequences were undefined. In practice, nbd-server was observed to deadlock during the execution of sigchld_handler(). Impact ====== A remote attacker is able to send requests to the nbd server that may lead to a deadlock resulting in denial of service. References ========== http://sourceforge.net/p/nbd/mailman/message/34091218/ https://access.redhat.com/security/cve/CVE-2015-0847 https://github.com/yoe/nbd/commit/412def

1 0

[arch-security] [ASA-201505-14] chromium: multiple issues
by Levente Polyak 21 May '15

21 May '15

Arch Linux Security Advisory ASA-201505-14 ========================================== Severity: Critical Date : 2015-05-21 CVE-ID : CVE-2015-1251 CVE-2015-1252 CVE-2015-1253 CVE-2015-1254 CVE-2015-1255 CVE-2015-1256 CVE-2015-1257 CVE-2015-1258 CVE-2015-1259 CVE-2015-1260 CVE-2015-1263 CVE-2015-1264 CVE-2015-1265 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 43.0.2357.65-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox protection bypass, same origin policy bypass, denial of service, cross side scripting and man-in-the-middle. Resolution ========== Upgrade to 43.0.2357.65-1. # pacman -Syu "chromium>=43.0.2357.65-1" The problems have been fixed upstream in version 43.0.2357.65. Workaround ========== None. Description =========== - CVE-2015-1251 (arbitrary code execution) Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem allows remote attackers to execute arbitrary code via a crafted document. - CVE-2015-1252 (sandbox protection bypass) It has been discovered that common/partial_circular_buffer.cc does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. - CVE-2015-1253 (same origin policy bypass) It has been discovered that core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions. - CVE-2015-1254 (same origin policy bypass) It has been discovered that core/dom/Document.cpp in Blink enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing. - CVE-2015-1255 (denial of service) Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track. - CVE-2015-1256 (denial of service) Use-after-free vulnerability in the SVG implementation in Blink allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element. - CVE-2015-1257 (denial of service) It has been discovered that platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document. - CVE-2015-1258 (denial of service) Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data. - CVE-2015-1259 (denial of service) PDFium does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. - CVE-2015-1260 (denial of service) Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request. - CVE-2015-1263 (man-in-the-middle) The Spellcheck API implementation does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file. - CVE-2015-1264 (cross side scripting) Cross-site scripting (XSS) vulnerability allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature. - CVE-2015-1265 (denial of service) Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Impact ====== A remote attacker is able to execute arbitrary code, bypass the sandbox protection mechanism, bypass the same origin policy, perform cross side scripting, perform a denial of service attack or possibly have unspecified other impact via various vectors. References ========== http://googlechromereleases.blogspot.fr/2015/05/stable-channel-update_19.ht… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1251 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1252 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1253 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1254 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1255 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1256 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1257 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1258 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1259 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1260 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1263 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1264 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1265

1 0

[arch-security] Fw: Django security release issued (1.8.2)
by Markus Holtermann 21 May '15

21 May '15

Today the Django team issued Django 1.8.2 as part of our security process. This releases address a security issue, and we encourage all users to upgrade as soon as possible. More details can be found on our blog: https://www.djangoproject.com/weblog/2015/may/20/security-release/ As a reminder, we ask that potential security issues be reported via private email to security(a)djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see https://www.djangoproject.com/security for further information. --

2 1

[arch-security] [ASA-201505-13] thunderbird: multiple issues
by Remi Gacogne 18 May '15

18 May '15

Arch Linux Security Advisory ASA-201505-13 ========================================== Severity: Critical Date : 2015-05-18 CVE-ID : CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2713 CVE-2015-2716 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 31.7.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 31.7.0-1. # pacman -Syu "thunderbird>=31.7.0-1" The problem has been fixed upstream in version 31.7.0. Workaround ========== CVE-2015-2708, CVE-2015-2709, CVE-2015-2710 and CVE-2015-2716 cannot be exploited through email in the Thunderbird product because scripting is disabled, but are potentially a risk in browser or browser-like contexts. There is no workaround for CVE-2015-2713. Description =========== - CVE-2015-2708 (Memory safety bugs fixed in Firefox ESR 31.7 and Firefox 38): Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported memory safety problems and crashes that affect Firefox ESR 31.6 and Firefox 37. - CVE-2015-2709 (Memory safety bugs fixed in Firefox 38): Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety problems and crashes that affect Firefox 37. - CVE-2015-2710 (Buffer overflow with SVG content and CSS): Using the Address Sanitizer tool, security researcher Atte Kettunen found a buffer overflow during the rendering of SVG format graphics when combined with specific CSS properties on a page. This results in a potentially exploitable crash. - CVE-2015-2713 (Use-after-free during text processing with vertical text enabled): Security researcher Scott Bell used the Address Sanitizer tool to discover a use-after-free error during the processing of text when vertical text is enabled. This leads to a potentially exploitable crash. - CVE-2015-2716 (Buffer overflow when parsing compressed XML): Security researcher Ucha Gobejishvili used the Address Sanitizer tool to find a buffer overflow while parsing compressed XML content. This was due to an error in how buffer space is created and modified when handling large amounts of XML data. This results in a potentially exploitable crash. Impact ====== A remote attacker can execute arbitrary code with the privileges of the current user. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2708 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2709 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2710 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2713 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716

1 0

[arch-security] [ASA-201505-12] wireshark-gtk: denial of service
by Levente Polyak 15 May '15

15 May '15

Arch Linux Security Advisory ASA-201505-12 ========================================== Severity: Medium Date : 2015-05-15 CVE-ID : CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811 CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815 Package : wireshark-gtk Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-gtk before version 1.12.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.12.5-1. # pacman -Syu "wireshark-gtk>=1.12.5-1" The problems have been fixed upstream in version 1.12.5. Workaround ========== None. Description =========== - CVE-2015-3808 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3809 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3810 (denial of service) The Websocket dissector recurses to dissect more data. Since the minimum valid websocket frame length is two bytes, this allows for quite some recursion. With a minimal IP and TCP header (20 bytes each), you can get 32747 recursions which is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3811 (denial of service) The WCP dissector could crash while decompressing data. The compression format is basically saying "these n bytes are the same as these other n bytes you've already seen at offset X" except we haven't processed X bytes yet so we're not validating that offset and are getting uninitialized bytes leading to a crash when injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3812 (denial of service) It has been discovered that the X11 dissector could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3813 (denial of service) It has been discovered that the packet reassembly code could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3814 (denial of service) It has been discovered that the IEEE 802.11 dissector could go into an infinite loop under certain circumstances. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3815 (denial of service) It has been discovered that the Android Logcat file parser could crash under certain circumstances. This issue is leading to denial of service by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able to perform a denial of service attack by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file via various vectors. References ========== https://wireshark.org/docs/relnotes/wireshark-1.12.5.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815

1 0

[arch-security] [ASA-201505-11] wireshark-qt: denial of service
by Levente Polyak 15 May '15

15 May '15

Arch Linux Security Advisory ASA-201505-11 ========================================== Severity: Medium Date : 2015-05-15 CVE-ID : CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811 CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815 Package : wireshark-qt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-qt before version 1.12.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.12.5-1. # pacman -Syu "wireshark-qt>=1.12.5-1" The problems have been fixed upstream in version 1.12.5. Workaround ========== None. Description =========== - CVE-2015-3808 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3809 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3810 (denial of service) The Websocket dissector recurses to dissect more data. Since the minimum valid websocket frame length is two bytes, this allows for quite some recursion. With a minimal IP and TCP header (20 bytes each), you can get 32747 recursions which is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3811 (denial of service) The WCP dissector could crash while decompressing data. The compression format is basically saying "these n bytes are the same as these other n bytes you've already seen at offset X" except we haven't processed X bytes yet so we're not validating that offset and are getting uninitialized bytes leading to a crash when injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3812 (denial of service) It has been discovered that the X11 dissector could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3813 (denial of service) It has been discovered that the packet reassembly code could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3814 (denial of service) It has been discovered that the IEEE 802.11 dissector could go into an infinite loop under certain circumstances. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3815 (denial of service) It has been discovered that the Android Logcat file parser could crash under certain circumstances. This issue is leading to denial of service by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able to perform a denial of service attack by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file via various vectors. References ========== https://wireshark.org/docs/relnotes/wireshark-1.12.5.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815

1 0

[arch-security] [ASA-201505-10] wireshark-cli: denial of service
by Levente Polyak 15 May '15

15 May '15

Arch Linux Security Advisory ASA-201505-10 ========================================== Severity: Medium Date : 2015-05-15 CVE-ID : CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3811 CVE-2015-3812 CVE-2015-3813 CVE-2015-3814 CVE-2015-3815 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-cli before version 1.12.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.12.5-1. # pacman -Syu "wireshark-cli>=1.12.5-1" The problems have been fixed upstream in version 1.12.5. Workaround ========== None. Description =========== - CVE-2015-3808 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3809 (denial of service) There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3810 (denial of service) The Websocket dissector recurses to dissect more data. Since the minimum valid websocket frame length is two bytes, this allows for quite some recursion. With a minimal IP and TCP header (20 bytes each), you can get 32747 recursions which is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3811 (denial of service) The WCP dissector could crash while decompressing data. The compression format is basically saying "these n bytes are the same as these other n bytes you've already seen at offset X" except we haven't processed X bytes yet so we're not validating that offset and are getting uninitialized bytes leading to a crash when injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3812 (denial of service) It has been discovered that the X11 dissector could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3813 (denial of service) It has been discovered that the packet reassembly code could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3814 (denial of service) It has been discovered that the IEEE 802.11 dissector could go into an infinite loop under certain circumstances. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2015-3815 (denial of service) It has been discovered that the Android Logcat file parser could crash under certain circumstances. This issue is leading to denial of service by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able to perform a denial of service attack by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file via various vectors. References ========== https://wireshark.org/docs/relnotes/wireshark-1.12.5.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3808 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3809 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3810 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3811 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3812 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3813 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3814 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3815

1 0

[arch-security] [ASA-201505-9] qemu: arbitrary code execution
by Levente Polyak 14 May '15

14 May '15

Arch Linux Security Advisory ASA-201505-9 ========================================= Severity: Critical Date : 2015-05-14 CVE-ID : CVE-2015-3456 Package : qemu Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qemu before version 2.2.1-5 is vulnerable to arbitrary code execution in the context of the host’s hypervisor process. Resolution ========== Upgrade to 2.2.1-5. # pacman -Syu "qemu>=2.2.1-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The guest operating system communicates with the FDC by sending commands such as seek, read, write, format, etc. to the FDC’s input/output port. QEMU’s virtual FDC uses a fixed-size buffer for storing these commands and their associated data parameters. The FDC keeps track of how much data to expect for each command and, after all expected data for a given command is received from the guest system, the FDC executes the command and clears the buffer for the next command. This buffer reset is performed immediately at the completion of processing for all FDC commands, except for two of the defined commands. An attacker can send these commands and specially crafted parameter data from the guest system to the FDC to overflow the data buffer and execute arbitrary code in the context of the host’s hypervisor process. Impact ====== A remote attacker is able to send FDC commands and specially crafted parameter data from the guest system to overflow the data buffer and execute arbitrary code in the context of the host’s hypervisor process. References ========== https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3456 https://github.com/qemu/qemu/commit/e90774626 https://bugs.archlinux.org/task/44954

1 0

[arch-security] QEMU venom vulnerability
by Mark Lee 14 May '15

14 May '15

To All, After the disclosure of the venom vulnerability in QEMU today; I'm wondering if the Arch version of qemu is vulnerable. The disclosure indicated that distros have been notified since 4/30/2015. Regards, Mark

3 5

[arch-security] [ASA-201505-8] tomcat6: denial of service
by Remi Gacogne 13 May '15

13 May '15

Arch Linux Security Advisory ASA-201505-8 ========================================= Severity: Low Date : 2015-05-13 CVE-ID : CVE-2014-0230 Package : tomcat6 Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tomcat6 before version 6.0.44-1 is vulnerable to remote denial of service. Resolution ========== Upgrade to 6.0.44-1. # pacman -Syu "tomcat6>=6.0.44-1" The problem has been fixed upstream in version 6.0.44. Workaround ========== None. Description =========== When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited Denial of Service as Tomcat would never close the connection and a processing thread would remain allocated to the connection. Impact ====== A remote attacker can cause a denial of service by preventing a large number of connections from being closed. References ========== https://access.redhat.com/security/cve/CVE-2014-0230 https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44

1 0