- Arch-security - lists.archlinux.org

[arch-security] [ASA-201505-7] firefox: multiple issues
by Remi Gacogne 13 May '15

13 May '15

Arch Linux Security Advisory ASA-201505-7 ========================================= Severity: Critical Date : 2015-05-13 CVE-ID : CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2711 CVE-2015-2712 CVE-2015-2713 CVE-2015-2715 CVE-2015-2716 CVE-2015-2717 CVE-2015-2718 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 38.0-1 is vulnerable to multiple issues including remote code execution. Resolution ========== Upgrade to 38.0-1. # pacman -Syu "firefox>=38.0-1" The problem has been fixed upstream in version 38.0. Workaround ========== None. Description =========== - CVE-2015-2708 (Memory safety bugs fixed in Firefox ESR 31.7 and Firefox 38): Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported memory safety problems and crashes that affect Firefox ESR 31.6 and Firefox 37. - CVE-2015-2709 (Memory safety bugs fixed in Firefox 38): Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety problems and crashes that affect Firefox 37. - CVE-2015-2710 (Buffer overflow with SVG content and CSS): Using the Address Sanitizer tool, security researcher Atte Kettunen found a buffer overflow during the rendering of SVG format graphics when combined with specific CSS properties on a page. This results in a potentially exploitable crash. - CVE-2015-2711 (Referrer policy ignored when links opened by middle-click and context menu): Security researcher Alex Verstak reported that <meta name="referrer"> is ignored when a link is opened through the context menu or a middle-click by mouse. This means that, in some situations, the referrer policy is ignored when opening links in new tabs and may cause some pages to open without an HTTP Referer header being set according to the author's intended policy. - CVE-2015-2712 (Out-of-bounds read and write in asm.js validation): Security researcher Dougall Johnson reported an out-of-bounds read and write in asm.js during JavaScript validation due to an error in how heap lengths are defined. This results in a potentially exploitable crash and could allow for the reading of random memory which may contain sensitive data. - CVE-2015-2713 (Use-after-free during text processing with vertical text enabled): Security researcher Scott Bell used the Address Sanitizer tool to discover a use-after-free error during the processing of text when vertical text is enabled. This leads to a potentially exploitable crash. - CVE-2015-2715 (Use-after-free due to Media Decoder Thread creation during shutdown): Security researchers Tyson Smith and Jesse Schwartzentruber reported a use-after-free during the shutdown process. This was caused by a race condition when media decoder threads are created during the shutdown process in some circumstances. This leads to a potentially exploitable crash when triggered. - CVE-2015-2716 (Buffer overflow when parsing compressed XML): Security researcher Ucha Gobejishvili used the Address Sanitizer tool to find a buffer overflow while parsing compressed XML content. This was due to an error in how buffer space is created and modified when handling large amounts of XML data. This results in a potentially exploitable crash. - CVE-2015-2717 (Buffer overflow and out-of-bounds read while parsing MP4 video metadata): Security researcher laf.intel reported a buffer overflow and out-of-bounds read in the libstagefright library while parsing invalid metadata in MP4 video files. This can lead to a potentially exploitable crash. - CVE-2015-2718 (Untrusted site hosting trusted page can intercept webchannel responses): Mozilla developer Mark Hammond reported a flaw in how WebChannel.jsm handles message traffic. He found that when a trusted page is hosted within an <iframe> on an untrusted third-party untrusted framing page, the untrusted page could intercept webchannel responses meant for the trusted page, bypassing origin restrictions. Impact ====== A remote attacker can execute arbitrary code with the permission of the current firefox user by tricking him into visiting a website. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://access.redhat.com/security/cve/CVE-2015-2708 https://access.redhat.com/security/cve/CVE-2015-2709 https://access.redhat.com/security/cve/CVE-2015-2710 https://access.redhat.com/security/cve/CVE-2015-2711 https://access.redhat.com/security/cve/CVE-2015-2712 https://access.redhat.com/security/cve/CVE-2015-2713 https://access.redhat.com/security/cve/CVE-2015-2715 https://access.redhat.com/security/cve/CVE-2015-2716 https://access.redhat.com/security/cve/CVE-2015-2717 https://access.redhat.com/security/cve/CVE-2015-2718

1 0

[arch-security] [ASA-201505-6] docker: multiple issues
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-6 ========================================= Severity: High Date : 2015-05-08 CVE-ID : CVE-2015-3627 CVE-2015-3629 CVE-2015-3630 CVE-2015-3631 Package : docker Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package docker before version 1:1.6.1-1 is vulnerable to multiple issues including but not limited to privilege escalation, symlink traversal, unauthorized configuration modification, information disclosure and policy profile escalation. Resolution ========== Upgrade to 1:1.6.1-1. # pacman -Syu "docker>=1:1.6.1-1" The problems have been fixed upstream in version 1.6.1. Workaround ========== None. Description =========== - CVE-2015-3627 (privilege escalation) The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal. This allows malicious container images to trigger a local privilege escalation. - CVE-2015-3629 (privilege escalation) Symlink traversal on container respawn allows local privilege escalation. Libcontainer version 1.6.0 introduced changes which facilitated a mount namespace breakout upon respawn of a container. This allowed malicious images to write files to the host system and escape containerization. - CVE-2015-3630 (unauthorized modification) Several paths underneath /proc were writable from containers, allowing global system manipulation and configuration. These paths included /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. By allowing writes to /proc/fs, it has been noted that CIFS volumes could be forced into a protocol downgrade attack by a root user operating inside of a container. Machines having loaded the timer_stats module were vulnerable to having this mechanism enabled and consumed by a container. - CVE-2015-3631 (policy profile escalation) By allowing volumes to override files of /proc within a mount namespace, a user could specify arbitrary policies for Linux Security Modules, including setting an unconfined policy underneath AppArmor, or a docker_t policy for processes managed by SELinux. In all versions of Docker up until 1.6.1, it is possible for malicious images to configure volume mounts such that files of proc may be overridden. Impact ====== A remote attacker is able to escalate privileges via unsafe symlink traversal, modify the configuration of the host system or disclose information via specific writable descriptors in /proc or escalate the LSM policy profiles by overriding files of /proc. References ========== http://seclists.org/oss-sec/2015/q2/389 https://access.redhat.com/security/cve/CVE-2015-3627 https://access.redhat.com/security/cve/CVE-2015-3629 https://access.redhat.com/security/cve/CVE-2015-3630 https://access.redhat.com/security/cve/CVE-2015-3631

1 0

[arch-security] [ASA-201505-5] libtasn1: arbitrary code execution
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-5 ========================================= Severity: Critical Date : 2015-05-08 CVE-ID : CVE-2015-3622 Package : libtasn1 Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libtasn1 before version 4.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.5-1. # pacman -Syu "libtasn1>=4.5-1" The problem has been fixed upstream in version 4.5. Workaround ========== None. Description =========== A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded input. A specially crafted, DER-encoded input could cause an application using libtasn1 to perform an invalid read, causing the application to crash or, possibly, execute arbitrary code. The heap overflow happens in the function _asn1_extract_der_octet() that is called during decoding of DER-encoded input. Impact ====== A remote attacker is able to use a specially crafted certificate that is leading to arbitrary code execution during decoding. References ========== http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=f979435 https://access.redhat.com/security/cve/CVE-2015-3622

1 0

[arch-security] [ASA-201505-4] mariadb-clients: denial of service
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-4 ========================================= Severity: Medium Date : 2015-05-08 CVE-ID : CVE-2014-8964 Package : mariadb-clients Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mariadb-clients before version 10.0.18-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.0.18-1. # pacman -Syu "mariadb-clients>=10.0.18-1" The problems have been fixed upstream in version 10.0.18. Workaround ========== None. Description =========== A heap-based buffer overflow was found in the way PCRE handled certain malformed regular expressions. This issue could cause a crash while parsing malicious regular expressions related to an assertion that allows zero repeats. Impact ====== A remote attacker is able to cause an application crash leading to denial of service via malicious regular expressions. References ========== https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8964

1 0

[arch-security] [ASA-201505-3] mariadb: denial of service
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-3 ========================================= Severity: Medium Date : 2015-05-08 CVE-ID : CVE-2014-8964 CVE-2015-0499 CVE-2015-0501 CVE-2015-0505 CVE-2015-2571 Package : mariadb Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mariadb before version 10.0.18-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.0.18-1. # pacman -Syu "mariadb>=10.0.18-1" The problems have been fixed upstream in version 10.0.18. Workaround ========== None. Description =========== - CVE-2014-8964 (denial of service) A heap-based buffer overflow was found in the way PCRE handled certain malformed regular expressions. This issue could cause a crash while parsing malicious regular expressions related to an assertion that allows zero repeats. - CVE-2015-0499 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : Federated. - CVE-2015-0501 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling. - CVE-2015-0505 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : DDL. - CVE-2015-2571 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. Impact ====== A remote authenticated attacker is able to cause a server crash leading to denial of service via malicious regular expressions and various unspecified vectors. References ========== https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8964 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0499 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0501 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0505 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2571

1 0

[arch-security] [ASA-201505-2] clamav: multiple issues
by Levente Polyak 03 May '15

03 May '15

Arch Linux Security Advisory ASA-201505-2 ========================================= Severity: Medium Date : 2015-05-03 CVE-ID : CVE-2015-2170 CVE-2015-2221 CVE-2015-2222 CVE-2015-2305 CVE-2015-2668 Package : clamav Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package clamav before version 0.98.7-1 is vulnerable to denial of service and under certain circumstances on 32-bit platforms possibly arbitrary code execution. Resolution ========== Upgrade to 0.98.7-1. # pacman -Syu "clamav>=0.98.7-1" The problems have been fixed upstream in version 0.98.7. Workaround ========== None. Description =========== - CVE-2015-2170 (denial of service) A flaw has been found in the UPX decoder with crafted files. During unpacking there are two range checks which are implemented "manually". Those checks lack the detection of overflows which are considered by the CLI_ISCONTAINED() macro. - CVE-2015-2221 (denial of service) Y0da cryptor / protector is a PE file encryptor - the executable file is decrypted on start up. Clamav is able to decrypt such files in order to scan them. As part of the decryptor there is an op code emulator. A special crafted file may contain a jump op code to a position that already has been interpreted - which leads to an endless loop. This leads to an endless loop in clamav itself. - CVE-2015-2222 (denial of service) Petite is a tool for compressing PE files on windows. Clamav is a virus scanning tool which is able to unpack such files during scanning. Once the file has been identified as "petite" compressed before the decompressing process is started it is possible that a specially crafted file tells clamav to read more data than it allocated memory. On glibc it leads to SIGABRT on free() since glibc's malloc() recognizes this. - CVE-2015-2305 (arbitrary code execution) An upstream patch for possible heap overflow in Henry Spencer's regex library has been applied. The flaw is within an integer overflow in the regcomp implementation in the Henry Spencer regex library on 32-bit platforms, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow. - CVE-2015-2668 (denial of service) A flaw has been discovered that is leading to an infinite loop condition on a crafted "xz" archive file. Impact ====== A remote attacker is able to use specially crafted files that are leading to denial of service when scanned by Clamav. Additionally it may be possible to execute arbitrary code on 32-bit platforms under certain circumstances. References ========== http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html https://access.redhat.com/security/cve/CVE-2015-2170 https://access.redhat.com/security/cve/CVE-2015-2221 https://access.redhat.com/security/cve/CVE-2015-2222 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2305 https://access.redhat.com/security/cve/CVE-2015-2668

1 0

[arch-security] [ASA-201505-1] squid: weak certificate validation
by Levente Polyak 01 May '15

01 May '15

Arch Linux Security Advisory ASA-201505-1 ========================================= Severity: High Date : 2015-05-01 CVE-ID : CVE-2015-3455 Package : squid Type : weak certificate validation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package squid before version 3.5.4-1 is vulnerable to weak certificate validation. Resolution ========== Upgrade to 3.5.4-1. # pacman -Syu "squid>=3.5.4-1" The problem has been fixed upstream in version 3.5.4. Workaround ========== Upgrade the squid.conf settings to use a "ssl_bump peek" operation before the "bump" operation. NOTE that this workaround does not resolve the vulnerability, but allow Squid to relay (or mimic) the invalid certificate to clients and depends on validation in the client. Alternatively remove from squid.conf (and include'd files) any ssl_bump directives. Description =========== The flaw allows remote servers to bypass client certificate validation. Some attackers may also be able to use valid certificates for one domain signed by a global Certificate Authority to abuse an unrelated domain. However, the bug is exploitable only if you have configured Squid to perform SSL Bumping with the "client-first" or "bump" mode of operation. Sites that do not use SSL-Bump are not vulnerable. Impact ====== A remote attacker is able to bypass client certificate validation, as a result malicious server responses can wrongly be presented through the proxy to clients as secure authenticated HTTPS responses. References ========== http://www.squid-cache.org/Advisories/SQUID-2015_1.txt http://www.openwall.com/lists/oss-security/2015/04/30/2 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3455

1 0

[arch-security] [ASA-201504-32] perl-xml-libxml: XML External Entity
by Christian Rebischke 30 Apr '15

30 Apr '15

Arch Linux Security Advisory ASA-201504-32 ========================================= Severity: low Date : 2015-04-30 CVE-ID : CVE-2015-3451 Package : perl-xml-libxml Type : XML External Entity Remote : yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package perl-xml-libxml before version 2.0119-1 is vulnerable to a XML-External-Entity-Vulnerability. Resolution ========== Upgrade to 2.0119-1 # pacman -Syu "perl-xml-libxml>=2.0119-1" The problem has been fixed upstream in version 2.0119. Workaround ========== None. Description =========== Unpreserved unset options after a _clone() call (e.g: in load_xml()) leads to not preserved expand_entities. Therefore it leads to a XML-External-Entity Vulnerability. Impact ====== This vulnerability may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts. References ========== http://www.openwall.com/lists/oss-security/2015/04/30/1 https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94… http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes

1 0

[arch-security] [ASA-201504-31] dovecot: denial of service
by Remi Gacogne 29 Apr '15

29 Apr '15

Arch Linux Security Advisory ASA-201504-31 ========================================== Severity: Low Date : 2015-04-29 CVE-ID : CVE-2015-3420 Package : dovecot Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package dovecot before version 2.2.16-2 is vulnerable to a remote denial of service. Resolution ========== Upgrade to 2.2.16-2. # pacman -Syu "dovecot>=2.2.16-2" The problem has been fixed upstream but no new version has been released yet. Workaround ========== None. Description =========== Dovecot <= 2.2.14 does not correctly handle SSL/TLS handshake failure in the login process, asking OpenSSL to flush a connection that has already been aborted. This results in a crash with some versions of OpenSSL (most likely >= 1.0.2). A patch to OpenSSL has also been written to handle more gracefully this situation, see references. Impact ====== A remote unauthenticated attacker can cause a denial of service by constantly connecting to Dovecot then causing a SSL/TLS handshake failure. References ========== https://access.redhat.com/security/cve/CVE-2015-3420 https://bugs.archlinux.org/task/44757 http://seclists.org/oss-sec/2015/q2/288 http://dovecot.org/pipermail/dovecot/2015-April/100618.html https://rt.openssl.org/Ticket/Display.html?id=3818&user=guest&pass=guest

1 0

[arch-security] [ASA-201504-30] chromium: multiple issues
by Remi Gacogne 29 Apr '15

29 Apr '15

Arch Linux Security Advisory ASA-201504-30 ========================================== Severity: High Date : 2015-04-29 CVE-ID : CVE-2015-1243 CVE-2015-1250 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 42.0.2311.135-1 is vulnerable to multiple issues, including but not limited to a use-after-free. Resolution ========== Upgrade to 42.0.2311.135-1. # pacman -Syu "chromium>=42.0.2311.135-1" The problem has been fixed upstream in version 42.0.2311.135. Workaround ========== None. Description =========== - CVE-2015-1243 (use-after-free): Use-after-free in DOM. Credit to Saif El-Sherei. - CVE-2015-1250: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== Google has not disclosed any information regarding the issues fixed in this release. Four of them (CVE-2015-1243 and three more covered by CVE-2015-1250) are classified as "high", while the remaining issue covered by CVE-2015-125 is classified as medium. References ========== http://googlechromereleases.blogspot.fr/2015/04/stable-channel-update_28.ht… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1243 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1250

1 0