- Arch-security - lists.archlinux.org

[arch-security] [ASA-201502-8] glibc: multiple issues
by Christian Rebischke 09 Feb '15

09 Feb '15

Arch Linux Security Advisory ASA-201502-8 ========================================= Severity: High Date : 2015-02-09 CVE-ID : CVE-2015-1472 CVE-2015-1473 Package : glibc Type : multiple issues Remote : possible (still under investigation) Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.21-1 has multiple issues that could be exploitable. Resolution ========== Upgrade to 2.21-1 # pacman -Syu "glibc>=2.21-1" The problems have been fixed upstream in version 2.21. Workaround ========== None. Description =========== glibc has multiple issues including heap- and stack overflows that could be exploitable. The heap- and stack-overflow is possible in the swscanf function. Impact ====== The issue is still under investigation. It's not clear if the issue is exploitable. In case of 'yes' this could result in various exploits in every software that uses glibc. This includes remote-code-execution or local exploits for gaining root access. References ========== https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2015-1472 https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2015-1473 https://sourceware.org/ml/libc-alpha/2015-02/msg00119.html

1 0

[arch-security] [ASA-201502-7] ntp: multiple issues
by Levente Polyak 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-7 ========================================= Severity: Medium Date : 2015-02-06 CVE-ID : CVE-2014-9297 CVE-2014-9298 Package : ntp Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ntp before version 4.2.8.p1-1 is vulnerable to multiple issues including information disclosure, denial of service and configuration restriction bypass. Resolution ========== Upgrade to 4.2.8.p1-1. # pacman -Syu "ntp>=4.2.8.p1-1" The problems have been fixed upstream in version 4.2.8.p1. Workaround ========== - CVE-2014-9297 Disable Autokey Authentication by removing, or commenting out, all configuration directives beginning with the crypto keyword in your ntp.conf file. - CVE-2014-9298 Install firewall rules to block packets claiming to come from ::1 from inappropriate network interfaces. Description =========== - CVE-2014-9297 (information disclosure, denial of service) The vallen packet value is not validated in several code paths in ntp_crypto.c which can lead to information leakage or a possible crash. - CVE-2014-9298 (access restriction bypass) While available kernels will prevent 127.0.0.1 addresses from "appearing" on non-localhost IPv4 interfaces, some kernels do not offer the same protection for ::1 source addresses on IPv6 interfaces. Since NTP's access control is based on source address and localhost addresses generally have no restrictions, an attacker can send malicious control and configuration packets by spoofing ::1 addresses from the outside. Impact ====== A remote attacker is able to send specially crafted packets to perform information disclosure, denial of service or bypass the configuration restriction by claiming to come from ::1. References ========== http://support.ntp.org/bin/view/Main/SecurityNotice#1_can_be_spoofed_on_som… http://support.ntp.org/bin/view/Main/SecurityNotice#vallen_is_not_validated… https://access.redhat.com/security/cve/CVE-2014-9297 https://access.redhat.com/security/cve/CVE-2014-9298

1 0

[arch-security] [ASA-201502-6] clamav: arbitrary code execution
by Levente Polyak 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-6 ========================================= Severity: Critical Date : 2015-02-06 CVE-ID : CVE-2014-9328 Package : clamav Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package clamav before version 0.98.6-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.98.6-1. # pacman -Syu "clamav>=0.98.6-1" The problems have been fixed upstream in version 0.98.6. Workaround ========== None. Description =========== Sebastian Andrzej Siewior discovered that ClamAV incorrectly handled certain upack packer files. An attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. Impact ====== A remote attacker is able to craft special upack packer files leading to denial of service or possibly arbitrary code execution. References ========== http://lists.clamav.net/pipermail/clamav-announce/2015/000010.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9328

1 0

[arch-security] [ASA-201502-5] chromium: multiple issues
by Remi Gacogne 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-5 ========================================= Severity: High Date : 2015-02-06 CVE-ID : CVE-2015-1209 CVE-2015-1210 CVE-2015-1211 CVE-2015-1212 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 40.0.2214.111-1 is vulnerable to multiple issues, including but not limited to privilege escalation, cross-origin bypass and arbitrary code execution. Resolution ========== Upgrade to 40.0.2214.111-1. # pacman -Syu "chromium>=40.0.2214.111-1" The problem has been fixed upstream in version 40.0.2214.111. Workaround ========== None. Description =========== - CVE-2015-1209 (use-after-free) Use-after-free in DOM, possibly leading to arbitrary code execution. Credit to Maksymillian Motyl. - CVE-2015-1210 (cross-origin bypass) Cross-origin-bypass in V8 bindings allows an attacker to bypass the same-origin policy. - CVE-2015-1211 (privilege escalation) Privilege escalation using service workers. - CVE-2015-1212 Various fixes from internal audits, fuzzing and other initiatives, fixing unspecified vulnerabilities not disclosed by upstream. Impact ====== A remote attacker is able to bypass the same-origin policy, escalate privileges or execute arbitrary code. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1209 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1210 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1211 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1212 http://googlechromereleases.blogspot.fr/2015/02/stable-channel-update.html

1 0

[arch-security] [ASA-201502-4] postgresql: multiple issues
by Remi Gacogne 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-4 ========================================= Severity: High Date : 2015-02-06 CVE-ID : CVE-2014-8161 CVE-2015-0241 CVE-2015-0243 CVE-2015-0244 Package : postgresql Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package postgresql before version 9.4.1-1 is vulnerable to multiple issues, including information leak, denial of service, privilege escalation and command injection. Resolution ========== Upgrade to 9.4.1-1. # pacman -Syu "postgresql>=9.4.1-1" The problem has been fixed upstream in version 9.4.1. Workaround ========== None. Description =========== - CVE-2014-8161 (information leak) Some server error messages show the values of columns that violate a constraint, such as a unique constraint. If the user does not have SELECT privilege on all columns of the table, this could mean exposing values that the user should not be able to see. Adjust the code so that values are displayed only when they came from the SQL command or could be selected by the user. - CVE-2015-0241 (denial of service, privilege escalation) When to_char() processes a numeric formatting template calling for a large number of digits, PostgreSQL would read past the end of a buffer. When processing a crafted timestamp formatting template, PostgreSQL would write past the end of a buffer. Either case could crash the server. We have not ruled out the possibility of attacks that lead to privilege escalation, though they seem unlikely. - CVE-2015-0243 (denial of service, privilege escalation) Errors in memory size tracking within the pgcrypto module permitted stack buffer overruns and improper dependence on the contents of uninitialized memory. The buffer overrun cases can crash the server, and we have not ruled out the possibility of attacks that lead to privilege escalation. - CVE-2015-0244 (command injection) If any error occurred while the server was in the middle of reading a protocol message from the client, it could lose synchronization and incorrectly try to interpret part of the message's data as a new protocol message. An attacker able to submit crafted binary data within a command parameter might succeed in injecting his own SQL commands this way. Statement timeout and query cancellation are the most likely sources of errors triggering this scenario. Particularly vulnerable are applications that use a timeout and also submit arbitrary user-crafted data as binary query parameters. Disabling statement timeout will reduce, but not eliminate, the risk of exploit. Our thanks to Emil Lenngren for reporting this issue. Impact ====== A remote, authenticated attacker might be able to get access to sensitive information, escalate privileges or cause a denial of service by crashing the server. A remote attacker could inject arbitrary SQL command by submitting crafted binary data within a command parameter. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8161 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0241 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0243 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0244 http://www.postgresql.org/docs/9.4/static/release-9-4-1.html

1 0

[arch-security] [ASA-201502-3] mantisbt: multiple issues
by Levente Polyak 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-3 ========================================= Severity: High Date : 2015-02-06 CVE-ID : CVE-2014-9571 CVE-2014-9572 CVE-2014-9573 CVE-2014-9624 CVE-2015-1042 Package : mantisbt Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mantisbt before version 1.2.19-1 is vulnerable to multiple issues including cross-side scripting, database credential disclosure, sql injection, captcha bypass and url redirection. Resolution ========== Upgrade to 1.2.19-1. # pacman -Syu "mantisbt>=1.2.19-1" The problems have been fixed upstream in version 1.2.19. Workaround ========== None. Description =========== - CVE-2014-9571 (cross-side scripting) Cross-site scripting (XSS) vulnerability in admin/install.php allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter. - CVE-2014-9572 (information disclosure) It was discovered that mantisbt does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4. - CVE-2014-9573 (sql injection) SQL injection vulnerability in manage_user_page.php allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie. - CVE-2014-9624 (captcha bypass) An attacker can get an unlimited amount of CAPTCHA "samples" with different perturbations for the same challenge, which makes the whole captcha utterly useless and very easy to bypass. - CVE-2015-1042 (url redirection) A bug in the URL sanitization routine allows an attacker to craft an URL that can redirect outside of the MantisBT instance's domain. This is related to CVE-2014-6316 [1], and the same API function is affected by the same vulnerability, but the root cause is different. Impact ====== A remote attacker is able to perform cross-side scripting, obtain database credentials, execute arbitrary SQL commands when having administrator privileges, bypass captchas or craft an URL that redirects to any domain. References ========== https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=1… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9571 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9572 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9573 https://access.redhat.com/security/cve/CVE-2014-9624 https://access.redhat.com/security/cve/CVE-2015-1042

1 0

[arch-security] [ASA-201502-2] flashplugin: remote code execution
by Remi Gacogne 06 Feb '15

06 Feb '15

Arch Linux Security Advisory ASA-201502-2 ========================================= Severity: Critical Date : 2015-02-06 CVE-ID : CVE-2015-0313 CVE-2015-0314 CVE-2015-0315 CVE-2015-0316 CVE-2015-0317 CVE-2015-0318 CVE-2015-0319 CVE-2015-0320 CVE-2015-0321 CVE-2015-0322 CVE-2015-0323 CVE-2015-0324 CVE-2015-0325 CVE-2015-0326 CVE-2015-0327 CVE-2015-0328 CVE-2015-0329 CVE-2015-0330 Package : flashplugin Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.442-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 11.2.202.442-1. # pacman -Syu "flashplugin>=11.2.202.442-1" The problem has been fixed upstream in version 11.2.202.442. Workaround ========== None. Description =========== - CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, CVE-2015-0322 Use-after-free vulnerabilities leading to arbitrary code execution. - (CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, CVE-2015-0330 Memory corruption vulnerabilities leading to arbitrary code execution. - CVE-2015-0317, CVE-2015-0319 Type confusion vulnerabilities leading to arbitrary code execution. - CVE-2015-0323, CVE-2015-0327 Heap overflow vulnerabilities leading to arbitrary code execution. - CVE-2015-0324 Buffer overflow vulnerability leading to arbitrary code execution. - CVE-2015-0325, CVE-2015-0326, CVE-2015-0328 Null-pointer dereference issues, possibly leading to denial of service or other unspecified impact. Impact ====== A remote attacker can execute arbitrary code. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0313 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0314 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0315 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0316 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0317 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0318 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0319 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0320 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0321 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0322 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0323 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0324 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0325 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0326 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0327 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0328 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0329 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0330 https://helpx.adobe.com/security/products/flash-player/apsb15-04.html

1 0

[arch-security] [ASA-201502-1] privoxy: denial of service
by Levente Polyak 03 Feb '15

03 Feb '15

Arch Linux Security Advisory ASA-201502-1 ========================================= Severity: Medium Date : 2015-02-03 CVE-ID : CVE-2015-1380 CVE-2015-1381 CVE-2015-1382 Package : privoxy Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package privoxy before version 3.0.23-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.0.23-1. # pacman -Syu "privoxy>=3.0.23-1" The problems have been fixed upstream in version 3.0.23. Workaround ========== None. Description =========== - CVE-2015-1380 (denial of service) Denial of service issue was found in case of client requests with incorrect chunk-encoded body. When compiled with assertions enabled (the default) they could previously cause Privoxy to abort(). - CVE-2015-1381 (segmentation fault) Multiple segmentation faults and memory leaks were found in the pcrs code. This fix also increases the chances that an invalid pcrs command is rejected as such. Previously some invalid commands would be loaded without error. Note that privoxy's pcrs sources (action and filter files) are considered trustworthy input and should not be writable by untrusted third-parties. - CVE-2015-1382 (denial of service) A 'invalid read' bug was found which could at least theoretically cause privoxy to crash. Impact ====== A remote attacker is able to perform a denial of service attack via crafted requests or a segmentation fault via invalid pcrs commands. References ========== http://seclists.org/oss-sec/2015/q1/285 https://access.redhat.com/security/cve/CVE-2015-1380 https://access.redhat.com/security/cve/CVE-2015-1381 https://access.redhat.com/security/cve/CVE-2015-1382

1 0

[arch-security] [ASA-201501-24] patch: multiple issues
by Levente Polyak 28 Jan '15

28 Jan '15

Arch Linux Security Advisory ASA-201501-24 ========================================== Severity: Medium Date : 2015-01-28 CVE-ID : CVE-2015-1196 CVE-2014-9637 Package : patch Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package patch before version 2.7.3-1 is vulnerable to directory traversal and denial of service via memory consumption. Resolution ========== Upgrade to 2.7.3-1. # pacman -Syu "patch>=2.7.3-1" The problems have been fixed upstream in version 2.7.3. Workaround ========== None. Description =========== - CVE-2015-1196 (directory traversal) A directory traversal flaw was discovered that allows remote attackers to write to arbitrary files via a symlink attack in a patch file. This could allow an attacker to overwrite arbitrary files by applying a specially crafted patch, with the privileges of the user running patch. - CVE-2014-9637 (denial of service) It was reported that a crafted patch file can consume all available memory and later segfault resulting in denial of service. Impact ====== A remote attacker is able to write to arbitrary files via a symlink attack or consume all available memory via a crafted patch file leading to denial of service. References ========== http://seclists.org/oss-sec/2015/q1/173 http://seclists.org/oss-sec/2015/q1/218 https://savannah.gnu.org/bugs/?44051 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1196 https://access.redhat.com/security/cve/CVE-2014-9637

1 0

[arch-security] [ASA-201501-23] jasper: arbitrary code execution
by Levente Polyak 27 Jan '15

27 Jan '15

Arch Linux Security Advisory ASA-201501-23 ========================================== Severity: Critical Date : 2015-01-27 CVE-ID : CVE-2014-8157 CVE-2014-8158 Package : jasper Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jasper before version 1.900.1-13 is vulnerable to heap and stack based buffer overflows leading to arbitrary code execution. Resolution ========== Upgrade to 1.900.1-13. # pacman -Syu "jasper>=1.900.1-13" The problems have not been fixed upstream but patches were applied. Workaround ========== None. Description =========== - CVE-2014-8157 (arbitrary code execution) Off-by-one error in the jpc_dec_process_sot function allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow. - CVE-2014-8158 (arbitrary code execution) Multiple stack-based buffer overflows in jpc_qmfb.c allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image. Impact ====== A remote attacker is able to create a specially crafted JPEG 2000 image that is leading to arbitrary code execution. References ========== https://www.ocert.org/advisories/ocert-2015-001.html https://bugs.archlinux.org/task/43592 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8157 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8158

1 0