- Arch-security - lists.archlinux.org

[arch-security] [ASA-201502-1] privoxy: denial of service
by Levente Polyak 03 Feb '15

03 Feb '15

Arch Linux Security Advisory ASA-201502-1 ========================================= Severity: Medium Date : 2015-02-03 CVE-ID : CVE-2015-1380 CVE-2015-1381 CVE-2015-1382 Package : privoxy Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package privoxy before version 3.0.23-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.0.23-1. # pacman -Syu "privoxy>=3.0.23-1" The problems have been fixed upstream in version 3.0.23. Workaround ========== None. Description =========== - CVE-2015-1380 (denial of service) Denial of service issue was found in case of client requests with incorrect chunk-encoded body. When compiled with assertions enabled (the default) they could previously cause Privoxy to abort(). - CVE-2015-1381 (segmentation fault) Multiple segmentation faults and memory leaks were found in the pcrs code. This fix also increases the chances that an invalid pcrs command is rejected as such. Previously some invalid commands would be loaded without error. Note that privoxy's pcrs sources (action and filter files) are considered trustworthy input and should not be writable by untrusted third-parties. - CVE-2015-1382 (denial of service) A 'invalid read' bug was found which could at least theoretically cause privoxy to crash. Impact ====== A remote attacker is able to perform a denial of service attack via crafted requests or a segmentation fault via invalid pcrs commands. References ========== http://seclists.org/oss-sec/2015/q1/285 https://access.redhat.com/security/cve/CVE-2015-1380 https://access.redhat.com/security/cve/CVE-2015-1381 https://access.redhat.com/security/cve/CVE-2015-1382

1 0

[arch-security] [ASA-201501-24] patch: multiple issues
by Levente Polyak 28 Jan '15

28 Jan '15

Arch Linux Security Advisory ASA-201501-24 ========================================== Severity: Medium Date : 2015-01-28 CVE-ID : CVE-2015-1196 CVE-2014-9637 Package : patch Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package patch before version 2.7.3-1 is vulnerable to directory traversal and denial of service via memory consumption. Resolution ========== Upgrade to 2.7.3-1. # pacman -Syu "patch>=2.7.3-1" The problems have been fixed upstream in version 2.7.3. Workaround ========== None. Description =========== - CVE-2015-1196 (directory traversal) A directory traversal flaw was discovered that allows remote attackers to write to arbitrary files via a symlink attack in a patch file. This could allow an attacker to overwrite arbitrary files by applying a specially crafted patch, with the privileges of the user running patch. - CVE-2014-9637 (denial of service) It was reported that a crafted patch file can consume all available memory and later segfault resulting in denial of service. Impact ====== A remote attacker is able to write to arbitrary files via a symlink attack or consume all available memory via a crafted patch file leading to denial of service. References ========== http://seclists.org/oss-sec/2015/q1/173 http://seclists.org/oss-sec/2015/q1/218 https://savannah.gnu.org/bugs/?44051 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1196 https://access.redhat.com/security/cve/CVE-2014-9637

1 0

[arch-security] [ASA-201501-23] jasper: arbitrary code execution
by Levente Polyak 28 Jan '15

28 Jan '15

Arch Linux Security Advisory ASA-201501-23 ========================================== Severity: Critical Date : 2015-01-27 CVE-ID : CVE-2014-8157 CVE-2014-8158 Package : jasper Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jasper before version 1.900.1-13 is vulnerable to heap and stack based buffer overflows leading to arbitrary code execution. Resolution ========== Upgrade to 1.900.1-13. # pacman -Syu "jasper>=1.900.1-13" The problems have not been fixed upstream but patches were applied. Workaround ========== None. Description =========== - CVE-2014-8157 (arbitrary code execution) Off-by-one error in the jpc_dec_process_sot function allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow. - CVE-2014-8158 (arbitrary code execution) Multiple stack-based buffer overflows in jpc_qmfb.c allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image. Impact ====== A remote attacker is able to create a specially crafted JPEG 2000 image that is leading to arbitrary code execution. References ========== https://www.ocert.org/advisories/ocert-2015-001.html https://bugs.archlinux.org/task/43592 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8157 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8158

1 0

[arch-security] CVE-2015-0235 "ghost"
by Remi Gacogne 27 Jan '15

27 Jan '15

Hello, A critical vulnerability has been found in glibc [1] in the form of a heap buffer overflow in the gethostbyname() and gethostbyname2() calls. It may allow a remote attacker to execute arbitrary code. Arch Linux does not seem vulnerable because we use a recent glibc version, which includes a patch [2] for this issue. This seems confirmed by the test case included with the fix [3]. [1] https://sourceware.org/bugzilla/show_bug.cgi?id=15014 [2] https://sourceware.org/git/?p=glibc.git;a=commit;h=d5dd6189d506068ed11c8bfa… [3] https://sourceware.org/git/?p=glibc.git;a=blob;f=nss/test-digits-dots.c;h=1… https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-0235

1 0

[arch-security] [ASA-201501-22] flashplugin: multiple issues
by chris.rebischke＠gmail.com 27 Jan '15

27 Jan '15

Arch Linux Security Advisory ASA-201501-22 ========================================== Severity: Critical Date : 2015-01-23 CVE-ID : CVE-2015-0311 CVE-2015-0301 CVE-2015-0302 CVE-2015-0303 CVE-2015-0304 CVE-2015-0305 CVE-2015-0306 CVE-2015-0307 CVE-2015-0308 CVE-2015-0309 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.440-1 is vulnerable to multiple issues including remote code execution, denial of service, keylogging and memory leaks. Resolution ========== Upgrade to 11.2.202.440-1. # pacman -Syu "flashplugin>=11.2.202.440-1" The problems have been fixed upstream in version 11.2.202.440. Workaround ========== None. Description =========== - CVE-2015-0311 (remote code execution) Unspecified vulnerability allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015. - CVE-2015-0309 (remote code execution) Heap-based buffer overflow allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0304. - CVE-2015-0308 (remote code execution) Use-after-free vulnerability allows attackers to execute arbitrary code via unspecified vectors. - CVE-2015-0307 (memory leaks, denial of service) A vulnerability allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors. - CVE-2015-0306 (remote code execution, denial of service) A vulnerability allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0303. - CVE-2015-0305 (remote code execution) A vulnerability allows attackers to execute arbitrary code by leveraging an unspecified "type confusion". - CVE-2015-0304 (remote code execution) Heap-based buffer overflow allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0309. - CVE-2015-0303 (remote code execution, denial of service) A vulnerability allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0306. - CVE-2015-0302 (keylogging) A vulnerability allows attackers to obtain sensitive keystroke information via unspecified vectors. - CVE-2015-0301 (file validation) The flashplugin does not properly validate files, which has unspecified impact and attack vectors. Impact ====== A remote attacker is able to perform remote code execution, keylogging, denial of service and resource consumption through memory leaks. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-01.html http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-f… http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0311 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0309 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0308 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0307 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0306 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0305 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0304 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0303 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0302 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0301

1 0

[arch-security] [ASA-201501-21] chromium: multiple issues
by Levente Polyak 25 Jan '15

25 Jan '15

Arch Linux Security Advisory ASA-201501-21 ========================================== Severity: High Date : 2015-01-25 CVE-ID : CVE-2014-7923 CVE-2014-7924 CVE-2014-7925 CVE-2014-7926 CVE-2014-7927 CVE-2014-7928 CVE-2014-7930 CVE-2014-7931 CVE-2014-7929 CVE-2014-7932 CVE-2014-7933 CVE-2014-7934 CVE-2014-7935 CVE-2014-7936 CVE-2014-7937 CVE-2014-7938 CVE-2014-7939 CVE-2014-7940 CVE-2014-7941 CVE-2014-7942 CVE-2014-7943 CVE-2014-7944 CVE-2014-7945 CVE-2014-7946 CVE-2014-7947 CVE-2014-7948 CVE-2015-1205 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 40.0.2214.91-1 is vulnerable to multiple issues including bug not limited to denial of service, same-origin bypass or possibly have unspecified other impact. Resolution ========== Upgrade to 40.0.2214.91-1. # pacman -Syu "chromium>=40.0.2214.91-1" The problems have been fixed upstream in version 40.0.2214.91. Workaround ========== None. Description =========== - CVE-2014-7923 (memory corruption) The Regular Expressions package in International Components for Unicode (ICU) 52, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a (1) zero-length quantifier or (2) look-behind expression. - CVE-2014-7924 (use-after-free) Use-after-free vulnerability in the IndexedDB implementation allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering duplicate BLOB references. - CVE-2014-7925 (use-after-free) Use-after-free vulnerability in the WebAudio implementation in Blink allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an audio-rendering thread in which AudioNode data is improperly maintained. - CVE-2014-7926 (memory corruption) The Regular Expressions package in International Components for Unicode (ICU) 52 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors related to a (1) zero-length quantifier or (2) look-behind expression, a different vulnerability than CVE-2014-7923. - CVE-2014-7927 (memory corruption) The SimplifiedLowering::DoLoadBuffer function in compiler/simplified-lowering.cc in Google V8 does not properly choose an integer data type, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code. - CVE-2014-7928 (memory corruption) hydrogen.cc in Google V8 does not properly handle arrays with holes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code that triggers an array copy. - CVE-2014-7930 (use-after-free) Use-after-free vulnerability in core/events/TreeScopeEventContext.cpp in the DOM implementation in Blink allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data. - CVE-2014-7931 (memory corruption) factory.cc in Google V8 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of backing-store pointers. - CVE-2014-7929 (use-after-free) Use-after-free vulnerability in the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp in the DOM implementation in Blink allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving movement of a SCRIPT element across documents. - CVE-2014-7932 (use-after-free) Use-after-free vulnerability in the Element::detach function in core/dom/Element.cpp in the DOM implementation in Blink allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving pending updates of detached elements. - CVE-2014-7933 (use-after-free) Use-after-free vulnerability in the matroska_read_seek function in libavformat/matroskadec.c in FFmpeg before 2.5.1 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska file that triggers improper maintenance of tracks data. - CVE-2014-7934 (use-after-free) Use-after-free vulnerability in the DOM implementation in Blink allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to unexpected absence of document data structures. - CVE-2014-7935 (use-after-free) Use-after-free vulnerability in browser/speech/tts_message_filter.cc in the Speech implementation allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab. - CVE-2014-7936 (use-after-free) Use-after-free vulnerability in the ZoomBubbleView::Close function in browser/ui/views/location_bar/zoom_bubble_view.cc in the Views implementation allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that triggers improper maintenance of a zoom bubble. - CVE-2014-7937 (use-after-free) Multiple off-by-one errors in libavcodec/vorbisdec.c in FFmpeg before 2.4.2 allow remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Vorbis I data. - CVE-2014-7938 (memory corruption) The Fonts implementation allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors. - CVE-2014-7939 (same-origin bypass) When the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header. - CVE-2014-7940 (uninitialized-value) The collator implementation in i18n/ucol.cpp in International Components for Unicode (ICU) 52 does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted character sequence. - CVE-2014-7941 (out-of-bounds read) The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation uses an incorrect data type for a certain length value, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted X11 data. - CVE-2014-7942 (uninitialized-value) The Fonts implementation does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. - CVE-2014-7943 (out-of-bounds read) Skia allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. - CVE-2014-7944 (out-of-bounds read) The sycc422_to_rgb function in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium does not properly handle odd values of image width, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document. - CVE-2014-7945 (out-of-bounds read) OpenJPEG before r2908, as used in PDFium, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document, related to j2k.c, jp2.c, and t2.c. - CVE-2014-7946 (out-of-bounds read) The RenderTable::simplifiedNormalFlowLayout function in core/rendering/RenderTable.cpp in Blink skips captions during table layout in certain situations, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors related to the Fonts implementation. - CVE-2014-7947 (out-of-bounds read) OpenJPEG before r2944, as used in PDFium, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document, related to j2k.c, jp2.c, pi.c, t1.c, t2.c, and tcd.c. - CVE-2014-7948 (caching error) The AppCacheUpdateJob::URLFetcher::OnResponseStarted function in content/browser/appcache/appcache_update_job.cc proceeds with AppCache caching for SSL sessions even if there is an X.509 certificate error, which allows man-in-the-middle attackers to spoof HTML5 application content via a crafted certificate. - CVE-2015-1205 (denial of service) Multiple unspecified vulnerabilities allow attackers to cause a denial-of-service or possibly have other impact via unknown vectors. Impact ====== A remote attacker is able to perform denial of service, bypass the same-origin policy or possibly have unspecified other impact. References ========== http://googlechromereleases.blogspot.fr/2015/01/stable-update.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7923 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7924 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7925 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7926 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7927 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7928 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7930 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7931 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7929 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7932 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7933 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7934 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7935 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7936 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7937 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7938 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7939 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7940 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7941 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7942 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7943 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7944 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7945 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7946 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7947 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7948 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1205

1 0

[arch-security] [ASA-201501-20] jre7-openjdk-headless: multiple issues
by Levente Polyak 23 Jan '15

23 Jan '15

Arch Linux Security Advisory ASA-201501-20 ========================================== Severity: Critical Date : 2015-01-23 CVE-ID : CVE-2014-3566 CVE-2014-6587 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0403 CVE-2015-0406 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 CVE-2015-0413 Package : jre7-openjdk-headless Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk-headless before version 7.u75_2.5.4-1 is vulnerable to multiple issues including bug not limited to arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle. Resolution ========== Upgrade to 7.u75_2.5.4-1. # pacman -Syu "jre7-openjdk-headless>=7.u75_2.5.4-1" The problems have been fixed upstream in version 7.u75. Workaround ========== None. Description =========== - CVE-2014-3566 (man-in-the-middle) Nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. - CVE-2014-6587 (privilege escalation) MulticastSocket NULL pointer dereference allows local users to affect confidentiality, integrity, and availability. - CVE-2014-6593 (man-in-the-middle) Incorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows remote attackers to affect confidentiality and integrity. - CVE-2014-6601 (arbitrary code execution) Class verifier insufficient invokespecial calls verification related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0383 (denial of service) Insecure hsperfdata temporary file handling related to Hotspot allows local users to affect integrity and availability. - CVE-2015-0395 (arbitrary code execution) Phantom references handling issue in garbage collector related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0400 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of Java SE accessible data. - CVE-2015-0403 (arbitrary code execution) Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. - CVE-2015-0406 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of accessible data and ability to cause a partial denial of service. - CVE-2015-0407 (information disclosure) Directory information leak via file chooser related to Swing allows remote attackers to affect confidentiality. - CVE-2015-0408 (arbitrary code execution) Incorrect context class loader use in RMI transport allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0410 (denial of service) DER decoder infinite loop allows remote attackers to affect availability. - CVE-2015-0412 (arbitrary code execution) Insufficient code privileges checks related to JAX-WS allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0413 (unauthorized modification) Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE accessible data. Impact ====== A remote attacker is able to perform arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle via various vulnerabilities. References ========== http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6549 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6587 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6593 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6601 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0383 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0395 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0400 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0403 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0406 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0407 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0408 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0410 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0412 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0413

1 0

[arch-security] [ASA-201501-19] jre7-openjdk: multiple issues
by Levente Polyak 23 Jan '15

23 Jan '15

Arch Linux Security Advisory ASA-201501-19 ========================================== Severity: Critical Date : 2015-01-23 CVE-ID : CVE-2014-3566 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0403 CVE-2015-0406 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 CVE-2015-0413 Package : jre7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre7-openjdk before version 7.u75_2.5.4-1 is vulnerable to multiple issues including bug not limited to arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle. Resolution ========== Upgrade to 7.u75_2.5.4-1. # pacman -Syu "jre7-openjdk>=7.u75_2.5.4-1" The problems have been fixed upstream in version 7.u75. Workaround ========== None. Description =========== - CVE-2014-3566 (man-in-the-middle) Nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. - CVE-2014-6585 (out-of-bounds read) Allows remote attackers to affect confidentiality via font parsing out-of-bounds read related to 2D. - CVE-2014-6587 (privilege escalation) MulticastSocket NULL pointer dereference allows local users to affect confidentiality, integrity, and availability. - CVE-2014-6591 (out-of-bounds read) Allows remote attackers to affect confidentiality via font parsing out-of-bounds read related to 2D. - CVE-2014-6593 (man-in-the-middle) Incorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows remote attackers to affect confidentiality and integrity. - CVE-2014-6601 (arbitrary code execution) Class verifier insufficient invokespecial calls verification related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0383 (denial of service) Insecure hsperfdata temporary file handling related to Hotspot allows local users to affect integrity and availability. - CVE-2015-0395 (arbitrary code execution) Phantom references handling issue in garbage collector related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0400 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of Java SE accessible data. - CVE-2015-0403 (arbitrary code execution) Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. - CVE-2015-0406 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of accessible data and ability to cause a partial denial of service. - CVE-2015-0407 (information disclosure) Directory information leak via file chooser related to Swing allows remote attackers to affect confidentiality. - CVE-2015-0408 (arbitrary code execution) Incorrect context class loader use in RMI transport allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0410 (denial of service) DER decoder infinite loop allows remote attackers to affect availability. - CVE-2015-0412 (arbitrary code execution) Insufficient code privileges checks related to JAX-WS allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0413 (unauthorized modification) Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE accessible data. - CVE-2015-0421 (arbitrary code execution) Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. - CVE-2015-0437 (arbitrary code execution) Code generation issue related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. Impact ====== A remote attacker is able to perform arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle via various vulnerabilities. References ========== http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6585 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6587 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6591 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6593 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6601 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0383 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0395 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0400 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0403 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0406 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0407 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0408 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0410 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0412 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0413

1 0

[arch-security] [ASA-201501-18] jdk7-openjdk: multiple issues
by Levente Polyak 23 Jan '15

23 Jan '15

Arch Linux Security Advisory ASA-201501-18 ========================================== Severity: Critical Date : 2015-01-23 CVE-ID : CVE-2014-3566 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0403 CVE-2015-0406 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 CVE-2015-0413 Package : jdk7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk7-openjdk before version 7.u75_2.5.4-1 is vulnerable to multiple issues including bug not limited to arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle. Resolution ========== Upgrade to 7.u75_2.5.4-1. # pacman -Syu "jdk7-openjdk>=7.u75_2.5.4-1" The problems have been fixed upstream in version 7.u75. Workaround ========== None. Description =========== - CVE-2014-3566 (man-in-the-middle) Nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. - CVE-2014-6585 (out-of-bounds read) Allows remote attackers to affect confidentiality via font parsing out-of-bounds read related to 2D. - CVE-2014-6587 (privilege escalation) MulticastSocket NULL pointer dereference allows local users to affect confidentiality, integrity, and availability. - CVE-2014-6591 (out-of-bounds read) Allows remote attackers to affect confidentiality via font parsing out-of-bounds read related to 2D. - CVE-2014-6593 (man-in-the-middle) Incorrect tracking of ChangeCipherSpec during SSL/TLS handshake allows remote attackers to affect confidentiality and integrity. - CVE-2014-6601 (arbitrary code execution) Class verifier insufficient invokespecial calls verification related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0383 (denial of service) Insecure hsperfdata temporary file handling related to Hotspot allows local users to affect integrity and availability. - CVE-2015-0395 (arbitrary code execution) Phantom references handling issue in garbage collector related to Hotspot allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0400 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of Java SE accessible data. - CVE-2015-0403 (arbitrary code execution) Successful attack of this vulnerability can result in unauthorized Operating System takeover including arbitrary code execution. - CVE-2015-0406 (information disclosure) Successful unauthenticated network attacks via multiple protocols can result in unauthorized read access to a subset of accessible data and ability to cause a partial denial of service. - CVE-2015-0407 (information disclosure) Directory information leak via file chooser related to Swing allows remote attackers to affect confidentiality. - CVE-2015-0408 (arbitrary code execution) Incorrect context class loader use in RMI transport allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0410 (denial of service) DER decoder infinite loop allows remote attackers to affect availability. - CVE-2015-0412 (arbitrary code execution) Insufficient code privileges checks related to JAX-WS allows remote attackers to affect confidentiality, integrity, and availability. - CVE-2015-0413 (unauthorized modification) Successful attack of this vulnerability can result in unauthorized update, insert or delete access to some Java SE accessible data. Impact ====== A remote attacker is able to perform arbitrary code execution, information disclosure, denial of service, privilege escalation and man-in-the-middle via various vulnerabilities. References ========== http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6585 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6587 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6591 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6593 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6601 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0383 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0395 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0400 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0403 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0406 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0407 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0408 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0410 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0412 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0413

1 0

[arch-security] [ASA-201501-17] php: remote code execution
by Remi Gacogne 23 Jan '15

23 Jan '15

Arch Linux Security Advisory ASA-201501-17 ========================================== Severity: Critical Date : 2015-01-23 CVE-ID : CVE-2014-9427 CVE-2015-0231 CVE-2015-0232 Package : php Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package php before version 5.6.5-1 is vulnerable to arbitrary remote code execution. Resolution ========== Upgrade to 5.6.5-1. # pacman -Syu "php>=5.6.5-1" The problem has been fixed upstream in version 5.6.5. Workaround ========== None. Description =========== - CVE-2014-9427 (information leak, remote code execution) A one-byte file containing only the '#' character, not followed by any newline, causes php-cgi to do an out of bound read, potentially disclosing sensitive information present in memory or even triggering code execution if adjacent memory location contains valid PHP code. - CVE-2015-0231 (remote code execution) A use-after-free vulnerability in unserialize() allows a remote attacker to execute arbitrary code. This vulnerability results from an incomplete fix for CVE-2014-8142. - CVE-2015-0232 (remote code execution) An attempt to free an uninitialized pointer may result in arbitrary code execution while parsing exif information from a carefully crafted file. Impact ====== A remote attacker may be able to execute arbitrary code on the affected host. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9427 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0231 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0232 https://bugs.php.net/bug.php?id=68618 https://bugs.php.net/bug.php?id=68710 https://bugs.php.net/bug.php?id=68799

1 0