- Arch-security - lists.archlinux.org

[arch-security] [ASA-201412-21] glibc: arbitrary code execution
by Levente Polyak 19 Dec '14

19 Dec '14

Arch Linux Security Advisory ASA-201412-21 ========================================== Severity: High Date : 2014-12-18 CVE-ID : CVE-2012-3406 CVE-2014-9402 Package : glibc lib32-glibc Type : arbitrary code execution, denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The packages glibc and lib32-glibc before version 2.20-5 are vulnerable to arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.20-5. # pacman -Syu "glibc>=2.20-5" # pacman -Syu "lib32-glibc>=2.20-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2012-3406 (arbitrary code execution) The vfprintf function in stdio-common/vfprintf.c in GNU C Library does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers. - CVE-2014-9402 (denial of service) The nss_dns getnetbyname function will enter an infinite loop if the DNS backend is activated in the system Name Service Switch configuration and the DNS resolver receives a positive answer while processing the network name. Impact ====== An attacker is able to perform a denial of service attack or execute arbitrary code via crafted format strings. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3406 https://access.redhat.com/security/cve/CVE-2014-9402 https://sourceware.org/bugzilla/show_bug.cgi?id=17630 http://www.openwall.com/lists/oss-security/2014/12/18/1

1 0

[arch-security] Privelege escalation via Wheel + PolKit
by Mark Lee 17 Dec '14

17 Dec '14

To all, This was just posted on oss-security; I figure it's a good read. https://www.alertlogic.com/blog/dont-let-grinch-steal-christmas/ Regards, Mark

1 1

[arch-security] [ASA-201412-20] unrtf: arbitrary code execution
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-20 ========================================== Severity: High Date : 2014-12-16 CVE-ID : CVE-2014-9274 CVE-2014-9275 Package : unrtf Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package unrtf before version 0.21.7-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.21.7-1. # pacman -Syu "unrtf>=0.21.7-1" The problems have been fixed upstream in version 0.21.7. Workaround ========== None. Description =========== - CVE-2014-9274 (arbitrary code execution) A flaw allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by a file containing the string "{\cb-999999999". - CVE-2014-9275 (arbitrary code execution) A flaw allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file. Impact ====== An attacker able to craft a RTF file could use those issues to cause a crash or execute arbitrary code while accessing a pointer that may be under the attacker's control. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9274 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9275 https://bugzilla.redhat.com/show_bug.cgi?id=1170233 http://seclists.org/oss-sec/2014/q4/904 https://bugs.archlinux.org/task/43131

1 0

[arch-security] [ASA-201412-19] dokuwiki: cross-site scripting
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-19 ========================================== Severity: Medium Date : 2014-12-16 CVE-ID : CVE-2014-9253 Package : dokuwiki Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package dokuwiki before version 20140929_b-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 20140929_b-1. # pacman -Syu "dokuwiki>=20140929_b-1" The problem has been fixed upstream in version 20140929_b. Workaround ========== None. Description =========== It was discovered that dokuwiki did not sufficiently filter uploaded files. A remote attacker with upload access is able to use this flaw in order to upload SWF files leading to possible cross-site scripting. Impact ====== A remote attacker with upload access is able to craft a SWF file to perform a cross-site scripting attack. References ========== https://access.redhat.com/security/cve/CVE-2014-9253 http://seclists.org/oss-sec/2014/q4/1050 https://www.dokuwiki.org/changes#release_2014-09-29b_hrun https://github.com/splitbrain/dokuwiki/commit/778ddf

1 0

[arch-security] [ASA-201412-18] nss: signature forgery
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-18 ========================================== Severity: High Date : 2014-12-16 CVE-ID : CVE-2014-1569 Package : nss Type : signature forgery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package nss before version 3.17.3-1 is vulnerable to signature forgery. Resolution ========== Upgrade to 3.17.3-1. # pacman -Syu "nss>=3.17.3-1" The problem has been fixed upstream in version 3.17.3. Workaround ========== None. Description =========== The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00. This update also adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails. This can prevent a forceful downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566, also known as POODLE. SSL 3.0 support has also been disabled by default in this Firefox and Thunderbird update, further mitigating POODLE. Impact ====== A remote attacker is able to smuggle arbitrary data into an ASN.1 object in order to forge certificates that are considered trusted. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1569 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_re… https://hg.mozilla.org/projects/nss/rev/e9a7991380db https://bugzilla.mozilla.org/show_bug.cgi?id=1064670 https://bugs.archlinux.org/task/42760

1 0

[arch-security] [ASA-201412-17] subversion: denial of service
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-17 ========================================== Severity: Medium Date : 2014-12-16 CVE-ID : CVE-2014-3580 CVE-2014-8108 Package : subversion Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package subversion before version 1.8.11-1 is vulnerable to denial of service in mod_dav_svn through multiple remotely triggerable crashes. Resolution ========== Upgrade to 1.8.11-1. # pacman -Syu "subversion>=1.8.11-1" The problems have been fixed upstream in version 1.8.11. Workaround ========== None. Description =========== - CVE-2014-3580 (denial of service) A NULL pointer dereference flaw was found in the way mod_dav_svn handled REPORT requests. A remote, unauthenticated attacker could use a crafted REPORT request to crash mod_dav_svn. - CVE-2014-8108 (denial of service) A NULL pointer dereference flaw was found in the way mod_dav_svn handled URIs for virtual transaction names. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. Impact ====== A remote attacker is able to send specially crafted requests causing mod_dav_svn to crash leading to denial of service. References ========== https://subversion.apache.org/security/CVE-2014-3580-advisory.txt https://subversion.apache.org/security/CVE-2014-8108-advisory.txt https://access.redhat.com/security/cve/CVE-2014-3580 https://access.redhat.com/security/cve/CVE-2014-8108

1 0

[arch-security] [ASA-201412-16] docker: multiple issues
by Levente Polyak 15 Dec '14

15 Dec '14

Arch Linux Security Advisory ASA-201412-16 ========================================== Severity: Medium Date : 2014-12-15 CVE-ID : CVE-2014-9356 CVE-2014-9357 CVE-2014-9358 Package : docker Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package docker before version 1:1.4.0-1 is vulnerable to multiple issues including but not limited to privilege escalation and path traversal. Resolution ========== Upgrade to 1:1.4.0-1. # pacman -Syu "docker>=1:1.4.0-1" The problems have been fixed upstream in version 1.4.0. Workaround ========== None. Description =========== - CVE-2014-9356 (path traversal) Path traversal attacks are possible in the processing of absolute symlinks. In checking symlinks for traversals, only relative links were considered. This allowed path traversals to exist where they should have otherwise been prevented. This was exploitable via both archive extraction and through volume mounts. This vulnerability allowed malicious images or builds from malicious Dockerfiles to write files to the host system and escape containerization, leading to privilege escalation. - CVE-2014-9357 (privilege escalation) It has been discovered that the introduction of chroot for archive extraction in Docker 1.3.2 had introduced a privilege escalation vulnerability. Malicious images or builds from malicious Dockerfiles could escalate privileges and execute arbitrary code as a privileged root user on the Docker host by providing a malicious ‘xz’ binary. - CVE-2014-9358 (path traversal) It has been discovered that Docker does not sufficiently validate Image IDs as provided either via 'docker load' or through registry communications. This allows for path traversal attacks, causing graph corruption and manipulation by malicious images, as well as repository spoofing attacks. Impact ====== A local attacker is able to create malicious Dockerfiles or image IDs in order to perform privilege escalation or path traversal. References ========== http://www.securityfocus.com/archive/1/534215 https://access.redhat.com/security/cve/CVE-2014-9356 https://access.redhat.com/security/cve/CVE-2014-9357 https://access.redhat.com/security/cve/CVE-2014-9358

1 0

[arch-security] [ASA-201412-15] python2: multiple issues
by Levente Polyak 15 Dec '14

15 Dec '14

Arch Linux Security Advisory ASA-201412-15 ========================================== Severity: Medium Date : 2014-12-15 CVE-ID : CVE-2013-1752 CVE-2013-1753 CVE-2014-9365 Package : python2 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package python2 before version 2.7.9-1 is vulnerable to denial of service and man-in-the-middle attacks. Resolution ========== Upgrade to 2.7.9-1. # pacman -Syu "python2>=2.7.9-1" The problems have been fixed upstream in version 2.7.9. Workaround ========== None. Description =========== - CVE-2013-1752 (denial of service) Multiple unbound readline() flaws in python stdlib were found, which can lead to excessive memory usage if a malicious or broken server sends excessively long lines without any line breaks. - CVE-2013-1753 (denial of service) The XMLRPC library is vulnerable to unrestricted decompression of HTTP responses using gzip enconding. A malicious server can send a specially prepared HTTP request that can result in memory exhaustion. - CVE-2014-9365 (man-in-the-middle) When Python's standard library HTTP clients (httplib, urllib, urllib2, xmlrpclib) are used to access resources with HTTPS, by default the certificate is not checked against any trust store, nor is the hostname in the certificate checked against the requested host. It was possible to configure a trust root to be checked against, however there were no faculties for hostname checking. This made MITM attacks against the HTTP clients trivial, and violated RFC 2818. Impact ====== An remote attacker is able to perform a man-in-the-middle attack or cause a denial of service. References ========== https://hg.python.org/cpython/raw-file/v2.7.9/Misc/NEWS https://access.redhat.com/security/cve/CVE-2013-1752 https://access.redhat.com/security/cve/CVE-2013-1753 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9365 https://bugs.python.org/issue16041 https://bugs.python.org/issue16042 https://bugs.python.org/issue16043 https://bugs.python.org/issue22417

1 0

[arch-security] [ASA-201412-14] xorg-server: multiple issues
by Levente Polyak 12 Dec '14

12 Dec '14

Arch Linux Security Advisory ASA-201412-14 ========================================== Severity: Critical Date : 2014-12-12 CVE-ID : CVE-2014-8091 CVE-2014-8092 CVE-2014-8093 CVE-2014-8094 CVE-2014-8095 CVE-2014-8096 CVE-2014-8097 CVE-2014-8098 CVE-2014-8099 CVE-2014-8100 CVE-2014-8101 CVE-2014-8102 CVE-2014-8103 Package : xorg-server Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package xorg-server before version 1.16.2.901-1 is vulnerable to multiple issues including but not limited to denial of service and possibly arbitrary code execution. Resolution ========== Upgrade to 1.16.2.901-1. # pacman -Syu "xorg-server>=1.16.2.901-1" The problems have been fixed upstream in version 1.16.2.901. Workaround ========== None. Description =========== - CVE-2014-8091 (denial of service) X.Org X Window System, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return value of a malloc call, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a crafted connection request. - CVE-2014-8092 (arbitrary code execution) A flaw allow remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted request to various affected functions, which triggers an out-of-bounds read or write. - CVE-2014-8093 (arbitrary code execution) Multiple integer overflows allow remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted request to various affected functions, which triggers an out-of-bounds read or write. - CVE-2014-8094 (arbitrary code execution) Integer overflow in the ProcDRI2GetBuffers function in the DRI2 extension allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted request, which triggers an out-of-bounds read or write. - CVE-2014-8095 (arbitrary code execution) The XInput extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8096 (arbitrary code execution) The SProcXCMiscGetXIDList function in the XC-MISC extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value. - CVE-2014-8097 (arbitrary code execution) The DBE extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8098 (arbitrary code execution) The GLX extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8099 (arbitrary code execution) The XVideo extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected function. - CVE-2014-8100 (arbitrary code execution) The Render extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8101 (arbitrary code execution) The RandR extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8102 (arbitrary code execution) The SProcXFixesSelectSelectionInput function in the XFixes extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length value. - CVE-2014-8103 (arbitrary code execution) A flaw allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions in the DRI3 or Present extension. Impact ====== An authenticated attacker, either locally or remotely, is able to cause a denial of service or possibly execute arbitrary code via crafted calls to various affected functions. References ========== http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/ http://lists.x.org/archives/xorg-announce/2014-December/002501.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8091 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8092 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8093 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8094 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8095 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8096 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8097 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8098 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8099 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8100 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8101 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8102 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8103

1 0

[arch-security] [ASA-201412-13] flashplugin: multiple issues
by Levente Polyak 12 Dec '14

12 Dec '14

Arch Linux Security Advisory ASA-201412-13 ========================================== Severity: Critical Date : 2014-12-12 CVE-ID : CVE-2014-0580 CVE-2014-0587 CVE-2014-8443 CVE-2014-9163 CVE-2014-9164 CVE-2014-9162 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package flashplugin before version 11.2.202.425-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, information disclosure and policy bypass. Resolution ========== Upgrade to 11.2.202.425-1. # pacman -Syu "flashplugin>=11.2.202.425-1" The problems have been fixed upstream in version 11.2.202.425. Workaround ========== None. Description =========== - CVE-2014-0580 (policy bypass) A flaw allows remote attackers to bypass the same origin policy via unspecified vectors. - CVE-2014-0587 (arbitrary code execution) A flaw allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. - CVE-2014-8443 (arbitrary code execution) A flaw allows attackers to execute arbitrary code via a use-after-free vulnerability. - CVE-2014-9163 (arbitrary code execution) A flaw allows attackers to execute arbitrary code via a stack-based buffer overflow vulnerability. - CVE-2014-9164 (arbitrary code execution) A flaw allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. - CVE-2014-9162 (information disclosure) A flaw allows attackers to obtain sensitive information via unspecified vectors. Impact ====== A remote attacker is able to execute arbitrary code, bypass the same origin policy, obtain sensitive information or crash the plugin via various unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb14-27.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0580 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0587 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8443 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9162 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9163 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9164

1 0