- Arch-security - lists.archlinux.org

[arch-security] [Arch Linux Security Advisory ASA-201412-2] openvpn: denial of service
by Levente Polyak 02 Dec '14

02 Dec '14

Arch Linux Security Advisory ASA-201412-2 ========================================= Severity: High Date : 2014-12-02 CVE-ID : CVE-2014-8104 Package : openvpn Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package openvpn before version 2.3.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.3.6-1. # pacman -Syu "openvpn>=2.3.6-1" The problem has been fixed upstream [0] in version 2.3.6. Workaround ========== None. Description =========== It was discovered that an authenticated client could trigger an ASSERT() in OpenVPN by sending a too-short control channel packet to the server. This could cause the OpenVPN server to crash and deny access to the VPN to other legitimate users. Impact ====== A remote authenticated attacker could send specially crafted packets that could cause the OpenVPN server to crash leading to denial of service of other legitimate users. References ========== [0] https://github.com/OpenVPN/openvpn/commit/c5590a https://access.redhat.com/security/cve/CVE-2014-8104 https://forums.openvpn.net/topic17625.html https://bugs.archlinux.org/task/42975

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-1] gnupg: denial of service
by Remi Gacogne 01 Dec '14

01 Dec '14

Arch Linux Security Advisory ASA-201412-1 ========================================= Severity: Medium Date : 2014-12-01 CVE-ID : CVE-2014-9087 Package : gnupg Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package gnupg before version 2.1.0-6 is vulnerable to the same denial of service issue than the one in libska (ASA-201411-31), as they share the same code. Resolution ========== Upgrade to 2.1.0-6. # pacman -Syu "gnupg>=2.1.0-6" The problem has been fixed upstream but no new version has been released yet for the 2.1.x branch. Workaround ========== None. Description =========== By using special crafted S/MIME messages or ECC based OpenPGP data, it is possible to create a buffer overflow. The bug is not easy to exploit because there only 80 possible values which can be used to overwrite memory. However, a denial of service is possible and someone may come up with other clever attacks. Thus this should be fix. Background: Hanno Böck found an invalid memory access in the 2.1 branch of GnuPG by conveying a malformed OID as part of an ECC key. It turned out that this bug has also been in libksba ever since and affects at least gpgsm and dirmngr. The code to convert an OID to its string representation has an obvious error of not considering an invalid encoding for arc-2. A first byte of 0x80 can be used to make a value of less then 80 and we then subtract 80 from it as required by the OID encoding rules. Due to the use of an unsigned integer this results in a pretty long value which won't fit anymore into the allocated buffer. Impact ====== A remote attacker can cause a denial of service by sending a specially crafted S/MIME message or ECC based OpenPGP data. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9087 http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html http://seclists.org/oss-sec/2014/q4/801 https://bugs.archlinux.org/task/42943

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-33] libjpeg-turbo: denial of service
by Remi Gacogne 28 Nov '14

28 Nov '14

Arch Linux Security Advisory ASA-201411-33 ========================================== Severity: Medium Date : 2014-11-28 CVE-ID : CVE-2014-9092 Package : libjpeg-turbo Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package libjpeg-turbo before version 1.3.1-3 is vulnerable to denial of service. Resolution ========== Upgrade to 1.3.1-3. # pacman -Syu "libjpeg-turbo>=1.3.1-3" The problem has been fixed upstream but a new version has not been released yet. Workaround ========== None. Description =========== Special crafted jpeg files lead to stack smashing and lead to at least a dos (maybe remote due to imagick). The Huffman encoder's local buffer can be overrun when a buffered destination manager is being used and an extremely-high-frequency block (basically junk image data) is being encoded. Even though the Huffman local buffer was increased from 128 bytes to 136 bytes to address the previous issue, the new issue caused even the larger buffer to be overrun. Further analysis reveals that, in the absolute worst case (such as setting alternating AC coefficients to 32767 and -32768 in the JPEG scanning order), the Huffman encoder can produce encoded blocks that approach double the size of the unencoded blocks. Thus, the Huffman local buffer was increased to 256 bytes, which should prevent any such issue from re-occurring in the future. Impact ====== An attacker can cause a denial of service or other unspecified impact by supplying a specially crafted JPEG file. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9092 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768369 http://sourceforge.net/p/libjpeg-turbo/code/1427/ https://bugs.archlinux.org/task/42922

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-32] icecast: information leak
by Remi Gacogne 28 Nov '14

28 Nov '14

Arch Linux Security Advisory ASA-201411-32 ========================================== Severity: Critical Date : 2014-11-28 CVE-ID : CVE-2014-9018 Package : icecast Type : information leak Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package icecast before version 2.4.1-1 is vulnerable to information leak. Resolution ========== Upgrade to 2.4.1-1. # pacman -Syu "icecast>=2.4.1-1" The problem has been fixed upstream in version 2.4.1. Workaround ========== Disable on-connect and on-disconnect scripts. Description =========== It was reported that Icecast could possibly leak the contents of on-connect scripts to clients, which may contain sensitive information. If on-connect/on-disconnect scripts are used, file descriptors of the server process remain open and could be written to or read from. Most pressing STDIN, STDOUT, STDERR are handled. Further all file descriptors up to 1024 are closed. There is a remaining (much lower) risk in combination of either a malicious or susceptible script and FDs above 1024. Impact ====== A remote attacker may be able to extract sensitive information from the process memory, including but not limited to passwords. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9018 http://icecast.org/news/icecast-release-2_4_1/ https://trac.xiph.org/ticket/2087 https://bugs.archlinux.org/task/42912 http://seclists.org/oss-sec/2014/q4/716

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-31] libksba: denial of service
by Remi Gacogne 28 Nov '14

28 Nov '14

Arch Linux Security Advisory ASA-201411-31 ========================================== Severity: Medium Date : 2014-11-28 CVE-ID : CVE-2014-9087 Package : libksba Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package libksba before version 1.3.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.3.2-1. # pacman -Syu "libksba>=1.3.2-1" The problem has been fixed upstream in version 1.3.2. Workaround ========== None. Description =========== By using special crafted S/MIME messages or ECC based OpenPGP data, it is possible to create a buffer overflow. The bug is not easy to exploit because there only 80 possible values which can be used to overwrite memory. However, a denial of service is possible and someone may come up with other clever attacks. Thus this should be fix. Background: Hanno Böck found an invalid memory access in the 2.1 branch of GnuPG by conveying a malformed OID as part of an ECC key. It turned out that this bug has also been in libksba ever since and affects at least gpgsm and dirmngr. The code to convert an OID to its string representation has an obvious error of not considering an invalid encoding for arc-2. A first byte of 0x80 can be used to make a value of less then 80 and we then subtract 80 from it as required by the OID encoding rules. Due to the use of an unsigned integer this results in a pretty long value which won't fit anymore into the allocated buffer. Impact ====== A remote attacker can cause a denial of service by sending a specially crafted S/MIME message or ECC based OpenPGP data. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9087 http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html http://seclists.org/oss-sec/2014/q4/801

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-30] flac: arbitrary code execution
by Remi Gacogne 26 Nov '14

26 Nov '14

Arch Linux Security Advisory ASA-201411-30 ========================================== Severity: High Date : 2014-11-26 CVE-ID : CVE-2014-8962 CVE-2014-9028 Package : flac Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package flac before version 1.3.0-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.3.0-5. # pacman -Syu "flac>=1.3.0-5" The problem has been fixed upstream in version 1.3.1-pre1. Workaround ========== None. Description =========== A stack overflow and a heap overflow condition have been found in libFLAC when parsing a maliciously crafted .flac file, which may result in arbitrary code execution. Impact ====== An attacker can execute arbitrary code by supplying a specially crafted .flac file to the libFLAC decoder. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8962 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9028 http://www.ocert.org/advisories/ocert-2014-008.html https://bugs.archlinux.org/task/42898

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-29] pcre: heap buffer overflow
by Remi Gacogne 26 Nov '14

26 Nov '14

Arch Linux Security Advisory ASA-201411-29 ========================================== Severity: Low Date : 2014-11-26 CVE-ID : CVE-2014-8964 Package : pcre Type : heap buffer overflow Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package pcre before version 8.36-2 is vulnerable to denial of service via a heap buffer overlow. Resolution ========== Upgrade to 8.36-2. # pacman -Syu "pcre>=8.36-2" The problem has been fixed upstream but no version released yet. Workaround ========== None. Description =========== A heap buffer overflow issue was found in PCRE when processing a specially crafted regular expression, causing a denial of service or other unspecified impact. Impact ====== An attacker able to supply a specially crafted regular expression can cause a denial of service, or other unspecified impact. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8964 http://bugs.exim.org/show_bug.cgi?id=1546 https://bugs.archlinux.org/task/42860

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-28] dbus: denial of service
by Levente Polyak 23 Nov '14

23 Nov '14

Arch Linux Security Advisory ASA-201411-28 ========================================== Severity: Medium Date : 2014-11-23 CVE-ID : CVE-2014-7824 Package : dbus Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package dbus before version 1.8.10-1 is vulnerable to denial of service via file descriptor exhaustion. Resolution ========== Upgrade to 1.8.10-1. # pacman -Syu "dbus>=1.8.10-1" The problem has been fixed upstream in version 1.8.10. Workaround ========== None. Description =========== The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on incorrect reasoning and does not fully prevent the attack described in the impact section below. Preventing that attack requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher value. Impact ====== A local attacker is able to queue up the maximum allowed number of file descriptors to reach the system dbus-daemon's RLIMIT_NOFILE resulting in a denial of service in two ways: - new clients would be unable to connect to the dbus-daemon - when receiving a subsequent message from a non-malicious client that contained a fd, dbus-daemon would receive the MSG_CTRUNC flag, indicating that the list of fds was truncated; kernel fd-passing APIs do not provide any way to recover from that, so dbus-daemon responds to MSG_CTRUNC by disconnecting the sender, causing denial of service to that sender References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7824 http://www.openwall.com/lists/oss-security/2014/11/10/2 https://bugs.freedesktop.org/show_bug.cgi?id=85105

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-27] glibc: command execution
by Remi Gacogne 21 Nov '14

21 Nov '14

Arch Linux Security Advisory ASA-201411-27 ========================================== Severity: Medium Date : 2014-11-21 CVE-ID : CVE-2014-7817 Package : glibc Type : command execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package glibc before version 2.20-3 is vulnerable to command execution. Resolution ========== Upgrade to 2.20-3. # pacman -Syu "glibc>=2.20-3" The problem has been fixed upstream but there has been no new release yet. Workaround ========== None. Description =========== The wordexp function could ignore the WRDE_NOCMD flag under certain input conditions resulting in the execution of a shell for command substitution when the application did not request it. The implementation now checks WRDE_NOCMD immediately before executing the shell and returns the error WRDE_CMDSUB as expected. Impact ====== An attacker may be able to force arbitrary commands to be executed by an application using the wordexp function. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7817 https://sourceware.org/bugzilla/show_bug.cgi?id=17625 http://seclists.org/oss-sec/2014/q4/730

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-26] chromium: multiple issues
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-26 ========================================== Severity: High Date : 2014-11-20 CVE-ID : CVE-2014-7899 CVE-2014-7900 CVE-2014-7901 CVE-2014-7902 CVE-2014-7903 CVE-2014-7904 CVE-2014-7906 CVE-2014-7907 CVE-2014-7908 CVE-2014-7909 CVE-2014-7910 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package chromium before version 39.0.2171.65-1 is vulnerable to multiple issues including but not limited to address bar spoofing and denial of service. Resolution ========== Upgrade to 39.0.2171.65-1. # pacman -Syu "chromium>=39.0.2171.65-1" The problems have been fixed upstream in version 39.0.2171.65. Workaround ========== None. Description =========== - CVE-2014-7899 (address bar spoofing) A flaw allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string. - CVE-2014-7900 (use-after-free) Use-after-free vulnerability in the CPDF_Parser::IsLinearizedFile function in fpdfapi/fpdf_parser/fpdf_parser_parser.cpp in PDFium allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document. - CVE-2014-7901 (integer overflow) Integer overflow in the opj_t2_read_packet_data function in fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c in OpenJPEG in PDFium allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long segment in a JPEG image. - CVE-2014-7902 (use-after-free) Use-after-free vulnerability in PDFium allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document. - CVE-2014-7903 (buffer overflow) Buffer overflow in OpenJPEG before r2911 in PDFium allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG image. - CVE-2014-7904 (buffer overflow) Buffer overflow in Skia allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. - CVE-2014-7906 (use-after-free) Use-after-free vulnerability in the Pepper plugins allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Flash content that triggers an attempted PepperMediaDeviceManager access outside of the object's lifetime. - CVE-2014-7907 (use-after-free) Multiple use-after-free vulnerabilities in modules/screen_orientation/ScreenOrientationController.cpp in Blink allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods. - CVE-2014-7908 (integer overflow) Multiple integer overflows in the CheckMov function in media/base/container_names.cc allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in (1) MPEG-4 or (2) QuickTime .mov data. - CVE-2014-7909 (uninitialized memory read) A flaw in effects/SkDashPathEffect.cpp in Skia computes a hash key using uninitialized integer values, which might allow remote attackers to cause a denial of service by rendering crafted data. - CVE-2014-7910 (various issues) Various issues from internal audits, fuzzing and other initiatives that allow attackers to cause a denial of service or possibly have other impact. Impact ====== A remote attacker is be able to spoof the address bar, cause a denial of service or possibly have unspecified other impacts. References ========== [0] http://googlechromereleases.blogspot.in/2014/11/stable-channel-update_18.ht… http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7899 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7900 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7901 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7902 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7903 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7904 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7906 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7907 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7908 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7909 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7910

1 0