- Arch-security - lists.archlinux.org

[arch-security] [Arch Linux Security Advisory ASA-201411-15] linux-lts: local denial of service, privilege escalation
by Remi Gacogne 17 Nov '14

17 Nov '14

Arch Linux Security Advisory ASA-201411-15 ========================================== Severity: Medium Date : 2014-11-17 CVE-ID : CVE-2014-3610, CVE-2014-3611, CVE-2014-3646, CVE-2014-3647, CVE-2014-7825, CVE-2014-7826, CVE-2014-8369 Package : linux-lts Type : local denial of service, privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package linux-lts before version 3.14.24-1 is vulnerable to local denial service and privilege escalation via various issues. Resolution ========== Upgrade to 3.14.24-1. # pacman -Syu "linux-lts>=3.14.24-1" The problem has been fixed upstream in version 3.14.24. Workaround ========== None. Description =========== CVE-2014-3610: The WRMSR processing functionality in the KVM subsystem in the Linux kernel does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. CVE-2014-3611: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation. CVE-2014-3646: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-7825: kernel/trace/trace_syscalls.c in the Linux kernel does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application. CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2014-8369: The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601. Impact ====== A local OS user may be able to cause a kernel crash in various ways, or escalate privileges. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3610 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3611 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3646 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3647 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7825 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7826 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8369 http://permalink.gmane.org/gmane.comp.security.oss.general/14526

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-14] linux: local denial of service, privilege escalation
by Remi Gacogne 17 Nov '14

17 Nov '14

Arch Linux Security Advisory ASA-201411-14 ========================================== Severity: Medium Date : 2014-11-17 CVE-ID : CVE-2014-3610, CVE-2014-3611, CVE-2014-3646, CVE-2014-3647, CVE-2014-7825, CVE-2014-7826, CVE-2014-8369, CVE-2014-8480, CVE-2014-8481 Package : linux Type : local denial of service, privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package linux before version 3.17.3-1 is vulnerable to local denial service and privilege escalation via various issues. Resolution ========== Upgrade to 3.17.3-1. # pacman -Syu "linux>=3.17.3-1" The problem has been fixed upstream in version 3.17.3. Workaround ========== None. Description =========== CVE-2014-3610: The WRMSR processing functionality in the KVM subsystem in the Linux kernel does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. CVE-2014-3611: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation. CVE-2014-3646: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-7825: kernel/trace/trace_syscalls.c in the Linux kernel does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application. CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2014-8369: The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601. CVE-2014-8480: The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel lacks intended decoder-table flags for certain RIP-relative instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application. CVE-2014-8481: The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel does not properly handle invalid instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application that triggers (1) an improperly fetched instruction or (2) an instruction that occupies too many bytes. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8480. Impact ====== A local OS user may be able to cause a kernel crash in various ways, or escalate privileges. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3610 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3611 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3646 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3647 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7825 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7826 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8369 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8480 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8481 http://permalink.gmane.org/gmane.comp.security.oss.general/14526

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-13] php: denial of service
by Levente Polyak 13 Nov '14

13 Nov '14

Arch Linux Security Advisory ASA-201411-13 ========================================== Severity: Medium Date : 2014-11-13 CVE-ID : CVE-2014-3710 Package : php Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package php before version 5.6.3-1 is vulnerable to denial of service through out-of-bounds read. Resolution ========== Upgrade to 5.6.3-1. # pacman -Syu "php>=5.6.3-1" The problem has been fixed upstream [0] in version 5.6.3. Workaround ========== None. Description =========== An out-of-bounds read flaw was found in the way the file information (fileinfo) extension parsed executable and linkable format (ELF) files. Impact ====== A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted ELF file. References ========== [0] http://git.php.net/?p=php-src.git;a=patch;h=180322 https://access.redhat.com/security/cve/CVE-2014-3710 https://bugzilla.redhat.com/show_bug.cgi?id=1155071 https://bugs.archlinux.org/task/42764 https://bugs.php.net/bug.php?id=68283

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-12] imagemagick: denial of service
by Remi Gacogne 13 Nov '14

13 Nov '14

Arch Linux Security Advisory ASA-201411-12 ========================================== Severity: Low Date : 2014-11-13 CVE-ID : CVE-2014-8716 Package : imagemagick Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package imagemagick before version 6.8.9.10-1 is vulnerable to denial of service. Resolution ========== Upgrade to 6.8.9.10-1. # pacman -Syu "imagemagick>=6.8.9.10-1" The problem has been fixed upstream in version 6.8.9.10. Workaround ========== None. Description =========== Converting some specially crafted jpeg with convert could lead to a dos. Impact ====== An attacker capable of submitting a specially crafted jpeg passed to the convert command would be able to cause a crash resulting from an out-of-bound read. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8716 http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26456 http://seclists.org/oss-sec/2014/q4/569

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-11] flashplugin: remote code execution
by Remi Gacogne 13 Nov '14

13 Nov '14

Arch Linux Security Advisory ASA-201411-11 ========================================== Severity: Critical Date : 2014-11-13 CVE-ID : CVE-2014-0573, CVE-2014-0574, CVE-2014-0576, CVE-2014-0577, CVE-2014-0581, CVE-2014-0582, CVE-2014-0583, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0588, CVE-2014-0589, CVE-2014-0590, CVE-2014-8437, CVE-2014-8438, CVE-2014-8440, CVE-2014-8441, CVE-2014-8442 Package : flashplugin Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package flashplugin before version 11.2.202.418-1 is vulnerable to multiple flaws, allowing arbitrary remote code execution. Resolution ========== Upgrade to 11.2.202.418-1. # pacman -Syu "flashplugin>=11.2.202.418-1" The problem has been fixed upstream in version 11.2.202.418. Workaround ========== Disable or remove the flash plugin. Description =========== These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2014-0576, CVE-2014-0581, CVE-2014-8440, CVE-2014-8441). These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2014-0573, CVE-2014-0588, CVE-2014-8438). These updates resolve a double free vulnerability that could lead to code execution (CVE-2014-0574). These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0590). These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2014-0582, CVE-2014-0589). These updates resolve an information disclosure vulnerability that could be exploited to disclose session tokens (CVE-2014-8437). These updates resolve a heap buffer overflow vulnerability that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-0583). These updates resolve a permission issue that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-8442). Impact ====== A remote attacker in position of a man-in-the-middle or a malicious website can remotely execute arbitrary code with the privileges of the current user. References ========== https://helpx.adobe.com/security/products/flash-player/apsb14-24.html https://bugs.archlinux.org/task/42769 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0573 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0574 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0576 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0577 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0581 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0582 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0583 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0584 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0585 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0586 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0588 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0589 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0590 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8437 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8438 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8440 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8441 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8442

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-10] gnutls: out-of-bounds memory write
by Levente Polyak 12 Nov '14

12 Nov '14

Arch Linux Security Advisory ASA-201411-10 ========================================== Severity: Medium Date : 2014-11-12 CVE-ID : CVE-2014-8564 Package : gnutls Type : out-of-bounds memory write Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package gnutls before version 3.3.10-1 is vulnerable to out-of-bounds memory write resulting in denial of service or possibly code execution. Resolution ========== Upgrade to 3.3.10-1. # pacman -Syu "gnutls>=3.3.10-1" The problems have been fixed upstream [0] in version 3.3.10. Workaround ========== None. Description =========== An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR) resulting in heap corruption. Impact ====== A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application. References ========== [0] https://gitorious.org/gnutls/gnutls/commit/e821e19 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8564 http://www.gnutls.org/security.html#GNUTLS-SA-2014-5 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8564

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-9] file: denial of service through out-of-bounds read
by Levente Polyak 12 Nov '14

12 Nov '14

Arch Linux Security Advisory ASA-201411-9 ========================================= Severity: Medium Date : 2014-11-12 CVE-ID : CVE-2014-3710 Package : file Type : denial of service through out-of-bounds read Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package file before version 5.20-2 is vulnerable to denial of service through out-of-bounds read. Resolution ========== Upgrade to 5.20-2. # pacman -Syu "file>=5.20-2" The problems have been fixed upstream [0] but no release version is available yet. Workaround ========== None. Description =========== An out-of-bounds read flaw was found in file's donote() function in the way the file utility determined the note headers of a elf file. This could possibly lead to file executable crash. Impact ====== A specially crafted elf file may lead to out-of-bounds read while parsing the note headers and lead to file executable crash. As readelf in file is widely used this could possibly lead to denial of service of middleware relying on it. References ========== [0] https://github.com/file/file/commit/39c7ac1106 https://access.redhat.com/security/cve/CVE-2014-3710 https://bugzilla.redhat.com/show_bug.cgi?id=1155071 https://bugs.archlinux.org/task/42759

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-8] mantisbt: arbitrary code execution and unrestricted access
by Levente Polyak 12 Nov '14

12 Nov '14

Arch Linux Security Advisory ASA-201411-8 ========================================= Severity: Critical Date : 2014-11-12 CVE-ID : CVE-2014-7146 CVE-2014-8598 Package : mantisbt Type : arbitrary code execution, unrestricted access Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package mantisbt before version 1.2.17-4 is vulnerable to arbitrary code execution and unrestricted access. Resolution ========== Upgrade to 1.2.17-4. # pacman -Syu "mantisbt>=1.2.17-4" The problems have been fixed upstream [0][1] but no release version is available yet. Workaround ========== Uninstall the XML Import/Export plugin in mantisbt to avoid both vulnerabilities. Description =========== - CVE-2014-7146 (arbitrary code execution) When importing data with the plugin, user input passed through the "description" field (and the "issuelink" attribute) of the uploaded XML file isn't properly sanitized before being used in a call to the preg_replace() function which uses the 'e' modifier. This can be exploited to inject and execute arbitrary PHP code when the Import/Export plugin is installed. - CVE-2014-8598 (unrestricted access, information disclosure) The bundled XML Import/Export plugin does not perform any access level checks in the import and export pages. This allows any user knowing the URL to the plugin's page to insert or export any (confidential) data without restriction, regardless of their access level. This vulnerability is particularly dangerous when used in combination with the one described above (CVE-2014-7146) as it makes the access complexity very simple, allowing unauthenticated attackers to execute arbitrary code. Impact ====== A remote unauthenticated attacker knowing the URL to the plugin's page is able to export confidential information, insert data without any restriction or execute arbitrary code. References ========== [0] https://github.com/mantisbt/mantisbt/commit/bed19db9 [1] https://github.com/mantisbt/mantisbt/commit/80a15487 https://access.redhat.com/security/cve/CVE-2014-7146 https://access.redhat.com/security/cve/CVE-2014-8598 http://www.openwall.com/lists/oss-security/2014/11/07/27 http://www.openwall.com/lists/oss-security/2014/11/07/28 https://bugs.archlinux.org/task/42761

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-7] curl: out-of-bounds read
by Levente Polyak 11 Nov '14

11 Nov '14

Arch Linux Security Advisory ASA-201411-7 ========================================= Severity: Medium Date : 2014-11-11 CVE-ID : CVE-2014-3707 Package : curl Type : out-of-bounds read Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package curl before version 7.39.0-1 is vulnerable to out-of-bounds read which may lead to information disclosure. Resolution ========== Upgrade to 7.39.0-1. # pacman -Syu "curl>=7.39.0-1" The problem has been fixed upstream [0] in version 7.39.0. Workaround ========== None. Description =========== Symeon Paraschoudis discovered that the curl_easy_duphandle() function has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending. Impact ====== This bug requires CURLOPT_COPYPOSTFIELDS and curl_easy_duphandle() to be used in that order, and then the duplicate handle must be used to perform the HTTP POST. The curl command line tool is not affected by this problem as it does not use this sequence. References ========== [0] https://github.com/bagder/curl/commit/b38756 https://access.redhat.com/security/cve/CVE-2014-3707 http://curl.haxx.se/docs/adv_20141105.html

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-6] kdebase-workspace: local privilege escalation
by Remi Gacogne 10 Nov '14

10 Nov '14

Arch Linux Security Advisory ASA-201411-6 ========================================= Severity: Medium Date : 2014-11-10 CVE-ID : CVE-2014-8651 Package : kdebase-workspace Type : local privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package kdebase-workspace before version 4.11.13-2 is vulnerable to a local privilege escalation issue. Resolution ========== Upgrade to 4.11.13-2. # pacman -Syu "kdebase-workspace>=4.11.13-2" The problem has not been fixed upstream yet. Workaround ========== A polkit rule can be added to disable the org.kde.kcontrol.kcmclock.save action. Description =========== KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. This is secured with polkit. This helper takes the name of the ntp utility to run as an argument. This allows a hacker to run any arbitrary command as root under the guise of updating the time. Impact ====== An local application can gain root privileges from an admin user with either misleading information or no interaction. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8651 http://seclists.org/oss-sec/2014/q4/520 https://git.reviewboard.kde.org/r/120977/ https://bugs.archlinux.org/task/42679

1 0