- Arch-security - lists.archlinux.org

[ASA-201812-7] lib32-openssl-1.0: private key recovery
by Jelle van der Waa 11 Dec '18

11 Dec '18

Arch Linux Security Advisory ASA-201812-7 ========================================= Severity: Low Date : 2018-12-08 CVE-ID : CVE-2018-0734 CVE-2018-5407 Package : lib32-openssl-1.0 Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-806 Summary ======= The package lib32-openssl-1.0 before version 1.0.2.q-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1.0.2.q-1. # pacman -Syu "lib32-openssl-1.0>=1.0.2.q-1" The problems have been fixed upstream in version 1.0.2.q. Workaround ========== None. Description =========== - CVE-2018-0734 (private key recovery) A timing vulnerability has been found in DSA signature generation in openssl versions up to and including 1.1.1, where information is leaked via a side channel when a BN is resized and could lead to private key recovery. - CVE-2018-5407 (private key recovery) A vulnerability has been found in the ECC scalar multiplication implementation of OpenSSL < 1.1.0i and <= 1.0.2p. The implementation, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key. Impact ====== A remote attacker might be able to recover a private DSA key via a timing attack. In addition, a local attacker might be able to recover a private ECC key via a timing attack. References ========== https://www.openssl.org/news/secadv/20181030.txt https://github.com/openssl/openssl/commit/8abfe72e8c1de1b95f50aa0d9134803b4… https://github.com/openssl/openssl/pull/7486 https://www.openssl.org/news/secadv/20181112.txt https://github.com/openssl/openssl/commit/b18162a7c9bbfb57112459a4d6631fa25… https://security.archlinux.org/CVE-2018-0734 https://security.archlinux.org/CVE-2018-5407

1 0

[ASA-201812-6] lib32-openssl: private key recovery
by Jelle van der Waa 11 Dec '18

11 Dec '18

Arch Linux Security Advisory ASA-201812-6 ========================================= Severity: Low Date : 2018-12-08 CVE-ID : CVE-2018-0734 CVE-2018-0735 Package : lib32-openssl Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-793 Summary ======= The package lib32-openssl before version 1:1.1.1.a-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1:1.1.1.a-1. # pacman -Syu "lib32-openssl>=1:1.1.1.a-1" The problems have been fixed upstream in version 1.1.1.a. Workaround ========== None. Description =========== - CVE-2018-0734 (private key recovery) A timing vulnerability has been found in DSA signature generation in openssl versions up to and including 1.1.1, where information is leaked via a side channel when a BN is resized and could lead to private key recovery. - CVE-2018-0735 (private key recovery) The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack in openssl versions prior to 1.1.1a. An attacker could use variations in the signing algorithm to recover the private key. Impact ====== A remote attacker might be able to recover a private ECDSA or DSA key via a timing attack. References ========== https://www.openssl.org/news/secadv/20181029.txt https://www.openssl.org/news/secadv/20181030.txt https://github.com/openssl/openssl/commit/8abfe72e8c1de1b95f50aa0d9134803b4… https://github.com/openssl/openssl/pull/7486 https://github.com/openssl/openssl/commit/b1d6d55ece1c26fa2829e2b819b038d7b… https://security.archlinux.org/CVE-2018-0734 https://security.archlinux.org/CVE-2018-0735

1 0

[ASA-201812-5] openssl: private key recovery
by Jelle van der Waa 11 Dec '18

11 Dec '18

Arch Linux Security Advisory ASA-201812-5 ========================================= Severity: Low Date : 2018-12-08 CVE-ID : CVE-2018-0734 CVE-2018-0735 Package : openssl Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-792 Summary ======= The package openssl before version 1.1.1.a-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1.1.1.a-1. # pacman -Syu "openssl>=1.1.1.a-1" The problems have been fixed upstream in version 1.1.1.a. Workaround ========== None. Description =========== - CVE-2018-0734 (private key recovery) A timing vulnerability has been found in DSA signature generation in openssl versions up to and including 1.1.1, where information is leaked via a side channel when a BN is resized and could lead to private key recovery. - CVE-2018-0735 (private key recovery) The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack in openssl versions prior to 1.1.1a. An attacker could use variations in the signing algorithm to recover the private key. Impact ====== A remote attacker might be able to recover a private ECDSA or DSA key via a timing attack. References ========== https://www.openssl.org/news/secadv/20181029.txt https://www.openssl.org/news/secadv/20181030.txt https://github.com/openssl/openssl/commit/8abfe72e8c1de1b95f50aa0d9134803b4… https://github.com/openssl/openssl/pull/7486 https://github.com/openssl/openssl/commit/b1d6d55ece1c26fa2829e2b819b038d7b… https://security.archlinux.org/CVE-2018-0734 https://security.archlinux.org/CVE-2018-0735

1 0

[ASA-201812-4] texlive-bin: arbitrary code execution
by Jelle van der Waa 11 Dec '18

11 Dec '18

Arch Linux Security Advisory ASA-201812-4 ========================================= Severity: High Date : 2018-12-08 CVE-ID : CVE-2018-17407 Package : texlive-bin Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-770 Summary ======= The package texlive-bin before version 2018.48691-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2018.48691-1. # pacman -Syu "texlive-bin>=2018.48691-1" The problem has been fixed upstream in version 2018.48691. Workaround ========== None. Description =========== An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex. Impact ====== A local attacker can execute arbitrary code via a crafted font. References ========== https://github.com/TeX-Live/texlive-source/commit/6ed0077520e2b0da1fd060c7f… https://github.com/TeX-Live/texlive-source/commit/f1211fe16c19af8fee54146ae… https://security.archlinux.org/CVE-2018-17407

1 0

[ASA-201812-3] wireshark-cli: multiple issues
by Jelle van der Waa 11 Dec '18

11 Dec '18

Arch Linux Security Advisory ASA-201812-3 ========================================= Severity: Critical Date : 2018-12-08 CVE-ID : CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628 Package : wireshark-cli Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-825 Summary ======= The package wireshark-cli before version 2.6.5-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 2.6.5-1. # pacman -Syu "wireshark-cli>=2.6.5-1" The problems have been fixed upstream in version 2.6.5. Workaround ========== None. Description =========== - CVE-2018-19622 (denial of service) A security issue has been found in the MMSE dissector of Wireshark versions prior to 2.6.5, which could be made to consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file - CVE-2018-19623 (arbitrary code execution) A heap-based out-of-bounds write has been found in the LBMPDM dissector of Wireshark versions prior to 2.6.5, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file - CVE-2018-19624 (denial of service) A NULL-pointer dereference has been found in the PVFS dissector of Wireshark versions prior to 2.6.5, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file - CVE-2018-19625 (information disclosure) An out-of-bounds read has been found in the dissection engine of Wireshark versions prior to 2.6.5, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file - CVE-2018-19626 (information disclosure) An out-of-bounds read has been found in the DCOM dissector of Wireshark versions prior to 2.6.5, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file - CVE-2018-19627 (information disclosure) An out-of-bounds read has been found in the IxVeriWave file parser of Wireshark versions prior to 2.6.5, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file - CVE-2018-19628 (denial of service) A divide-by-zero error has been found in the ZigBee ZCL dissector of Wireshark versions prior to 2.6.5, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file Impact ====== A remote attacker can execute arbitrary code, access sensitive information or crash wireshark via a crafted network packet or a capture file. References ========== https://www.wireshark.org/docs/relnotes/wireshark-2.6.5.html https://www.wireshark.org/security/wnpa-sec-2018-54 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15250 https://code.wireshark.org/review/#/c/30613/ https://www.wireshark.org/security/wnpa-sec-2018-53 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15132 https://code.wireshark.org/review/#/c/30346/ https://www.wireshark.org/security/wnpa-sec-2018-56 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15280 https://code.wireshark.org/review/#/c/30811/ https://www.wireshark.org/security/wnpa-sec-2018-51 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14466 https://code.wireshark.org/review/#/c/30152/ https://www.wireshark.org/security/wnpa-sec-2018-52 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15130 https://code.wireshark.org/review/#/c/30158/ https://www.wireshark.org/security/wnpa-sec-2018-55 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15279 https://code.wireshark.org/review/#/c/30813/ https://www.wireshark.org/security/wnpa-sec-2018-57 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15281 https://code.wireshark.org/review/#/c/30810/ https://security.archlinux.org/CVE-2018-19622 https://security.archlinux.org/CVE-2018-19623 https://security.archlinux.org/CVE-2018-19624 https://security.archlinux.org/CVE-2018-19625 https://security.archlinux.org/CVE-2018-19626 https://security.archlinux.org/CVE-2018-19627 https://security.archlinux.org/CVE-2018-19628

1 0

[ASA-201812-2] chromium: multiple issues
by Jelle van der Waa 11 Dec '18

11 Dec '18

Arch Linux Security Advisory ASA-201812-2 ========================================= Severity: Critical Date : 2018-12-08 CVE-ID : CVE-2018-17480 CVE-2018-17481 CVE-2018-18335 CVE-2018-18336 CVE-2018-18337 CVE-2018-18338 CVE-2018-18339 CVE-2018-18340 CVE-2018-18341 CVE-2018-18342 CVE-2018-18343 CVE-2018-18344 CVE-2018-18345 CVE-2018-18346 CVE-2018-18347 CVE-2018-18348 CVE-2018-18349 CVE-2018-18350 CVE-2018-18351 CVE-2018-18352 CVE-2018-18353 CVE-2018-18354 CVE-2018-18355 CVE-2018-18356 CVE-2018-18357 CVE-2018-18358 CVE-2018-18359 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-824 Summary ======= The package chromium before version 71.0.3578.80-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure and insufficient validation. Resolution ========== Upgrade to 71.0.3578.80-1. # pacman -Syu "chromium>=71.0.3578.80-1" The problems have been fixed upstream in version 71.0.3578.80. Workaround ========== None. Description =========== - CVE-2018-17480 (arbitrary code execution) An out of bounds write has been found in the V8 component of chromium before 71.0.3578.80. - CVE-2018-17481 (arbitrary code execution) A use-after-free has been found in the PDFium component of chromium before 71.0.3578.80. - CVE-2018-18335 (arbitrary code execution) A heap-based buffer overflow has been found in the Skia component of chromium before 71.0.3578.80. - CVE-2018-18336 (arbitrary code execution) A use-after-free has been found in the PDFium component of chromium before 71.0.3578.80. - CVE-2018-18337 (arbitrary code execution) A use-after-free has been found in the Blink component of chromium before 71.0.3578.80. - CVE-2018-18338 (arbitrary code execution) A heap-based buffer overflow has been found in the Canva component of chromium before 71.0.3578.80. - CVE-2018-18339 (arbitrary code execution) A use-after-free has been found in the WebAudio component of chromium before 71.0.3578.80. - CVE-2018-18340 (arbitrary code execution) A use-after-free has been found in the MediaRecorder component of chromium before 71.0.3578.80. - CVE-2018-18341 (arbitrary code execution) A heap-based buffer overflow has been found in the Blink component of chromium before 71.0.3578.80. - CVE-2018-18342 (arbitrary code execution) An out of bounds write has been found in the V8 component of chromium before 71.0.3578.80. - CVE-2018-18343 (arbitrary code execution) A use-after-free has been found in the Skia component of chromium before 71.0.3578.80. - CVE-2018-18344 (access restriction bypass) An inappropriate implementation issue has been found in the Extensions component of chromium before 71.0.3578.80. - CVE-2018-18345 (access restriction bypass) An inappropriate implementation issue has been found in the Site Isolation component of chromium before 71.0.3578.80. - CVE-2018-18346 (access restriction bypass) An incorrect security UI issue has been found in the Blink component of chromium before 71.0.3578.80. - CVE-2018-18347 (access restriction bypass) An inappropriate implementation issue has been found in the Navigation component of chromium before 71.0.3578.80. - CVE-2018-18348 (access restriction bypass) An inappropriate implementation issue has been found in the Omnibox component of chromium before 71.0.3578.80. - CVE-2018-18349 (access restriction bypass) An insufficient policy enforcement issue has been found in the Blink component of chromium before 71.0.3578.80. - CVE-2018-18350 (access restriction bypass) An insufficient policy enforcement issue has been found in the Blink component of chromium before 71.0.3578.80. - CVE-2018-18351 (access restriction bypass) An insufficient policy enforcement issue has been found in the Navigation component of chromium before 71.0.3578.80. - CVE-2018-18352 (access restriction bypass) An inappropriate implementation issue has been found in the Media component of chromium before 71.0.3578.80. - CVE-2018-18353 (access restriction bypass) An inappropriate implementation issue has been found in the Network Authentication component of chromium before 71.0.3578.80. - CVE-2018-18354 (insufficient validation) An insufficient data validation issue has been found in the Shell Integration component of chromium before 71.0.3578.80. - CVE-2018-18355 (access restriction bypass) An insufficient policy enforcement issue has been found in the URL Formatter component of chromium before 71.0.3578.80. - CVE-2018-18356 (arbitrary code execution) A use-after-free has been found in the Skia component of chromium before 71.0.3578.80. - CVE-2018-18357 (access restriction bypass) An insufficient policy enforcement issue has been found in the URL Formatter component of chromium before 71.0.3578.80. - CVE-2018-18358 (access restriction bypass) An insufficient policy enforcement issue has been found in the Proxy component of chromium before 71.0.3578.80. - CVE-2018-18359 (information disclosure) An out-of-bounds read has been found in the V8 component of chromium before 71.0.3578.80. Impact ====== A remote attacker can access sensitive information, bypass security restrictions and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=905940 https://bugs.chromium.org/p/chromium/issues/detail?id=901654 https://bugs.chromium.org/p/chromium/issues/detail?id=895362 https://bugs.chromium.org/p/chromium/issues/detail?id=898531 https://bugs.chromium.org/p/chromium/issues/detail?id=886753 https://bugs.chromium.org/p/chromium/issues/detail?id=890576 https://bugs.chromium.org/p/chromium/issues/detail?id=891187 https://bugs.chromium.org/p/chromium/issues/detail?id=896736 https://bugs.chromium.org/p/chromium/issues/detail?id=901030 https://bugs.chromium.org/p/chromium/issues/detail?id=906313 https://bugs.chromium.org/p/chromium/issues/detail?id=882423 https://bugs.chromium.org/p/chromium/issues/detail?id=866426 https://bugs.chromium.org/p/chromium/issues/detail?id=886976 https://bugs.chromium.org/p/chromium/issues/detail?id=606104 https://bugs.chromium.org/p/chromium/issues/detail?id=850824 https://bugs.chromium.org/p/chromium/issues/detail?id=881659 https://bugs.chromium.org/p/chromium/issues/detail?id=894399 https://bugs.chromium.org/p/chromium/issues/detail?id=799747 https://bugs.chromium.org/p/chromium/issues/detail?id=833847 https://bugs.chromium.org/p/chromium/issues/detail?id=849942 https://bugs.chromium.org/p/chromium/issues/detail?id=884179 https://bugs.chromium.org/p/chromium/issues/detail?id=889459 https://bugs.chromium.org/p/chromium/issues/detail?id=896717 https://bugs.chromium.org/p/chromium/issues/detail?id=883666 https://bugs.chromium.org/p/chromium/issues/detail?id=895207 https://bugs.chromium.org/p/chromium/issues/detail?id=899126 https://bugs.chromium.org/p/chromium/issues/detail?id=907714 https://security.archlinux.org/CVE-2018-17480 https://security.archlinux.org/CVE-2018-17481 https://security.archlinux.org/CVE-2018-18335 https://security.archlinux.org/CVE-2018-18336 https://security.archlinux.org/CVE-2018-18337 https://security.archlinux.org/CVE-2018-18338 https://security.archlinux.org/CVE-2018-18339 https://security.archlinux.org/CVE-2018-18340 https://security.archlinux.org/CVE-2018-18341 https://security.archlinux.org/CVE-2018-18342 https://security.archlinux.org/CVE-2018-18343 https://security.archlinux.org/CVE-2018-18344 https://security.archlinux.org/CVE-2018-18345 https://security.archlinux.org/CVE-2018-18346 https://security.archlinux.org/CVE-2018-18347 https://security.archlinux.org/CVE-2018-18348 https://security.archlinux.org/CVE-2018-18349 https://security.archlinux.org/CVE-2018-18350 https://security.archlinux.org/CVE-2018-18351 https://security.archlinux.org/CVE-2018-18352 https://security.archlinux.org/CVE-2018-18353 https://security.archlinux.org/CVE-2018-18354 https://security.archlinux.org/CVE-2018-18355 https://security.archlinux.org/CVE-2018-18356 https://security.archlinux.org/CVE-2018-18357 https://security.archlinux.org/CVE-2018-18358 https://security.archlinux.org/CVE-2018-18359

1 0

[ASA-201812-1] jupyter-notebook: cross-site scripting
by Santiago Torres-Arias 06 Dec '18

06 Dec '18

Arch Linux Security Advisory ASA-201812-1 ========================================= Severity: Medium Date : 2018-12-06 CVE-ID : CVE-2018-19351 CVE-2018-19352 Package : jupyter-notebook Type : cross-site scripting Remote : No Link : https://security.archlinux.org/AVG-820 Summary ======= The package jupyter-notebook before version 5.7.2-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 5.7.2-1. # pacman -Syu "jupyter-notebook>=5.7.2-1" The problems have been fixed upstream in version 5.7.2. Workaround ========== None. Description =========== - CVE-2018-19351 (cross-site scripting) A security issue has been found in Jupyter Notebook versions prior to 5.7.1, where untrusted javascript could be executed if malicious files could be delivered to the users system and the user takes specific actions with those malicious files. It allowed nbconvert endpoints (such as Print Preview) to render untrusted HTML and javascript with access to the notebook server. - CVE-2018-19352 (cross-site scripting) A security issue has been found in Jupyter Notebook versions prior to 5.7.2, where untrusted javascript could be executed if malicious files could be delivered to the users system and the user takes specific actions with those malicious files. It allowed maliciously crafted directory names to execute javascript when opened in the tree view. Impact ====== A remote attacker is able to execute javascript and create html content by tricking users into opening and interacting with maliciously crafted notebook files. References ========== https://bugs.archlinux.org/task/60910 https://blog.jupyter.org/jupyter-notebook-security-fixes-59817e86a711 https://blog.jupyter.org/security-fix-for-jupyter-notebook-450f272b6932?gi=… https://security.archlinux.org/CVE-2018-19351 https://security.archlinux.org/CVE-2018-19352

1 0

[ASA-201811-22] samba: multiple issues
by Remi Gacogne 28 Nov '18

28 Nov '18

Arch Linux Security Advisory ASA-201811-22 ========================================== Severity: High Date : 2018-11-28 CVE-ID : CVE-2018-14629 CVE-2018-16841 CVE-2018-16851 CVE-2018-16852 CVE-2018-16853 CVE-2018-16857 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-823 Summary ======= The package samba before version 4.9.3-1 is vulnerable to multiple issues including denial of service and access restriction bypass. Resolution ========== Upgrade to 4.9.3-1. # pacman -Syu "samba>=4.9.3-1" The problems have been fixed upstream in version 4.9.3. Workaround ========== None. Description =========== - CVE-2018-14629 (denial of service) A denial of service security issue has been found in samba from 4.0.0 up to and including 4.9.2, where an unprivileged user can use the ldbadd tool to add DNS records to create a CNAME loop, causing infinite query recursion. - CVE-2018-16841 (denial of service) A double-free issue has been found in samba from 4.3.0 up to and including 4.9.2, where a user with a valid certificate or smart card can crash the Samba AD DC's KDC. When configured to accept smart-card authentication, Samba's KDC willcall talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process. There is no further vulnerability associated with this issue, merely a denial of service. - CVE-2018-16851 (denial of service) A NULL pointer de-reference issue has been found in samba from 4.0.0 up to and including 4.9.2, where a user able to read more than 256MB of LDAP entries can crash the Samba AD DC's LDAP server. - CVE-2018-16852 (denial of service) A NULL pointer de-reference issue has been found in samba from 4.9.0 up to and including 4.9.2, where a user able to create or modify dnsZone objects can crash the Samba AD DC's DNS management RPC server, DNS server or BIND9 when using Samba's DLZ plugin - CVE-2018-16853 (denial of service) A denial of service has been found in samba from 4.7.0 up to and including 4.9.2, where a user in a Samba AD domain can crash the MIT KDC by requesting an S4U2Self ticket. This only happens if Samba is build in a experimental and unsupported MIT Kerberos configuration. - CVE-2018-16857 (access restriction bypass) A security issue has been found in samba from 4.9.0 up to and including 4.9.2, where AD DC Configurations watching for bad passwords to restrict brute forcing in a window of more than 3 minutes may not watch for bad passwords at all. Impact ====== A remote authenticated user can crash a vulnerable samba server. A remote attacker can brute-force passwords without triggering the bad password lockout protection. References ========== https://download.samba.org/pub/samba/patches/security/samba-4.9.2-security-… https://www.samba.org/samba/security/CVE-2018-14629.html https://bugzilla.samba.org/show_bug.cgi?id=13600 https://github.com/samba-team/samba/commit/bf596c14c2462b9a15ea738ef4f32b3a… https://www.samba.org/samba/security/CVE-2018-16841.html https://bugzilla.samba.org/show_bug.cgi?id=13628 https://github.com/samba-team/samba/commit/6e84215d4aa7ef51096db3b187adbe22… https://www.samba.org/samba/security/CVE-2018-16851.html https://bugzilla.samba.org/show_bug.cgi?id=13674 https://github.com/samba-team/samba/commit/f33f52c366f7cf140f470de44579dcb7… https://www.samba.org/samba/security/CVE-2018-16852.html https://bugzilla.samba.org/show_bug.cgi?id=13669 https://github.com/samba-team/samba/commit/05f867db81f118215445f2c49eda4b9c… https://github.com/samba-team/samba/commit/c78ca8b9b48a19e71f4d6ddd2e300f28… https://www.samba.org/samba/security/CVE-2018-16853.html https://bugzilla.samba.org/show_bug.cgi?id=13571 https://github.com/samba-team/samba/commit/4aabfecd290cd2769376abf7f170e832… https://www.samba.org/samba/security/CVE-2018-16857.html https://bugzilla.samba.org/show_bug.cgi?id=13683 https://github.com/samba-team/samba/commit/862d4909eccd18942e3de8e8b0dc6e15… https://github.com/samba-team/samba/commit/4f86beeaf3408383385ee99a74520a80… https://github.com/samba-team/samba/commit/d12b02c78842786969557b9be7c953e9… https://github.com/samba-team/samba/commit/60b2cd50f4d0554cc5ca8c53b2d1fa89… https://security.archlinux.org/CVE-2018-14629 https://security.archlinux.org/CVE-2018-16841 https://security.archlinux.org/CVE-2018-16851 https://security.archlinux.org/CVE-2018-16852 https://security.archlinux.org/CVE-2018-16853 https://security.archlinux.org/CVE-2018-16857

1 0

[ASA-201811-21] powerdns-recursor: denial of service
by Remi Gacogne 28 Nov '18

28 Nov '18

Arch Linux Security Advisory ASA-201811-21 ========================================== Severity: Medium Date : 2018-11-28 CVE-ID : CVE-2018-16855 Package : powerdns-recursor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-821 Summary ======= The package powerdns-recursor before version 4.1.8-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.1.8-1. # pacman -Syu "powerdns-recursor>=4.1.8-1" The problem has been fixed upstream in version 4.1.8. Workaround ========== None. Description =========== An issue has been found in PowerDNS Recursor versions from 4.1.0 up to and including 4.1.7, where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. Impact ====== A remote attacker can cause a denial of service via a crafted query. References ========== https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://seclists.org/oss-sec/2018/q4/183 https://github.com/PowerDNS/pdns/commit/e412a949491886c13854587bbd06fa90ceb… https://security.archlinux.org/CVE-2018-16855

1 0

[ASA-201811-20] webkit2gtk: arbitrary code execution
by Remi Gacogne 23 Nov '18

23 Nov '18

Arch Linux Security Advisory ASA-201811-20 ========================================== Severity: Critical Date : 2018-11-22 CVE-ID : CVE-2018-4372 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-819 Summary ======= The package webkit2gtk before version 2.22.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.22.4-1. # pacman -Syu "webkit2gtk>=2.22.4-1" The problem has been fixed upstream in version 2.22.4. Workaround ========== None. Description =========== Multiple memory corruption issues have been found in WebKitGTK+ versions prior to 2.22.4, possibly leading to arbitrary code execution while parsing crafted web content. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted web content. References ========== https://webkitgtk.org/security/WSA-2018-0008.html https://webkitgtk.org/security/WSA-2018-0008.html#CVE-2018-4372 https://security.archlinux.org/CVE-2018-4372

1 0