- Arch-security - lists.archlinux.org

[ASA-201811-9] lib32-curl: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-9 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16839 CVE-2018-16840 Package : lib32-curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-796 Summary ======= The package lib32-curl before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "lib32-curl>=7.62.0-1" The problems have been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== - CVE-2018-16839 (arbitrary code execution) The internal function Curl_auth_create_plain_message fails to correctly verify that the passed in lengths for name and password aren't too long, then calculates a buffer size to allocate. On systems with a 32 bit size_t, the math to calculate the buffer size triggers an integer overflow when the user name length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. - CVE-2018-16840 (arbitrary code execution) A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. A malicious user could execute arbitrary code by passing a very long username or password used for SASL authentication. References ========== https://curl.haxx.se/docs/CVE-2018-16839.html https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5 https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16839 https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-8] lib32-libcurl-compat: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-8 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16839 CVE-2018-16840 Package : lib32-libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-797 Summary ======= The package lib32-libcurl-compat before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "lib32-libcurl-compat>=7.62.0-1" The problems have been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== - CVE-2018-16839 (arbitrary code execution) The internal function Curl_auth_create_plain_message fails to correctly verify that the passed in lengths for name and password aren't too long, then calculates a buffer size to allocate. On systems with a 32 bit size_t, the math to calculate the buffer size triggers an integer overflow when the user name length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. - CVE-2018-16840 (arbitrary code execution) A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. A malicious user could execute arbitrary code by passing a very long username or password used for SASL authentication. References ========== https://curl.haxx.se/docs/CVE-2018-16839.html https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5 https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16839 https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-7] lib32-libcurl-gnutls: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-7 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16839 CVE-2018-16840 Package : lib32-libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-798 Summary ======= The package lib32-libcurl-gnutls before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.62.0-1" The problems have been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== - CVE-2018-16839 (arbitrary code execution) The internal function Curl_auth_create_plain_message fails to correctly verify that the passed in lengths for name and password aren't too long, then calculates a buffer size to allocate. On systems with a 32 bit size_t, the math to calculate the buffer size triggers an integer overflow when the user name length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. - CVE-2018-16840 (arbitrary code execution) A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. A malicious user could execute arbitrary code by passing a very long username or password used for SASL authentication. References ========== https://curl.haxx.se/docs/CVE-2018-16839.html https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5 https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16839 https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-6] libcurl-gnutls: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-6 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16840 Package : libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-799 Summary ======= The package libcurl-gnutls before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "libcurl-gnutls>=7.62.0-1" The problem has been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. References ========== https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-5] libcurl-compat: arbitrary code execution
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-5 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16840 Package : libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-800 Summary ======= The package libcurl-compat before version 7.62.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "libcurl-compat>=7.62.0-1" The problem has been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Impact ====== A malicious remote server might be able to execute arbitrary commands by closing the connection from a client using easy handlers. References ========== https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://security.archlinux.org/CVE-2018-16840

1 0

[ASA-201811-4] curl: multiple issues
by Morten Linderud 10 Nov '18

10 Nov '18

Arch Linux Security Advisory ASA-201811-4 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-16840 CVE-2018-16842 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-795 Summary ======= The package curl before version 7.62.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 7.62.0-1. # pacman -Syu "curl>=7.62.0-1" The problems have been fixed upstream in version 7.62.0. Workaround ========== None. Description =========== - CVE-2018-16840 (arbitrary code execution) A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. - CVE-2018-16842 (information disclosure) Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. This display function formats the output to wrap at 80 columns. The wrap logic is however flawed, so if a single word in the message is itself longer than 80 bytes the buffer arithmetic calculates the remainder wrong and will end up reading behind the end of the buffer. Impact ====== A malicious remote server could execute arbitrary commands by closing the client initialized with easy handlers. A malicious local user could disclose information and crash the application if invalid flags were passed. References ========== https://curl.haxx.se/docs/CVE-2018-16840.html https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f https://curl.haxx.se/docs/CVE-2018-16842.html https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211 https://security.archlinux.org/CVE-2018-16840 https://security.archlinux.org/CVE-2018-16842

1 0

[ASA-201811-3] ghostscript: sandbox escape
by Morten Linderud 06 Nov '18

06 Nov '18

Arch Linux Security Advisory ASA-201811-3 ========================================= Severity: High Date : 2018-11-06 CVE-ID : CVE-2018-17961 CVE-2018-18073 CVE-2018-18284 Package : ghostscript Type : sandbox escape Remote : Yes Link : https://security.archlinux.org/AVG-786 Summary ======= The package ghostscript before version 9.25-4 is vulnerable to sandbox escape. Resolution ========== Upgrade to 9.25-4. # pacman -Syu "ghostscript>=9.25-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2018-17961 (sandbox escape) Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. - CVE-2018-18073 (sandbox escape) Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object. - CVE-2018-18284 (sandbox escape) Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. Impact ====== A remote attacker is able to escape the sandbox via a specially crafted PostScript document. References ========== https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a54c9e61e7d02bbc… https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a5a9bf8c6a63aa4a… https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a6807394bd94b708… https://www.openwall.com/lists/oss-security/2018/10/09/4 https://bugs.chromium.org/p/project-zero/issues/detail?id=1682&desc=2 https://bugs.ghostscript.com/show_bug.cgi?id=699816 https://lists.debian.org/debian-lts-announce/2018/10/msg00013.html https://www.exploit-db.com/exploits/45573/ https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=34cc326eb2c56958… http://packetstormsecurity.com/files/149758/Ghostscript-Exposed-System-Oper… http://www.openwall.com/lists/oss-security/2018/10/10/12 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=8d19fdf63f91f504… https://www.openwall.com/lists/oss-security/2018/10/16/2 https://bugs.chromium.org/p/project-zero/issues/detail?id=1696 https://bugs.ghostscript.com/show_bug.cgi?id=699963 https://security.archlinux.org/CVE-2018-17961 https://security.archlinux.org/CVE-2018-18073 https://security.archlinux.org/CVE-2018-18284

1 0

[ASA-201811-2] linux-lts: denial of service
by Jelle van der Waa 01 Nov '18

01 Nov '18

Arch Linux Security Advisory ASA-201811-2 ========================================= Severity: Low Date : 2018-11-01 CVE-ID : CVE-2018-18445 Package : linux-lts Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-801 Summary ======= The package linux-lts before version 4.14.75-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.14.75-1. # pacman -Syu "linux-lts>=4.14.75-1" The problem has been fixed upstream in version 4.14.75. Workaround ========== None. Description =========== In the Linux kernel 4.14.x before 4.14.75 and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out- of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts. Impact ====== A local attacker is able to crash the kernel and leak information using a specially crafted BPF program. References ========== http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b… https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.13 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.75 https://bugs.chromium.org/p/project-zero/issues/detail?id=1686 https://seclists.org/oss-sec/2018/q4/69 https://security.archlinux.org/CVE-2018-18445

1 0

[ASA-201811-1] linux: denial of service
by Jelle van der Waa 01 Nov '18

01 Nov '18

Arch Linux Security Advisory ASA-201811-1 ========================================= Severity: Low Date : 2018-11-01 CVE-ID : CVE-2018-18445 Package : linux Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-784 Summary ======= The package linux before version 4.18.13.arch1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.18.13.arch1-1. # pacman -Syu "linux>=4.18.13.arch1-1" The problem has been fixed upstream in version 4.18.13.arch1. Workaround ========== None. Description =========== In the Linux kernel 4.14.x before 4.14.75 and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out- of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts. Impact ====== A local attacker is able to crash the kernel and leak information using a specially crafted BPF program. References ========== http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b… https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.13 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.75 https://bugs.chromium.org/p/project-zero/issues/detail?id=1686 https://seclists.org/oss-sec/2018/q4/69 https://security.archlinux.org/CVE-2018-18445

1 0

[ASA-201810-16] gitlab: multiple issues
by Jelle van der Waa 31 Oct '18

31 Oct '18

Arch Linux Security Advisory ASA-201810-16 ========================================== Severity: Critical Date : 2018-10-31 CVE-ID : CVE-2018-18640 CVE-2018-18641 CVE-2018-18643 CVE-2018-18645 CVE-2018-18646 CVE-2018-18648 CVE-2018-18649 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-794 Summary ======= The package gitlab before version 11.4.3-1 is vulnerable to multiple issues including arbitrary code execution, cross-site request forgery, cross-site scripting and information disclosure. Resolution ========== Upgrade to 11.4.3-1. # pacman -Syu "gitlab>=11.4.3-1" The problems have been fixed upstream in version 11.4.3. Workaround ========== None. Description =========== - CVE-2018-18640 (information disclosure) A security issue has been found in gitlab versions prior to 11.4.3, where private project pages had inadequate cache control, which resulted in unauthorized users being able to view them in the browser. - CVE-2018-18641 (information disclosure) A security issue has been found in gitlab versions prior to 11.4.3, where personal access tokens were being stored unencrypted as plain text in the database which could result in attackers potentially reading them via SQL injection or other database leaks. - CVE-2018-18643 (cross-site scripting) A security issue has been found in gitlab versions prior to 11.4.3, where the fragment identifier (hash) of several pages contained a lack of input validation and output encoding issue which resulted in a persistent XSS. - CVE-2018-18645 (information disclosure) A security issue has been found in gitlab versions prior to 11.4.3, where when replying to an issue through email, with the GitLab email footer included, a user's unsubscribe link would be included in the issue. This information is considered sensitive. - CVE-2018-18646 (cross-site request forgery) A security issue has been found in gitlab versions prior to 11.4.3, where the Hipchat integration was vulnerable to a SSRF issue which allowed an attacker to make requests to any local network resource accessible from the GitLab server. - CVE-2018-18648 (information disclosure) A security issue has been found in gitlab versions prior to 11.4.3, where a JSON endpoint was disclosing Gem version information which could result in an attacker discovering vulnerable Gems available on a specific GitLab instance. - CVE-2018-18649 (arbitrary code execution) A security issue has been found in gitlab versions prior to 11.4.3, where the wiki API contained an input validation issue which resulted in remote code execution. Impact ====== A remote attacker is able to execute arbitrary code, disclose information, perform cross-site request forgery or cross-site scripting. References ========== https://about.gitlab.com/2018/10/29/security-release-gitlab-11-dot-4-dot-3-… https://gitlab.com/gitlab-org/gitlab-ce/commit/5e125b0f84ad768d7ff19905d038… https://gitlab.com/gitlab-org/gitlab-ce/commit/daed01a5ca348e7d267b50e325bf… https://gitlab.com/gitlab-org/gitlab-ce/commit/5342df04045e1c8a98fdb9fe8203… https://gitlab.com/gitlab-org/gitlab-ce/commit/82c12bd8bf9e0ea9e8df3bbcad91… https://gitlab.com/gitlab-org/gitlab-ce/commit/f17e36feab266a62b316bfe88d7d… https://gitlab.com/gitlab-org/gitlab-ce/commit/b9b68fe7d30778338625fb606457… https://gitlab.com/gitlab-org/gitlab-ce/commit/e05636e2794d975876958c3781b6… https://security.archlinux.org/CVE-2018-18640 https://security.archlinux.org/CVE-2018-18641 https://security.archlinux.org/CVE-2018-18643 https://security.archlinux.org/CVE-2018-18645 https://security.archlinux.org/CVE-2018-18646 https://security.archlinux.org/CVE-2018-18648 https://security.archlinux.org/CVE-2018-18649

1 0