- Arch-security - lists.archlinux.org

[ASA-201810-14] firefox: multiple issues
by Remi Gacogne 26 Oct '18

26 Oct '18

Arch Linux Security Advisory ASA-201810-14 ========================================== Severity: Critical Date : 2018-10-24 CVE-ID : CVE-2018-12388 CVE-2018-12390 CVE-2018-12392 CVE-2018-12395 CVE-2018-12396 CVE-2018-12397 CVE-2018-12398 CVE-2018-12399 CVE-2018-12401 CVE-2018-12402 CVE-2018-12403 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-787 Summary ======= The package firefox before version 63.0-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, privilege escalation, content spoofing, denial of service and information disclosure. Resolution ========== Upgrade to 63.0-1. # pacman -Syu "firefox>=63.0-1" The problems have been fixed upstream in version 63.0. Workaround ========== None. Description =========== - CVE-2018-12388 (arbitrary code execution) Several memory safety bugs have been found in Firefox versions prior to 63.0. Some of these bugs showed evidence of memory corruption and Mozilla engineers presume that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-12390 (arbitrary code execution) Several memory safety bugs have been found in Firefox versions prior to 63.0. Some of these bugs showed evidence of memory corruption and Mozilla engineers presume that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-12392 (arbitrary code execution) A security issue has been found in Firefox versions prior to 63.0. When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. - CVE-2018-12395 (access restriction bypass) A security issue has been found in Firefox versions prior to 63.0, where by rewriting the Host request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. - CVE-2018-12396 (privilege escalation) A security issue has been found in Firefox versions prior to 63.0, where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. - CVE-2018-12397 (access restriction bypass) A security issue has been found in Firefox versions prior to 63.0, where a WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. - CVE-2018-12398 (access restriction bypass) A security issue has been found in Firefox versions prior to 63.0, where it is possible to inject stylesheets and bypass Content Security Policy (CSP) by using the reflected URL in some special resource URIs, such as chrome:. - CVE-2018-12399 (content spoofing) A security issue has been found in Firefox versions prior to 63.0, where when a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the new protocol. This may result in the user approving a protocol handler that they otherwise would not have. - CVE-2018-12401 (denial of service) A security issue has been found in Firefox versions prior to 63.0, where some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This could lead to denial of service (DOS) attacks. - CVE-2018-12402 (information disclosure) A security issue has been found in Firefox versions prior to 63.0, where SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page, violating cookie policy. This can result in saving the wrong version of resources based on those cookies. - CVE-2018-12403 (content spoofing) A security issue has been found in Firefox versions prior to 63.0, where if a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. Impact ====== A remote attacker can bypass domain restrictions, bypass various warnings, crash the browser, escalate privileges and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1472639%2C1485698%2C1301547… https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1487098%2C1487660%2C1490234… https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1492823 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1467523 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1483602 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1487478 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1460538 https://bugzilla.mozilla.org/show_bug.cgi?id=1488061 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1490276 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-124… https://bugzilla.mozilla.org/show_bug.cgi?id=1422456 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-124… https://bugzilla.mozilla.org/show_bug.cgi?id=1469916 https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-124… https://bugzilla.mozilla.org/show_bug.cgi?id=1484753 https://security.archlinux.org/CVE-2018-12388 https://security.archlinux.org/CVE-2018-12390 https://security.archlinux.org/CVE-2018-12392 https://security.archlinux.org/CVE-2018-12395 https://security.archlinux.org/CVE-2018-12396 https://security.archlinux.org/CVE-2018-12397 https://security.archlinux.org/CVE-2018-12398 https://security.archlinux.org/CVE-2018-12399 https://security.archlinux.org/CVE-2018-12401 https://security.archlinux.org/CVE-2018-12402 https://security.archlinux.org/CVE-2018-12403

1 0

[ASA-201810-13] thunderbird: multiple issues
by Santiago Torres-Arias 19 Oct '18

19 Oct '18

Arch Linux Security Advisory ASA-201810-13 ========================================== Severity: Critical Date : 2018-10-18 CVE-ID : CVE-2018-12376 CVE-2018-12377 CVE-2018-12378 CVE-2018-12379 CVE-2018-12383 CVE-2018-12385 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-782 Summary ======= The package thunderbird before version 60.2.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 60.2.1-1. # pacman -Syu "thunderbird>=60.2.1-1" The problems have been fixed upstream in version 60.2.1. Workaround ========== None. Description =========== - CVE-2018-12376 (arbitrary code execution) Several memory safety bugs have been found in Thunderbird versions prior to 60.2.1. - CVE-2018-12377 (arbitrary code execution) A use-after-free vulnerability has been found in Thunderbird versions prior to 60.2.1, which can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use. This results in a potentially exploitable crash. - CVE-2018-12378 (arbitrary code execution) A use-after-free vulnerability has been found in Thunderbird versions prior to 60.2.1, which can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored. This results in a potentially exploitable crash. - CVE-2018-12379 (arbitrary code execution) A security issue has been found in Thunderbird versions prior to 60.2.1. When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash. This requires running the Mozilla Updater manually on the local system with the malicious MAR file in order to occur. - CVE-2018-12383 (information disclosure) A security issue has been found in Thunderbird versions prior to 60.2.1. If a user saved passwords before the move to a new password format and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. - CVE-2018-12385 (arbitrary code execution) A security issue has been found in Thunderbird versions prior to 60.2.1. A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/60424 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1469309%2C1469914%2C1450989… https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1470260 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1459383 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1473113 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1475775 https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1490585 https://security.archlinux.org/CVE-2018-12376 https://security.archlinux.org/CVE-2018-12377 https://security.archlinux.org/CVE-2018-12378 https://security.archlinux.org/CVE-2018-12379 https://security.archlinux.org/CVE-2018-12383 https://security.archlinux.org/CVE-2018-12385

1 0

[ASA-201810-12] chromium: multiple issues
by Remi Gacogne 18 Oct '18

18 Oct '18

Arch Linux Security Advisory ASA-201810-12 ========================================== Severity: Critical Date : 2018-10-17 CVE-ID : CVE-2018-5179 CVE-2018-17462 CVE-2018-17463 CVE-2018-17464 CVE-2018-17465 CVE-2018-17466 CVE-2018-17467 CVE-2018-17468 CVE-2018-17469 CVE-2018-17470 CVE-2018-17471 CVE-2018-17473 CVE-2018-17474 CVE-2018-17475 CVE-2018-17476 CVE-2018-17477 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-781 Summary ======= The package chromium before version 70.0.3538.67-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, sandbox escape, information disclosure and denial of service. Resolution ========== Upgrade to 70.0.3538.67-1. # pacman -Syu "chromium>=70.0.3538.67-1" The problems have been fixed upstream in version 70.0.3538.67. Workaround ========== None. Description =========== - CVE-2018-5179 (denial of service) A security issue has been found in the ServiceWorker component of the chromium browser before 70.0.3538.67, due to a lack of limits on the update() function. - CVE-2018-17462 (sandbox escape) A sandbox escape has been found in the AppCache component of the chromium browser before 70.0.3538.67. - CVE-2018-17463 (arbitrary code execution) A remote code execution issue has been found in the V8 component of the chromium browser before 70.0.3538.67. - CVE-2018-17464 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the chromium browser before 70.0.3538.67. - CVE-2018-17465 (arbitrary code execution) A use-after-free issue has been found in the V8 component of the chromium browser before 70.0.3538.67. - CVE-2018-17466 (arbitrary code execution) A memory corruption issue has been found in the Angle component of the chromium browser before 70.0.3538.67. - CVE-2018-17467 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the chromium browser before 70.0.3538.67. - CVE-2018-17468 (information disclosure) A cross-origin URL disclosure issue has been found in the Blink component of the chromium browser before 70.0.3538.67. - CVE-2018-17469 (arbitrary code execution) A heap-based buffer overflow has been found in the PDFium component of the chromium browser before 70.0.3538.67. - CVE-2018-17470 (arbitrary code execution) A memory corruption issue has been found in the GPU internals component of the chromium browser before 70.0.3538.67. - CVE-2018-17471 (content spoofing) A security UI occlusion has been found in the the full screen mode of the chromium browser before 70.0.3538.67. - CVE-2018-17473 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the chromium browser before 70.0.3538.67. - CVE-2018-17474 (arbitrary code execution) A use-after-free has been found in the Blink component of the chromium browser before 70.0.3538.67. - CVE-2018-17475 (content spoofing) A URL spoofing issue has been found in the Omnibox component of the chromium browser before 70.0.3538.67. - CVE-2018-17476 (content spoofing) A security UI occlusion has been found in the the full screen mode of the chromium browser before 70.0.3538.67. - CVE-2018-17477 (content spoofing) A UI spoofing issue has been found in the Extensions component of the chromium browser before 70.0.3538.67. Impact ====== A remote attacker can spoof the URL or the security status of a page, access sensitive information, crash the browser or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=805496 https://bugs.chromium.org/p/chromium/issues/detail?id=888926 https://bugs.chromium.org/p/chromium/issues/detail?id=888923 https://bugs.chromium.org/p/chromium/issues/detail?id=887273 https://bugs.chromium.org/p/chromium/issues/detail?id=870226 https://bugs.chromium.org/p/chromium/issues/detail?id=880906 https://bugs.chromium.org/p/chromium/issues/detail?id=844881 https://bugs.chromium.org/p/chromium/issues/detail?id=876822 https://bugs.chromium.org/p/chromium/issues/detail?id=880675 https://bugs.chromium.org/p/chromium/issues/detail?id=877874 https://bugs.chromium.org/p/chromium/issues/detail?id=873080 https://bugs.chromium.org/p/chromium/issues/detail?id=882078 https://bugs.chromium.org/p/chromium/issues/detail?id=843151 https://bugs.chromium.org/p/chromium/issues/detail?id=852634 https://bugs.chromium.org/p/chromium/issues/detail?id=812769 https://bugs.chromium.org/p/chromium/issues/detail?id=863703 https://security.archlinux.org/CVE-2018-5179 https://security.archlinux.org/CVE-2018-17462 https://security.archlinux.org/CVE-2018-17463 https://security.archlinux.org/CVE-2018-17464 https://security.archlinux.org/CVE-2018-17465 https://security.archlinux.org/CVE-2018-17466 https://security.archlinux.org/CVE-2018-17467 https://security.archlinux.org/CVE-2018-17468 https://security.archlinux.org/CVE-2018-17469 https://security.archlinux.org/CVE-2018-17470 https://security.archlinux.org/CVE-2018-17471 https://security.archlinux.org/CVE-2018-17473 https://security.archlinux.org/CVE-2018-17474 https://security.archlinux.org/CVE-2018-17475 https://security.archlinux.org/CVE-2018-17476 https://security.archlinux.org/CVE-2018-17477

1 0

[ASA-201810-11] net-snmp: multiple issues
by Levente Polyak 17 Oct '18

17 Oct '18

Arch Linux Security Advisory ASA-201810-11 ========================================== Severity: High Date : 2018-10-17 CVE-ID : CVE-2015-5621 CVE-2018-18065 Package : net-snmp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-777 Summary ======= The package net-snmp before version 5.8-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.8-1. # pacman -Syu "net-snmp>=5.8-1" The problems have been fixed upstream in version 5.8. Workaround ========== None. Description =========== - CVE-2015-5621 (arbitrary code execution) It was discovered that in net-snmp before 5.8 the snmp_pdu_parse() function could leave incompletely parsed varBind variables in the list of variables. A remote, unauthenticated attacker could use this flaw to crash snmpd or potentially execute arbitrary code on the system with the privileges of the user running snmpd. - CVE-2018-18065 (denial of service) A denial of service vulnerability has been discovered in net-snmp before 5.8. The _set_key function in agent/helpers/table_container.c has a NULL pointer exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in denial of service. Impact ====== A remote unauthenticated attacker is able to crash snmpd or potentially execute arbitrary code on the system by sending specially crafted packets. References ========== https://seclists.org/oss-sec/2018/q4/24 https://sourceforge.net/p/net-snmp/bugs/2615/ https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc7… https://www.openwall.com/lists/oss-security/2015/04/13/1 https://bugzilla.redhat.com/show_bug.cgi?id=1212408 https://sourceforge.net/p/net-snmp/bugs/2743/ https://sourceforge.net/p/net-snmp/code/ci/7ffb8e25a0db851953155de91f0170e9… https://dumpco.re/blog/net-snmp-5.7.3-remote-dos https://security.archlinux.org/CVE-2015-5621 https://security.archlinux.org/CVE-2018-18065

1 0

[ASA-201810-10] libssh: authentication bypass
by Levente Polyak 17 Oct '18

17 Oct '18

Arch Linux Security Advisory ASA-201810-10 ========================================== Severity: Critical Date : 2018-10-17 CVE-ID : CVE-2018-10933 Package : libssh Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-780 Summary ======= The package libssh before version 0.8.4-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 0.8.4-1. # pacman -Syu "libssh>=0.8.4-1" The problem has been fixed upstream in version 0.8.4. Workaround ========== None. Description =========== An authentication bypass vulnerability has been discovered in libssh versions prior to 0.7.6 and 0.8.4, in the server-side state machine. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authenticate without any credentials, resulting in unauthorized access. Impact ====== A remote attacker is able to successfully authenticate without any credentials, resulting in unauthorized access. References ========== https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfi… https://www.libssh.org/security/advisories/CVE-2018-10933.txt https://git.libssh.org/projects/libssh.git/commit/?id=2bddafeb709eacc80ad31… https://git.libssh.org/projects/libssh.git/commit/?id=825f4ba96407abe8cebb0… https://git.libssh.org/projects/libssh.git/commit/?id=20981bf2296202e95d791… https://git.libssh.org/projects/libssh.git/commit/?id=5d7414467d6dac100a93d… https://git.libssh.org/projects/libssh.git/commit/?id=459868c4a57d2d11cf783… https://git.libssh.org/projects/libssh.git/commit/?id=68b0c7a93448123cc0d6a… https://git.libssh.org/projects/libssh.git/commit/?id=75be012b4a14f4550ce6a… https://git.libssh.org/projects/libssh.git/commit/?id=e1548a71bdac73da08417… https://security.archlinux.org/CVE-2018-10933

1 0

[ASA-201810-9] wireshark-cli: multiple issues
by Remi Gacogne 12 Oct '18

12 Oct '18

Arch Linux Security Advisory ASA-201810-9 ========================================= Severity: High Date : 2018-10-12 CVE-ID : CVE-2018-12086 CVE-2018-18225 CVE-2018-18226 CVE-2018-18227 Package : wireshark-cli Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-779 Summary ======= The package wireshark-cli before version 2.6.4-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.6.4-1. # pacman -Syu "wireshark-cli>=2.6.4-1" The problems have been fixed upstream in version 2.6.4. Workaround ========== None. Description =========== - CVE-2018-12086 (arbitrary code execution) A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the OpcUa dissector where a specially crafted structured request could lead to stack overflow. This could be used by an attacker to crash wireshark or execute arbitrary code on the affected host by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2018-18225 (denial of service) A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the CoAP dissector where an invalid frame could lead to NULL-pointer dereference. This could be used by an attacker to crash wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2018-18226 (denial of service) A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the Steam IHS Discovery dissector where dynamically allocated memory was not properly freed on exception. This could be used by an attacker to crash wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2018-18227 (denial of service) A flaw has been discovered in wireshark >= 2.6.0 and < 2.6.4 in the MS-WSP dissector where an invalid type could lead to an assertion failure. This could be used by an attacker to crash wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== An attacker can crash wireshark or execute arbitrary code on the affected host by injecting a malformed packet onto the wire or by convincing a local user to read a malformed packet trace file. References ========== https://www.wireshark.org/docs/relnotes/wireshark-2.6.4.html https://www.wireshark.org/security/wnpa-sec-2018-50 https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foun… https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=fc9… https://www.wireshark.org/security/wnpa-sec-2018-49 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15172 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=b2b… https://www.wireshark.org/security/wnpa-sec-2018-48 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15171 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=6e9… https://www.wireshark.org/security/wnpa-sec-2018-47 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15119 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commitdiff;h=536… https://security.archlinux.org/CVE-2018-12086 https://security.archlinux.org/CVE-2018-18225 https://security.archlinux.org/CVE-2018-18226 https://security.archlinux.org/CVE-2018-18227

1 0

[ASA-201810-8] patch: multiple issues
by Remi Gacogne 10 Oct '18

10 Oct '18

Arch Linux Security Advisory ASA-201810-8 ========================================= Severity: High Date : 2018-10-09 CVE-ID : CVE-2018-6951 CVE-2018-6952 CVE-2018-1000156 Package : patch Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-619 Summary ======= The package patch before version 2.7.6-3 is vulnerable to multiple issues including arbitrary command execution and denial of service. Resolution ========== Upgrade to 2.7.6-3. # pacman -Syu "patch>=2.7.6-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2018-6951 (denial of service) An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuit_diff_type function in pch.c, aka a "mangled rename" issue. - CVE-2018-6952 (denial of service) A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. An attacker could potentially use this flaw to crash the patch utility by tricking it into processing crafted patches. - CVE-2018-1000156 (arbitrary command execution) An arbitrary command execution vulnerability has been found in patch versions prior to 2.7.7 when applying ed-style patches. Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch to pass certain ed scripts to the ed editor, which would run commands. This issue could be exploited to execute arbitrary commands as the user invoking patch against a specially crafted patch file, which could be leveraged to obtain elevated privileges. Impact ====== An attacker can execute arbitrary commands or crash the patch utility via a specially crafted patch file. References ========== https://bugs.archlinux.org/task/57526 https://savannah.gnu.org/bugs/?53132 https://git.savannah.gnu.org/cgit/patch.git/commit/?id=f290f48a621867084884… https://savannah.gnu.org/bugs/?53133 https://git.savannah.gnu.org/cgit/patch.git/commit/?id=9c986353e420ead6e706… https://savannah.gnu.org/bugs/?53566 https://git.savannah.gnu.org/cgit/patch.git/commit/?id=123eaff0d5d1aebe1282… https://security.archlinux.org/CVE-2018-6951 https://security.archlinux.org/CVE-2018-6952 https://security.archlinux.org/CVE-2018-1000156

1 0

[ASA-201810-7] git: arbitrary code execution
by Remi Gacogne 09 Oct '18

09 Oct '18

Arch Linux Security Advisory ASA-201810-7 ========================================= Severity: High Date : 2018-10-09 CVE-ID : CVE-2018-17456 Package : git Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-776 Summary ======= The package git before version 2.19.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.19.1-1. # pacman -Syu "git>=2.19.1-1" The problem has been fixed upstream in version 2.19.1. Workaround ========== None. Description =========== A security issue has been found in git versions prior to 2.19.1, which allows an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules. When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone". Impact ====== A remote attacker can execute arbitrary code on the affected host by convincing a local user to clone a specially crafted git repository and its sub-modules. References ========== https://marc.info/?l=git&m=153875888916397&w=2 https://git.kernel.org/pub/scm/git/git.git/commit/?id=98afac7a7cefdca0d2c49… https://git.kernel.org/pub/scm/git/git.git/commit/?id=f6adec4e329ef0e25e14c… https://git.kernel.org/pub/scm/git/git.git/commit/?id=273c61496f88c6495b886… https://security.archlinux.org/CVE-2018-17456

1 0

[ASA-201810-6] firefox: multiple issues
by Remi Gacogne 04 Oct '18

04 Oct '18

Arch Linux Security Advisory ASA-201810-6 ========================================= Severity: Critical Date : 2018-10-04 CVE-ID : CVE-2018-12386 CVE-2018-12387 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-775 Summary ======= The package firefox before version 62.0.3-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 62.0.3-1. # pacman -Syu "firefox>=62.0.3-1" The problems have been fixed upstream in version 62.0.3. Workaround ========== None. Description =========== - CVE-2018-12386 (arbitrary code execution) A vulnerability has been found in Firefox before 62.0.3 in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. - CVE-2018-12387 (information disclosure) A vulnerability has been found in Firefox before 62.0.3 where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. Impact ====== A remote attacker can execute arbitrary code on the affected host via crafted Javascript code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1493900 https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1493903 https://security.archlinux.org/CVE-2018-12386 https://security.archlinux.org/CVE-2018-12387

1 0

[ASA-201810-5] python-django: information disclosure
by Jelle van der Waa 03 Oct '18

03 Oct '18

Arch Linux Security Advisory ASA-201810-5 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-16984 Package : python-django Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-773 Summary ======= The package python-django before version 2.1.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.1.2-1. # pacman -Syu "python-django>=2.1.2-1" The problem has been fixed upstream in version 2.1.2. Workaround ========== None. Description =========== If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view (but not change) permission to the user model were displayed the entire hash. While it's typically infeasible to reverse a strong password hash, if your site uses weaker password hashing algorithms such as MD5 or SHA1, it could be a problem. Impact ====== A remote authenticated administrator with change permissions is able to obtain the password hashes of users. References ========== https://www.djangoproject.com/weblog/2018/oct/01/security-release/ https://github.com/django/django/commit/c4bd5b597e0aa2432e4c867b86650f18af1… https://security.archlinux.org/CVE-2018-16984

1 0