- Arch-security - lists.archlinux.org

[ASA-201810-4] lib32-libxml2: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-4 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : lib32-libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-673 Summary ======= The package lib32-libxml2 before version 2.9.8-4 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.8-4. # pacman -Syu "lib32-libxml2>=2.9.8-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in libxml2 <= 2.9.8 compiled with LZMA support enabled, in the xz_decomp function in xzlib.c. This flaw allows a remote attacker to cause a denial of service via an infinite loop, using a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR. Impact ====== A remote attacker is able to cause a denial of service by parsing a specially crafted XML payload. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=794914 https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e263… https://security.archlinux.org/CVE-2018-9251

1 0

[ASA-201810-3] libxml2: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-3 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-672 Summary ======= The package libxml2 before version 2.9.8-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.8-5. # pacman -Syu "libxml2>=2.9.8-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in libxml2 <= 2.9.8 compiled with LZMA support enabled, in the xz_decomp function in xzlib.c. This flaw allows a remote attacker to cause a denial of service via an infinite loop, using a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR. Impact ====== A remote attacker is able to cause a denial of service by parsing a specially crafted XML payload. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=794914 https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e263… https://security.archlinux.org/CVE-2018-9251

1 0

[ASA-201810-3] libxml2: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-3 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-672 Summary ======= The package libxml2 before version 2.9.8-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.8-5. # pacman -Syu "libxml2>=2.9.8-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in libxml2 <= 2.9.8 compiled with LZMA support enabled, in the xz_decomp function in xzlib.c. This flaw allows a remote attacker to cause a denial of service via an infinite loop, using a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR. Impact ====== A remote attacker is able to cause a denial of service by parsing a specially crafted XML payload. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=794914 https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e263… https://security.archlinux.org/CVE-2018-9251

1 0

[ASA-201810-2] ntp: arbitrary code execution
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-2 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-12327 Package : ntp Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-723 Summary ======= The package ntp before version 4.2.8.p12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.2.8.p12-1. # pacman -Syu "ntp>=4.2.8.p12-1" The problem has been fixed upstream in version 4.2.8.p12. Workaround ========== None. Description =========== Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. Impact ====== A local attacker is able to execute arbitrary code via specially crafted command line options. References ========== https://gist.github.com/fakhrizulkifli/9b58ed8e0354e8deee50b0eebd1c011f http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=5b3ba863G-42Ac2TFzCy-PZ8vqNfVA https://security.archlinux.org/CVE-2018-12327

1 0

[ASA-201810-1] mosquitto: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-1 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-12543 Package : mosquitto Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-772 Summary ======= The package mosquitto before version 1.5.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.5.3-1. # pacman -Syu "mosquitto>=1.5.3-1" The problem has been fixed upstream in version 1.5.3. Workaround ========== None. Description =========== If a message is sent to Mosquitto before 1.5.3 with a topic that begins with $, but is not $SYS, then an assert that should be unreachable is triggered and Mosquitto will exit. Impact ====== A remote attacker is able to cause a denial of service by sending a specially crafted mqtt message. References ========== https://mosquitto.org/blog/2018/09/security-advisory-cve-2018-12543/ https://github.com/eclipse/mosquitto/commit/f7474d348225bf086f6b9c69b18d641… https://security.archlinux.org/CVE-2018-12543

1 0

[ASA-201809-5] mediawiki: multiple issues
by Jelle van der Waa 28 Sep '18

28 Sep '18

Arch Linux Security Advisory ASA-201809-5 ========================================= Severity: Medium Date : 2018-09-25 CVE-ID : CVE-2018-0503 CVE-2018-0505 CVE-2018-13258 Package : mediawiki Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-765 Summary ======= The package mediawiki before version 1.31.1-1 is vulnerable to multiple issues including access restriction bypass and information disclosure. Resolution ========== Upgrade to 1.31.1-1. # pacman -Syu "mediawiki>=1.31.1-1" The problems have been fixed upstream in version 1.31.1. Workaround ========== None. Description =========== - CVE-2018-0503 (access restriction bypass) A security issue has been found in the rate limiting feature of mediawiki < 1.31.1 where, contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'. - CVE-2018-0505 (access restriction bypass) A security issue has been found in mediawiki < 1.31.1 where BotPassword can bypass CentralAuth's account lock. - CVE-2018-13258 (information disclosure) A security issue has been found in mediawiki < 1.31.1 where the tarball is missing .htaccess files used to protect some directories that shouldn't be web accessible. Impact ====== A remote attacker is able to bypass access restrictions put in place by the site administrator and/or gain access to restricted content. References ========== https://www.mediawiki.org/wiki/Release_notes/1.31 https://phabricator.wikimedia.org/T169545 https://github.com/wikimedia/mediawiki/commit/befd48c5f7d3d073de96c87375d73… https://phabricator.wikimedia.org/T194605 https://github.com/wikimedia/mediawiki/commit/ff6b4cb35c1944870fcd3cc525884… https://phabricator.wikimedia.org/T199029 https://github.com/wikimedia/mediawiki/commit/b78d595feecf9de919258b659628c… https://security.archlinux.org/CVE-2018-0503 https://security.archlinux.org/CVE-2018-0505 https://security.archlinux.org/CVE-2018-13258

1 0

[ASA-201809-4] strongswan: authentication bypass
by Jelle van der Waa 25 Sep '18

25 Sep '18

Arch Linux Security Advisory ASA-201809-4 ========================================= Severity: High Date : 2018-09-24 CVE-ID : CVE-2018-16151 CVE-2018-16152 Package : strongswan Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-769 Summary ======= The package strongswan before version 5.7.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 5.7.0-1. # pacman -Syu "strongswan>=5.7.0-1" The problems have been fixed upstream in version 5.7.0. Workaround ========== If the gmp plugin is loaded, make sure that none of the employed keys and certificates (including those of CAs) use keys with e = 3. Strongswan's tool to generate keys (pki --gen) always used e = 65537 (0x10001), which is not vulnerable, so certificates and keys generated with this tool are fine for use even with an unpatched gmp plugin. Description =========== - CVE-2018-16151 (authentication bypass) The OID parser allows any number of random bytes after a valid OID for a PKCS#1.5 signature. The asn1_known_oid() function just parses until it finds a leaf in the tree of known OIDs, any further data that follows is simply ignored. And the function that parses ASN.1 algorithmIdentifier structures doesn't care if the full OID data was parsed as it usually doesn't really matter. A missing check to reject junk and random key parameters allows attackers to carry out a Bleichenbacher-style attack on low-exponent keys and create forged signatures. - CVE-2018-16152 (authentication bypass) The algorithmIdentifier structure on a PKCS#1.5 signature contains an optional parameters field. While none of the algorithms used with PKCS#1 use parameters, i.e. the field should always be encoded as ASN.1 NULL value, the strongswan decoder doesn't enforce this and simply skips over the parameters. This allows an attacker to fill the field with random data which allows to carry out a Bleichenbacher-style attack on low-exponent keys and forge signatures or create arbitrary CA certificates. Impact ====== An attacker is able to use non-validated fields on a maliciously- crafted file to forge a signature or a CA certificate. References ========== https://wiki.strongswan.org/versions/70 https://github.com/strongswan/strongswan/commit/5955db5b124a1ee5f44c0845b6e… https://security.archlinux.org/CVE-2018-16151 https://security.archlinux.org/CVE-2018-16152

1 0

[ASA-201809-3] zsh: insufficient validation
by Jelle van der Waa 25 Sep '18

25 Sep '18

Arch Linux Security Advisory ASA-201809-3 ========================================= Severity: Low Date : 2018-09-24 CVE-ID : CVE-2018-0502 CVE-2018-13259 Package : zsh Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-764 Summary ======= The package zsh before version 5.6-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 5.6-1. # pacman -Syu "zsh>=5.6-1" The problems have been fixed upstream in version 5.6. Workaround ========== None. Description =========== - CVE-2018-0502 (insufficient validation) An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line. - CVE-2018-13259 (insufficient validation) An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one. Impact ====== A local attacker is able to execute arbitrary commands via a specially crafted shell script. References ========== https://www.zsh.org/mla/zsh-announce/136 https://bugs.debian.org/908000 https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a4022… https://security.archlinux.org/CVE-2018-0502 https://security.archlinux.org/CVE-2018-13259

1 0

[ASA-201809-2] bitcoin-qt: denial of service
by Christian Rebischke 22 Sep '18

22 Sep '18

Arch Linux Security Advisory ASA-201809-2 ========================================= Severity: Medium Date : 2018-09-22 CVE-ID : CVE-2018-17144 Package : bitcoin-qt Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-766 Summary ======= The package bitcoin-qt before version 0.16.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.16.3-1. # pacman -Syu "bitcoin-qt>=0.16.3-1" The problem has been fixed upstream in version 0.16.3. Workaround ========== None. Description =========== Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. Any attempts to double-spend a transaction output within a single transaction inside of a block where the output being spent was created in the same block, the same assertion failure will occur (as exists in the test case which was included in the 0.16.3 patch). However, if the output being double-spent was created in a previous block, an entry will still remain in the CCoin map with the DIRTY flag set and having been marked as spent, resulting in no such assertion. This could allow a miner to inflate the supply of Bitcoin as they would then be able to claim the value being spent twice. Impact ====== A remote attacker is able to crash the bitcoin-daemon or the bitcoin-qt application. This vulnerability could allow a miner to inflate the supply of Bitcoin as they would then be able to claim value being spent twice. References ========== https://bitcoincore.org/en/2018/09/20/notice/ https://security.archlinux.org/CVE-2018-17144

1 0

[ASA-201809-1] bitcoin-daemon: denial of service
by Christian Rebischke 22 Sep '18

22 Sep '18

Arch Linux Security Advisory ASA-201809-1 ========================================= Severity: Medium Date : 2018-09-22 CVE-ID : CVE-2018-17144 Package : bitcoin-daemon Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-766 Summary ======= The package bitcoin-daemon before version 0.16.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.16.3-1. # pacman -Syu "bitcoin-daemon>=0.16.3-1" The problem has been fixed upstream in version 0.16.3. Workaround ========== None. Description =========== Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. Any attempts to double-spend a transaction output within a single transaction inside of a block where the output being spent was created in the same block, the same assertion failure will occur (as exists in the test case which was included in the 0.16.3 patch). However, if the output being double-spent was created in a previous block, an entry will still remain in the CCoin map with the DIRTY flag set and having been marked as spent, resulting in no such assertion. This could allow a miner to inflate the supply of Bitcoin as they would then be able to claim the value being spent twice. Impact ====== A remote attacker is able to crash the bitcoin-daemon or the bitcoin-qt application. This vulnerability could allow a miner to inflate the supply of Bitcoin as they would then be able to claim value being spent twice. References ========== https://bitcoincore.org/en/2018/09/20/notice/ https://security.archlinux.org/CVE-2018-17144

1 0