- Arch-security - lists.archlinux.org

[ASA-201806-8] gnupg: content spoofing
by Remi Gacogne 14 Jun '18

14 Jun '18

Arch Linux Security Advisory ASA-201806-8 ========================================= Severity: High Date : 2018-06-11 CVE-ID : CVE-2018-12020 Package : gnupg Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-713 Summary ======= The package gnupg before version 2.2.8-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 2.2.8-1. # pacman -Syu "gnupg>=2.2.8-1" The problem has been fixed upstream in version 2.2.8. Workaround ========== None. Description =========== A security issue has been found in gnupg before 2.2.8, leading to the possibility of faking verification status of signed content. The OpenPGP protocol allows to include the file name of the original input file into a signed or encrypted message. During decryption and verification the GPG tool can display a notice with that file name. The displayed file name is not sanitized and as such may include line feeds or other control characters. This can be used inject terminal control sequences into the out and, worse, to fake the so-called status messages. These status messages are parsed by programs to get information from gpg about the validity of a signature and an other parameters. Status messages are created with the option "--status-fd N" where N is a file descriptor. Now if N is 2 the status messages and the regular diagnostic messages share the stderr output channel. By using a made up file name in the message it is possible to fake status messages. Using this technique it is for example possible to fake the verification status of a signed mail. Impact ====== A remote attacker might be able to fake the verification status of a signed e-mail or file, via a crafted file name. References ========== https://bugs.archlinux.org/task/58931 https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html https://dev.gnupg.org/T4012 https://dev.gnupg.org/rG210e402acd3e284b32db1901e43bf1470e659e49 https://security.archlinux.org/CVE-2018-12020

1 0

[ASA-201806-7] flashplugin: multiple issues
by Remi Gacogne 10 Jun '18

10 Jun '18

Arch Linux Security Advisory ASA-201806-7 ========================================= Severity: Critical Date : 2018-06-09 CVE-ID : CVE-2018-4945 CVE-2018-5000 CVE-2018-5001 CVE-2018-5002 Package : flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-716 Summary ======= The package flashplugin before version 30.0.0.113-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 30.0.0.113-1. # pacman -Syu "flashplugin>=30.0.0.113-1" The problems have been fixed upstream in version 30.0.0.113. Workaround ========== None. Description =========== - CVE-2018-4945 (arbitrary code execution) A type confusion issue has been found in Adobe Flash Player before 30.0.0.113, leading to arbitrary code execution. - CVE-2018-5000 (information disclosure) An integer overflow issue has been found in Adobe Flash Player before 30.0.0.113, leading to information disclosure. - CVE-2018-5001 (information disclosure) An out-of-bounds read has been found in Adobe Flash Player before 30.0.0.113, leading to information disclosure. - CVE-2018-5002 (arbitrary code execution) A stack-based buffer overflow has been found in Adobe Flash Player before 30.0.0.113, leading to arbitrary code execution. Impact ====== A remote attacker can access sensitive information or execute arbitrary code via a crafted Flash file. References ========== https://helpx.adobe.com/security/products/flash-player/apsb18-19.html https://security.archlinux.org/CVE-2018-4945 https://security.archlinux.org/CVE-2018-5000 https://security.archlinux.org/CVE-2018-5001 https://security.archlinux.org/CVE-2018-5002

1 0

[ASA-201806-6] p7zip: arbitrary code execution
by Remi Gacogne 10 Jun '18

10 Jun '18

Arch Linux Security Advisory ASA-201806-6 ========================================= Severity: Critical Date : 2018-06-09 CVE-ID : CVE-2018-10115 Package : p7zip Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-714 Summary ======= The package p7zip before version 16.02-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 16.02-5. # pacman -Syu "p7zip>=16.02-5" The problem has been fixed upstream in version 18.05. Workaround ========== None. Description =========== An uninitialized memory security issue has been found in the RAR decoder component of 7-Zip before 18.05, resulting in arbitrary code execution. Impact ====== A remote attacker can execute arbitrary code via a crafted RAR file. References ========== https://bugs.archlinux.org/task/58907 https://landave.io/2018/05/7-zip-from-uninitialized-memory-to-remote-code-e… https://landave.io/files/patch_7zip_CVE-2018-10115.txt https://security.archlinux.org/CVE-2018-10115

1 0

[ASA-201806-5] firefox: arbitrary code execution
by Remi Gacogne 10 Jun '18

10 Jun '18

Arch Linux Security Advisory ASA-201806-5 ========================================= Severity: High Date : 2018-06-08 CVE-ID : CVE-2018-6126 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-715 Summary ======= The package firefox before version 60.0.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 60.0.2-1. # pacman -Syu "firefox>=60.0.2-1" The problem has been fixed upstream in version 60.0.2. Workaround ========== None. Description =========== A heap-based buffer overflow has been found in the Skia component of the Firefox browser before 60.0.2, when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. Impact ====== A remote attacker can execute arbitrary code via a crafted SVG file. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/#CVE-2018-6126 https://bugzilla.mozilla.org/show_bug.cgi?id=1462682 https://security.archlinux.org/CVE-2018-6126

1 0

[ASA-201806-4] chromium: access restriction bypass
by Remi Gacogne 09 Jun '18

09 Jun '18

Arch Linux Security Advisory ASA-201806-4 ========================================= Severity: High Date : 2018-06-07 CVE-ID : CVE-2018-6148 Package : chromium Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-712 Summary ======= The package chromium before version 67.0.3396.79-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 67.0.3396.79-1. # pacman -Syu "chromium>=67.0.3396.79-1" The problem has been fixed upstream in version 67.0.3396.79. Workaround ========== None. Description =========== An incorrect handling of CSP header has been found in chromium before 67.0.3396.79. Impact ====== A remote attacker can bypass the content security policy. References ========== https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-des… https://crbug.com/845961 https://security.archlinux.org/CVE-2018-6148

1 0

[ASA-201806-3] krb5: insufficient validation
by Remi Gacogne 09 Jun '18

09 Jun '18

Arch Linux Security Advisory ASA-201806-3 ========================================= Severity: Medium Date : 2018-06-05 CVE-ID : CVE-2018-5729 CVE-2018-5730 Package : krb5 Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-586 Summary ======= The package krb5 before version 1.16.1-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.16.1-1. # pacman -Syu "krb5>=1.16.1-1" The problems have been fixed upstream in version 1.16.1. Workaround ========== None. Description =========== - CVE-2018-5729 (insufficient validation) A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can cause a null dereference in kadmind, or circumvent a DN container check, by supplying tagged data intended to be internal to the database module. - CVE-2018-5730 (insufficient validation) A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. Impact ====== An authenticated kadmin user can elevate privileges or crash the application via a crafted DN. References ========== https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/I… https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1 https://security.archlinux.org/CVE-2018-5729 https://security.archlinux.org/CVE-2018-5730

1 0

[ASA-201806-2] radare2: multiple issues
by Jelle van der Waa 07 Jun '18

07 Jun '18

Arch Linux Security Advisory ASA-201806-2 ========================================= Severity: High Date : 2018-06-05 CVE-ID : CVE-2018-11375 CVE-2018-11376 CVE-2018-11377 CVE-2018-11378 CVE-2018-11379 CVE-2018-11380 CVE-2018-11381 CVE-2018-11382 CVE-2018-11383 CVE-2018-11384 Package : radare2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-709 Summary ======= The package radare2 before version 2.6.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.6.0-1. # pacman -Syu "radare2>=2.6.0-1" The problems have been fixed upstream in version 2.6.0. Workaround ========== None. Description =========== - CVE-2018-11375 (denial of service) The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11376 (denial of service) The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file. - CVE-2018-11377 (denial of service) The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11378 (arbitrary code execution) The wasm_dis() function in libr/asm/arch/wasm/wasm.c has a stack-buffer overflow that may result in denial-of-service or possibly have unspecified other impact via a crafted WASM file. - CVE-2018-11379 (denial of service) The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted PE file. - CVE-2018-11380 (denial of service) The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted Mach-O file. - CVE-2018-11381 (denial of service) The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11382 (denial of service) The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11383 (denial of service) The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr.c. - CVE-2018-11384 (denial of service) The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file. Impact ====== A remote attacker is able to execute arbitrary code or crash the application via a specially crafted file. References ========== https://github.com/radare/radare2/commit/041e53cab7ca33481ae45ecd65ad596976… https://github.com/radare/radare2/issues/9928 https://github.com/radare/radare2/commit/1f37c04f2a762500222dda2459e6a04646… https://github.com/radare/radare2/issues/9904 https://github.com/radare/radare2/commit/25a3703ef2e015bbe1d1f16f6b2f63bb10… https://github.com/radare/radare2/commit/b35530fa0681b27eba084de5527037ebfb… https://github.com/radare/radare2/issues/9901 https://github.com/radare/radare2/commit/bd276ef2fd8ac3401e65be7c126a43175c… https://github.com/radare/radare2/issues/9969 https://github.com/radare/radare2/commit/4e1cf0d3e6f6fe2552a269def0af1cd240… https://github.com/radare/radare2/issues/9926 https://github.com/radare/radare2/commit/60208765887f5f008b3b9a883f3addc8bd… https://github.com/radare/radare2/issues/9970 https://github.com/radare/radare2/commit/3fcf41ed96ffa25b38029449520c8d0a19… https://github.com/radare/radare2/issues/9902 https://github.com/radare/radare2/commit/d04c78773f6959bcb427453f8e5b9824d5… https://github.com/radare/radare2/issues/10091 https://github.com/radare/radare2/commit/9d348bcc2c4bbd3805e7eec97b594be9fe… https://github.com/radare/radare2/issues/9943 https://github.com/radare/radare2/commit/77c47cf873dd55b396da60baa2ca83bbd3… https://github.com/radare/radare2/issues/9903 https://security.archlinux.org/CVE-2018-11375 https://security.archlinux.org/CVE-2018-11376 https://security.archlinux.org/CVE-2018-11377 https://security.archlinux.org/CVE-2018-11378 https://security.archlinux.org/CVE-2018-11379 https://security.archlinux.org/CVE-2018-11380 https://security.archlinux.org/CVE-2018-11381 https://security.archlinux.org/CVE-2018-11382 https://security.archlinux.org/CVE-2018-11383 https://security.archlinux.org/CVE-2018-11384

1 0

[ASA-201806-1] git: multiple issues
by Jelle van der Waa 05 Jun '18

05 Jun '18

Arch Linux Security Advisory ASA-201806-1 ========================================= Severity: Critical Date : 2018-06-01 CVE-ID : CVE-2018-11233 CVE-2018-11235 Package : git Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-711 Summary ======= The package git before version 2.17.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2.17.1-1. # pacman -Syu "git>=2.17.1-1" The problems have been fixed upstream in version 2.17.1. Workaround ========== None. Description =========== - CVE-2018-11233 (information disclosure) A security issue has been found in git before 2.17.1, where the code that sanify-check paths in is_ntfs_dotgit() could have been tricked into reading random pieces of memory. - CVE-2018-11235 (arbitrary code execution) A security issue has been found in git before 2.17.1. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server. Impact ====== A remote attacker can execute arbitrary code on the affected host by placing a crafted .gitmodules file in a repository cloned by a local user, or access sensitive information via a crafted path in such a repository. References ========== https://lkml.org/lkml/2018/5/29/889 https://github.com/gitster/git/commit/11a9f4d807a0d71dc6eff51bb87baf4ca2ccc… https://security.archlinux.org/CVE-2018-11233 https://security.archlinux.org/CVE-2018-11235

1 0

[ASA-201805-26] strongswan: denial of service
by Christian Rebischke 29 May '18

29 May '18

Arch Linux Security Advisory ASA-201805-26 ========================================== Severity: Low Date : 2018-05-26 CVE-ID : CVE-2018-5388 Package : strongswan Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-710 Summary ======= The package strongswan before version 5.6.2-2 is vulnerable to denial of service. Resolution ========== Upgrade to 5.6.2-2. # pacman -Syu "strongswan>=5.6.2-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== strongSwan VPN's charon server prior to version 5.6.3 is missing a packet length check in stroke_socket.c, allowing a buffer overflow which may lead to resource exhaustion and denial of service while reading from the socket. According to the vendor, an attacker must typically have local root permissions to access the socket. However, other accounts and groups such as the vpn group (if capability dropping in enabled, for example) may also have sufficient permissions, but this configuration does not appear to be the default behavior. Impact ====== A local attacker with access to the VPN socket is able to crash the service. References ========== https://bugs.archlinux.org/task/58719 https://www.kb.cert.org/vuls/id/338343 https://git.strongswan.org/?p=strongswan.git;a=commitdiff;h=0acd1ab4 https://security.archlinux.org/CVE-2018-5388

1 0

[ASA-201805-25] wireshark-cli: multiple issues
by Remi Gacogne 29 May '18

29 May '18

Arch Linux Security Advisory ASA-201805-25 ========================================== Severity: Critical Date : 2018-05-25 CVE-ID : CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 Package : wireshark-cli Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-708 Summary ======= The package wireshark-cli before version 2.6.1-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 2.6.1-1. # pacman -Syu "wireshark-cli>=2.6.1-1" The problems have been fixed upstream in version 2.6.1. Workaround ========== None. Description =========== - CVE-2018-11354 (information disclosure) An out-of-bounds read has been found in the IEEE 1905.1a dissector of Wireshark <= 2.6.0. - CVE-2018-11355 (arbitrary code execution) A heap-based buffer overflow has been found in the RTCP dissector of Wireshark <= 2.6.0. - CVE-2018-11356 (denial of service) A null-pointer dereference has been found in the DNS dissector of Wireshark <= 2.6.0. - CVE-2018-11357 (denial of service) An integer overflow leading to excessive memory allocation has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11358 (arbitrary code execution) A heap-based use-after-free has been found in the Q.931 dissector of Wireshark <= 2.6.0. - CVE-2018-11359 (denial of service) A null-pointer dereference has been found in several dissectors of Wireshark <= 2.6.0. - CVE-2018-11360 (arbitrary code execution) A heap-based off-by-one write has been found in the GSM A DTAP dissector of Wireshark <= 2.6.0. - CVE-2018-11361 (denial of service) A heap-based out-of-bounds read has been found in the IEEE 802.11 dissector of Wireshark <= 2.6.0. - CVE-2018-11362 (information disclosure) An out-of-bounds read has been found in the LDSS dissector of Wireshark <= 2.6.0. Impact ====== A remote attacker can crash the application, access sensitive information present in memory or execute arbitrary code on the affected host via a specially crafted network packet or by convincing a local user to open a specially crafted PCAP file. References ========== https://www.wireshark.org/security/wnpa-sec-2018-26.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14647 https://www.wireshark.org/security/wnpa-sec-2018-27.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14673 https://www.wireshark.org/security/wnpa-sec-2018-29.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14681 https://www.wireshark.org/security/wnpa-sec-2018-28.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14678 https://www.wireshark.org/security/wnpa-sec-2018-31.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14689 https://www.wireshark.org/security/wnpa-sec-2018-33.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14703 https://www.wireshark.org/security/wnpa-sec-2018-30.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14688 https://www.wireshark.org/security/wnpa-sec-2018-32.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14686 https://www.wireshark.org/security/wnpa-sec-2018-25.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14615 https://security.archlinux.org/CVE-2018-11354 https://security.archlinux.org/CVE-2018-11355 https://security.archlinux.org/CVE-2018-11356 https://security.archlinux.org/CVE-2018-11357 https://security.archlinux.org/CVE-2018-11358 https://security.archlinux.org/CVE-2018-11359 https://security.archlinux.org/CVE-2018-11360 https://security.archlinux.org/CVE-2018-11361 https://security.archlinux.org/CVE-2018-11362

1 0