- Arch-security - lists.archlinux.org

[ASA-201805-4] mupdf: multiple issues
by Santiago Torres-Arias 10 May '18

10 May '18

Arch Linux Security Advisory ASA-201805-4 ========================================= Severity: High Date : 2018-05-09 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : mupdf Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-609 Summary ======= The package mupdf before version 1.13.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.13.0-1. # pacman -Syu "mupdf>=1.13.0-1" The problems have been fixed upstream in version 1.13.0. Workaround ========== None. Description =========== - CVE-2018-5686 (denial of service) In MuPDF 1.12.0, there is an infinite loop vulnerability and application hang in the pdf_parse_array function (pdf/pdf-parse.c) because EOF is not considered. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6187 (denial of service) In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow vulnerability in the do_pdf_save_document function in the pdf/pdf- write.c file. Remote attackers could leverage the vulnerability to cause a denial of service via a crafted pdf file. - CVE-2018-6192 (denial of service) In Artifex MuPDF 1.12.0, the pdf_read_new_xref function in pdf/pdf- xref.c allows remote attackers to cause a denial of service (segmentation violation and application crash) via a crafted pdf file. - CVE-2018-6544 (denial of service) pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document. - CVE-2018-1000051 (arbitrary code execution) Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appear to be exploitable via Victim opens a specially crafted PDF. Impact ====== A remote attacker is able to crash the application or execute arbitrary code via a specially crafted PDF file. References ========== https://bugs.archlinux.org/task/57486 https://bugs.ghostscript.com/show_bug.cgi?id=698860 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b70eb93f6936c03d8af… https://bugs.ghostscript.com/show_bug.cgi?id=698908 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=3e30fbb7bf5efd88df4… https://bugs.ghostscript.com/show_bug.cgi?id=698916 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=5e411a99604ff6be5db… https://git.ghostscript.com/?p=mupdf.git;h=fa9cd085533f68367c299e058ab3fbb7… https://bugs.ghostscript.com/show_bug.cgi?id=698965 https://bugs.ghostscript.com/show_bug.cgi?id=698830 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=b03def134988da8c800… https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=26527eef77b3e51c225… https://bugs.ghostscript.com/show_bug.cgi?id=698825 https://bugs.ghostscript.com/show_bug.cgi?id=698873 https://git.ghostscript.com/?p=mupdf.git;a=commitdiff;h=321ba1de287016b0036… https://security.archlinux.org/CVE-2018-5686 https://security.archlinux.org/CVE-2018-6187 https://security.archlinux.org/CVE-2018-6192 https://security.archlinux.org/CVE-2018-6544 https://security.archlinux.org/CVE-2018-1000051

1 0

[ASA-201805-3] freetype2: denial of service
by Jelle van der Waa 09 May '18

09 May '18

Arch Linux Security Advisory ASA-201805-3 ========================================= Severity: Low Date : 2018-05-09 CVE-ID : CVE-2018-6942 Package : freetype2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-613 Summary ======= The package freetype2 before version 2.9.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.1-1. # pacman -Syu "freetype2>=2.9.1-1" The problem has been fixed upstream in version 2.9.1. Workaround ========== None. Description =========== An issue was discovered in FreeType 2 before 2.9.1. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to denial of service via a crafted font file. Impact ====== A remote attacker is able to cause a denial of service via a specially crafted file. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5736 https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=29c7592… https://security.archlinux.org/CVE-2018-6942

1 0

[ASA-201805-2] libraw: multiple issues
by Jelle van der Waa 09 May '18

09 May '18

Arch Linux Security Advisory ASA-201805-2 ========================================= Severity: Critical Date : 2018-05-09 CVE-ID : CVE-2018-10528 CVE-2018-10529 Package : libraw Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-681 Summary ======= The package libraw before version 0.18.10-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 0.18.10-1. # pacman -Syu "libraw>=0.18.10-1" The problems have been fixed upstream in version 0.18.10. Workaround ========== None. Description =========== - CVE-2018-10528 (arbitrary code execution) A stack-based buffer overflow has been found in LibRaw before 0.18.10, in the utf2char() function in libraw_cxx.cpp. - CVE-2018-10529 (information disclosure) An out-of-bounds read has been found in LibRaw before 0.18.10, in the X3F property table list implementation in libraw_x3f.cpp and libraw_cxx.cpp Impact ====== A remote attacker is able to execute arbitrary code or disclose information by providing a specially crafted file. References ========== https://bugs.archlinux.org/task/58393 https://github.com/LibRaw/LibRaw/issues/144 https://github.com/LibRaw/LibRaw/commit/895529fc2f2eb8bc633edd6b04b5b237eb4… https://github.com/LibRaw/LibRaw/commit/6f89e5505b1759b788f15cd14d0958b262b… https://github.com/LibRaw/LibRaw/commit/efd8cfabb93fd0396266a7607069901657c… https://github.com/LibRaw/LibRaw/commit/f0c505a3e5d47989a5f69be2d0d4f250af6… https://github.com/LibRaw/LibRaw/commit/6b08eae24034789b3543a1b66dd6af9c202… https://security.archlinux.org/CVE-2018-10528 https://security.archlinux.org/CVE-2018-10529

1 0

[ASA-201805-1] powerdns: arbitrary code execution
by Jelle van der Waa 09 May '18

09 May '18

Arch Linux Security Advisory ASA-201805-1 ========================================= Severity: High Date : 2018-05-09 CVE-ID : CVE-2018-1046 Package : powerdns Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-686 Summary ======= The package powerdns before version 4.1.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.1.2-1. # pacman -Syu "powerdns>=4.1.2-1" The problem has been fixed upstream in version 4.1.2. Workaround ========== None. Description =========== An issue has been found in the dnsreplay tool provided with PowerDNS Authoritative, where replaying a specially crafted PCAP file can trigger a stack based buffer overflow, leading to a crash and potentially arbitrary code execution. This buffer overflow only occurs when the --ecs-stamp option of dnsreplay is used. Regardless of this issue, the use of dnsreplay with untrusted PCAP files is not advised. Impact ====== A local attacker is be able to cause a denial of service or execute arbitrary code via a specially crafted PCAP file. References ========== https://marc.info/?l=oss-security&m=152585376901543 https://github.com/PowerDNS/pdns/commit/f9c57c98da1b1007a51680629b667d57d9b… https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisor… https://security.archlinux.org/CVE-2018-1046

1 0

[ASA-201804-10] drupal: arbitrary command execution
by Jelle van der Waa 29 Apr '18

29 Apr '18

Arch Linux Security Advisory ASA-201804-10 ========================================== Severity: Critical Date : 2018-04-27 CVE-ID : CVE-2018-7602 Package : drupal Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-679 Summary ======= The package drupal before version 8.5.3-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 8.5.3-1. # pacman -Syu "drupal>=8.5.3-1" The problem has been fixed upstream in version 8.5.3. Workaround ========== None. Description =========== A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. Impact ====== A remote attacker is able to execute arbitrary code by performing a specially crafted request. References ========== https://www.drupal.org/sa-core-2018-004 https://github.com/drupal/drupal/commit/bb6d396609600d1169da29456ba3db59aba… https://security.archlinux.org/CVE-2018-7602

1 0

[ASA-201804-9] xfig: information disclosure
by Jelle van der Waa 23 Apr '18

23 Apr '18

Arch Linux Security Advisory ASA-201804-9 ========================================= Severity: Medium Date : 2018-04-19 CVE-ID : CVE-2017-16899 Package : xfig Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-513 Summary ======= The package xfig before version 3.2.7-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 3.2.7-1. # pacman -Syu "xfig>=3.2.7-1" The problem has been fixed upstream in version 3.2.7. Workaround ========== None. Description =========== An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file, related to a negative font value in dev/gentikz.c, and the read_textobject functions in read.c and read1_3.c. Impact ====== A remote attacker is able to crash the application or possibly disclose sensitive information on the affected host. References ========== https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881143 https://security.archlinux.org/CVE-2017-16899

1 0

[ASA-201804-8] roundcubemail: arbitrary command execution
by Jelle van der Waa 23 Apr '18

23 Apr '18

Arch Linux Security Advisory ASA-201804-8 ========================================= Severity: High Date : 2018-04-19 CVE-ID : CVE-2018-9846 Package : roundcubemail Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-670 Summary ======= The package roundcubemail before version 1.3.6-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 1.3.6-1. # pacman -Syu "roundcubemail>=1.3.6-1" The problem has been fixed upstream in version 1.3.6. Workaround ========== Disable the archive plugin. Description =========== In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user- controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism. Impact ====== A remote attacker is able to execute arbitrary IMAP commands via a specially crafted url. References ========== https://github.com/roundcube/roundcubemail/issues/6229 https://github.com/roundcube/roundcubemail/issues/6238 https://medium.com/@ndrbasi/cve-2018-9846-roundcube-303097048b0a https://roundcube.net/news/2018/04/11/security-update-1.3.6 https://security.archlinux.org/CVE-2018-9846

1 0

[ASA-201804-7] zsh: denial of service
by Jelle van der Waa 23 Apr '18

23 Apr '18

Arch Linux Security Advisory ASA-201804-7 ========================================= Severity: Medium Date : 2018-04-19 CVE-ID : CVE-2018-7548 CVE-2018-7549 Package : zsh Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-642 Summary ======= The package zsh before version 5.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.5-1. # pacman -Syu "zsh>=5.5-1" The problems have been fixed upstream in version 5.5. Workaround ========== None. Description =========== - CVE-2018-7548 (denial of service) In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result. - CVE-2018-7549 (denial of service) In params.c in zsh through 5.4.2, there is a crash during a copy of an empty hash table, as demonstrated by typeset -p. Impact ====== A local attacker can cause a denial of service via a specially input. References ========== https://sourceforge.net/p/zsh/code/ci/110b13e1090bc31ac1352b28adc2d02b6d25a… https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec43… https://security.archlinux.org/CVE-2018-7548 https://security.archlinux.org/CVE-2018-7549

1 0

[ASA-201804-6] lib32-openssl: private key recovery
by Remi Gacogne 15 Apr '18

15 Apr '18

Arch Linux Security Advisory ASA-201804-6 ========================================= Severity: Medium Date : 2018-04-15 CVE-ID : CVE-2017-3738 Package : lib32-openssl Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-551 Summary ======= The package lib32-openssl before version 1:1.1.0.h-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1:1.1.0.h-1. # pacman -Syu "lib32-openssl>=1:1.1.0.h-1" The problem has been fixed upstream in version 1.1.0.h. Workaround ========== None. Description =========== There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. Impact ====== A remote attacker might be able to recover a private key (in very unlikely cases). References ========== https://www.openssl.org/news/vulnerabilities.html#2017-3738 https://www.openssl.org/news/secadv/20171207.txt https://github.com/openssl/openssl/commit/5630661aecbea5fe3c4740f5fea744a1f… https://security.archlinux.org/CVE-2017-3738

1 0

[ASA-201804-5] zsh: arbitrary code execution
by Remi Gacogne 15 Apr '18

15 Apr '18

Arch Linux Security Advisory ASA-201804-5 ========================================= Severity: High Date : 2018-04-11 CVE-ID : CVE-2018-1100 Package : zsh Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-669 Summary ======= The package zsh before version 5.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.5-1. # pacman -Syu "zsh>=5.5-1" The problem has been fixed upstream in version 5.5. Workaround ========== None. Description =========== A stack-based buffer overflow has been found in zsh <= 5.4.2, in the checkmailpath() function, where unchecked strings from the MAILCHECK variable are copied to a buffer. A local, unprivileged user can create a specially crafted message file, which, if used to set a custom "you have new mail" message, leads to code execution in the context of the user who receives the message. If the user affected is privileged, this leads to privilege escalation. Impact ====== A local attacker might be able to execute arbitrary code in the context of another user. References ========== https://www.zsh.org/mla/workers/2018/msg00411.html https://sourceforge.net/p/zsh/code/ci/31f72205630687c1cef89347863aab355296a… https://security.archlinux.org/CVE-2018-1100

1 0