- Arch-security - lists.archlinux.org

[ASA-201804-4] apache: multiple issues
by Santiago Torres-Arias 12 Apr '18

12 Apr '18

Arch Linux Security Advisory ASA-201804-4 ========================================= Severity: Medium Date : 2018-04-04 CVE-ID : CVE-2017-15710 CVE-2017-15715 CVE-2018-1283 CVE-2018-1301 CVE-2018-1302 CVE-2018-1303 CVE-2018-1312 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-664 Summary ======= The package apache before version 2.4.33-1 is vulnerable to multiple issues including session hijacking, access restriction bypass, content spoofing and denial of service. Resolution ========== Upgrade to 2.4.33-1. # pacman -Syu "apache>=2.4.33-1" The problems have been fixed upstream in version 2.4.33. Workaround ========== None. Description =========== - CVE-2017-15710 (denial of service) In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en- US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all. - CVE-2017-15715 (access restriction bypass) In Apache httpd 2.4.0 before 2.4.30, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are externally blocked, but only by matching the trailing portion of the filename. - CVE-2018-1283 (session hijacking) In Apache httpd 2.2.0 before 2.4.30, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications. - CVE-2018-1301 (denial of service) A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage. - CVE-2018-1302 (denial of service) When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk. - CVE-2018-1303 (denial of service) A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. - CVE-2018-1312 (content spoofing) In Apache httpd 2.2.0 before 2.4.30, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection. Impact ====== A remote attacker is able to crash a server, hijack a user session, upload arbitrary files or spoof requests by providing a crafted request. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://security.archlinux.org/CVE-2017-15710 https://security.archlinux.org/CVE-2017-15715 https://security.archlinux.org/CVE-2018-1283 https://security.archlinux.org/CVE-2018-1301 https://security.archlinux.org/CVE-2018-1302 https://security.archlinux.org/CVE-2018-1303 https://security.archlinux.org/CVE-2018-1312

1 0

[ASA-201804-3] zziplib: denial of service
by Santiago Torres-Arias 09 Apr '18

09 Apr '18

Arch Linux Security Advisory ASA-201804-3 ========================================= Severity: Medium Date : 2018-04-04 CVE-ID : CVE-2018-7725 CVE-2018-7726 CVE-2018-7727 Package : zziplib Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-612 Summary ======= The package zziplib before version 0.13.69-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.13.69-1. # pacman -Syu "zziplib>=0.13.69-1" The problems have been fixed upstream in version 0.13.69. Workaround ========== None. Description =========== - CVE-2018-7725 (denial of service) An out of bounds read was found in function zzip_disk_fread of ZZIPlib before 0.13.69, when ZZIPlib mem_disk functionality is used. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. - CVE-2018-7726 (denial of service) An improper input validation was found in function __zzip_fetch_disk_trailer of ZZIPlib before 0.13.69, that could lead to a crash in __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. - CVE-2018-7727 (denial of service) A memory leak was found in unzip-mem.c and unzzip-mem.c of ZZIPlib before 0.13.69, that could lead to resource exhaustion. Local attackers could leverage this vulnerability to cause a denial of service via a crafted zip file. Impact ====== A remote attacker can cause a denial of service via a specially crafted zip file. References ========== https://github.com/gdraheim/zziplib/issues/39 https://github.com/gdraheim/zziplib/commit/1ba660b3300d67b8ce9f6b96bbae0b36… https://github.com/gdraheim/zziplib/issues/41 https://github.com/gdraheim/zziplib/commit/19c9e4dc6c5cf92a38d0d23dbccac699… https://github.com/gdraheim/zziplib/commit/feae4da1a5c92100c44ebfcbaaa89595… https://github.com/gdraheim/zziplib/issues/40 https://github.com/gdraheim/zziplib/commit/83a2da55922f67e07f22048ac9671a44… https://security.archlinux.org/CVE-2018-7725 https://security.archlinux.org/CVE-2018-7726 https://security.archlinux.org/CVE-2018-7727

1 0

[ASA-201804-2] openssl: multiple issues
by Santiago Torres-Arias 09 Apr '18

09 Apr '18

Arch Linux Security Advisory ASA-201804-2 ========================================= Severity: Medium Date : 2018-04-01 CVE-ID : CVE-2017-3738 CVE-2018-0739 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-540 Summary ======= The package openssl before version 1.1.0.h-1 is vulnerable to multiple issues including denial of service and private key recovery. Resolution ========== Upgrade to 1.1.0.h-1. # pacman -Syu "openssl>=1.1.0.h-1" The problems have been fixed upstream in version 1.1.0.h. Workaround ========== None. Description =========== - CVE-2017-3738 (private key recovery) There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. - CVE-2018-0739 (denial of service) A stack-exhaustion issue has been found in OpenSSL <= 1.1.0h, where constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Impact ====== A remote attacker might be able to recover a private key (in very unlikely cases), or cause a denial of service by providing a crafted ASN.1 type to a vulnerable application. References ========== https://www.openssl.org/news/vulnerabilities.html#2017-3738 https://www.openssl.org/news/secadv/20171207.txt https://github.com/openssl/openssl/commit/5630661aecbea5fe3c4740f5fea744a1f… https://www.openssl.org/news/secadv/20180327.txt https://github.com/openssl/openssl/commit/2ac4c6f7b2b2af20c0e2b0ba05367e454… https://security.archlinux.org/CVE-2017-3738 https://security.archlinux.org/CVE-2018-0739

1 0

[ASA-201804-1] drupal: arbitrary code execution
by Jelle van der Waa 04 Apr '18

04 Apr '18

Arch Linux Security Advisory ASA-201804-1 ========================================= Severity: Critical Date : 2018-04-01 CVE-ID : CVE-2018-7600 Package : drupal Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-665 Summary ======= The package drupal before version 8.5.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.5.1-1. # pacman -Syu "drupal>=8.5.1-1" The problem has been fixed upstream in version 8.5.1. Workaround ========== None. Description =========== A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. Impact ====== A remote attacker is able to execute arbitrary code by performing a specially crafted request. References ========== https://www.drupal.org/sa-core-2018-002 https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-ne… https://github.com/drupal/drupal/commit/5ac8738fa69df34a0635f0907d661b509ff… https://security.archlinux.org/CVE-2018-7600

1 0

[ASA-201803-24] bchunk: denial of service
by Remi Gacogne 26 Mar '18

26 Mar '18

Arch Linux Security Advisory ASA-201803-24 ========================================== Severity: Medium Date : 2018-03-25 CVE-ID : CVE-2017-15953 CVE-2017-15954 CVE-2017-15955 Package : bchunk Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-475 Summary ======= The package bchunk before version 1.2.2-4 is vulnerable to denial of service. Resolution ========== Upgrade to 1.2.2-4. # pacman -Syu "bchunk>=1.2.2-4" The problems have been fixed upstream in version 1.2.2. Workaround ========== None. Description =========== - CVE-2017-15953 (denial of service) bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap- based buffer overflow and crash when processing a malformed CUE (.cue) file. - CVE-2017-15954 (denial of service) bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to a heap- based buffer overflow (with a resultant invalid free) and crash when processing a malformed CUE (.cue) file. - CVE-2017-15955 (denial of service) bchunk (related to BinChunker) 1.2.0 and 1.2.1 is vulnerable to an "Access violation near NULL on destination operand" and crash when processing a malformed CUE (.cue) file. Impact ====== An attacker can cause a denial of service via a crafted CUE file. References ========== https://github.com/extramaster/bchunk/issues/2 https://github.com/extramaster/bchunk/issues/3 https://github.com/extramaster/bchunk/issues/4 https://security.archlinux.org/CVE-2017-15953 https://security.archlinux.org/CVE-2017-15954 https://security.archlinux.org/CVE-2017-15955

1 0

[ASA-201803-23] xerces-c: arbitrary code execution
by Remi Gacogne 26 Mar '18

26 Mar '18

Arch Linux Security Advisory ASA-201803-23 ========================================== Severity: High Date : 2018-03-25 CVE-ID : CVE-2017-12627 Package : xerces-c Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-644 Summary ======= The package xerces-c before version 3.2.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.2.1-1. # pacman -Syu "xerces-c>=3.2.1-1" The problem has been fixed upstream in version 3.2.1. Workaround ========== None. Description =========== The Xerces-C XML parser mishandles certain kinds of external DTD references, resulting in dereference of a NULL pointer while processing the path to the DTD. The bug allows for a denial of service attack in applications that allow DTD processing and do not prevent external DTD usage, and could conceivably result in remote code execution. Impact ====== A remote attacker might be able to cause a denial of service or execute arbitrary code by submitting a crafted XML document with an external DTD path to an application using a vulnerable version of the xerces-c parser. References ========== https://xerces.apache.org/xerces-c/secadv/CVE-2017-12627.txt https://security.archlinux.org/CVE-2017-12627

1 0

[ASA-201803-22] thunderbird: multiple issues
by Remi Gacogne 25 Mar '18

25 Mar '18

Arch Linux Security Advisory ASA-201803-22 ========================================== Severity: Critical Date : 2018-03-24 CVE-ID : CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5144 CVE-2018-5145 CVE-2018-5146 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-663 Summary ======= The package thunderbird before version 52.7.0-1 is vulnerable to multiple issues including arbitrary code execution and access restriction bypass. Resolution ========== Upgrade to 52.7.0-1. # pacman -Syu "thunderbird>=52.7.0-1" The problems have been fixed upstream in version 52.7.0. Workaround ========== None. Description =========== - CVE-2018-5125 (arbitrary code execution) Various memory safety bugs have been found in Thunderbird < 52.7.0 and Firefox < 59.0, some of them presenting evidence of memory corruption. Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-5127 (arbitrary code execution) A buffer overflow can occur in Thunderbird < 52.7.0 when manipulating the SVG animatedPathSegList through script. This results in a potentially exploitable crash. - CVE-2018-5129 (access restriction bypass) A lack of parameter validation on IPC messages results in a potential out-of-bounds write in Thunderbird < 52.7.0, through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. - CVE-2018-5144 (arbitrary code execution) An integer overflow can occur during conversion of text to some Unicode character sets in Thunderbird < 52.7.0, due to an unchecked length parameter. - CVE-2018-5145 (arbitrary code execution) Various memory safety bugs have been found in Thunderbird < 52.7.0, some of them presenting evidence of memory corruption. Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-5146 (arbitrary code execution) An out of bounds memory write vulnerability has been discovered in libvorbis before 1.3.6 while processing Vorbis audio data related to codebooks that are not an exact divisor of the partition size. Impact ====== A remote attacker might be able to bypass the sandbox and execute arbitrary code on the affected host via a crafted page containing an SVG object, a Vorbis audio file or some unicode characters. These issues can generally not be exploited through email because scripting is then disabled, but can be exploited in browser-like contexts. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-09/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-09/#CVE-2018-5125 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1416529%2C1434580%2C1434384… https://www.mozilla.org/en-US/security/advisories/mfsa2018-09/#CVE-2018-5127 https://bugzilla.mozilla.org/show_bug.cgi?id=1430557 https://www.mozilla.org/en-US/security/advisories/mfsa2018-09/#CVE-2018-5129 https://bugzilla.mozilla.org/show_bug.cgi?id=1428947 https://www.mozilla.org/en-US/security/advisories/mfsa2018-09/#CVE-2018-5144 https://bugzilla.mozilla.org/show_bug.cgi?id=1440926 https://www.mozilla.org/en-US/security/advisories/mfsa2018-09/#CVE-2018-5145 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1261175%2C1348955 https://github.com/xiph/vorbis/commit/667ceb4aab60c1f74060143bb24e5f427b3cc… http://seclists.org/oss-sec/2018/q1/243 https://security.archlinux.org/CVE-2018-5125 https://security.archlinux.org/CVE-2018-5127 https://security.archlinux.org/CVE-2018-5129 https://security.archlinux.org/CVE-2018-5144 https://security.archlinux.org/CVE-2018-5145 https://security.archlinux.org/CVE-2018-5146

1 0

[ASA-201803-21] lib32-libvorbis: multiple issues
by Levente Polyak 22 Mar '18

22 Mar '18

Arch Linux Security Advisory ASA-201803-21 ========================================== Severity: Critical Date : 2018-03-19 CVE-ID : CVE-2017-14632 CVE-2017-14633 CVE-2018-5146 Package : lib32-libvorbis Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-658 Summary ======= The package lib32-libvorbis before version 1.3.6-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.3.6-1. # pacman -Syu "lib32-libvorbis>=1.3.6-1" The problems have been fixed upstream in version 1.3.6. Workaround ========== None. Description =========== - CVE-2017-14632 (arbitrary code execution) fXiph.Org libvorbis before 1.3.6 allows remote code execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0, a similar issue to Mozilla bug 550184. - CVE-2017-14633 (denial of service) In Xiph.Org libvorbis before 1.3.6, an out-of-bounds array read vulnerability exists in the function mapping0_forward() in mapping0.c, which may lead to DoS when operating on a crafted audio file with vorbis_analysis(). - CVE-2018-5146 (arbitrary code execution) An out of bounds memory write vulnerability has been discovered in libvorbis before 1.3.6 while processing Vorbis audio data related to codebooks that are not an exact divisor of the partition size. Impact ====== A remote attacker is able to execute arbitrary code or crash the application by tricking the user into playing a specially crafted vorbis file. References ========== https://github.com/xiph/vorbis/commit/c1c2831fc7306d5fbd7bc800324efd12b28d3… https://github.com/xiph/vorbis/commit/a79ec216cd119069c68b8f3542c6a425a74ab… https://github.com/xiph/vorbis/commit/667ceb4aab60c1f74060143bb24e5f427b3cc… http://seclists.org/oss-sec/2018/q1/243 https://security.archlinux.org/CVE-2017-14632 https://security.archlinux.org/CVE-2017-14633 https://security.archlinux.org/CVE-2018-5146

1 0

[ASA-201803-20] lib32-libcurl-gnutls: multiple issues
by Levente Polyak 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-20 ========================================== Severity: Medium Date : 2018-03-19 CVE-ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-656 Summary ======= The package lib32-libcurl-gnutls before version 7.59.0-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 7.59.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.59.0-1" The problems have been fixed upstream in version 7.59.0. Workaround ========== None. Description =========== - CVE-2018-1000120 (denial of service) It was found that libcurl did not safely parse FTP URLs when using the CURLOPT_FTP_FILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash, or an unspecified behavior. - CVE-2018-1000121 (denial of service) A NULL pointer dereference exists in the LDAP code of curl >= 7.21.0 and < curl 7.59.0, allowing an attacker to cause a denial of service. libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server. - CVE-2018-1000122 (information disclosure) A buffer over-read exists in curl >= 7.20.0 and < 7.59.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it didn't cause a crash). This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this. Impact ====== A remote attacker is able to crash the application or disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2018-9cd6.html https://curl.haxx.se/CVE-2018-1000120.patch https://github.com/curl/curl/commit/535432c0adb62fe167ec09621500470b6fa4eb0f https://curl.haxx.se/docs/adv_2018-97a2.html https://curl.haxx.se/CVE-2018-1000121.patch https://github.com/curl/curl/commit/9889db043393092e9d4b5a42720bba0b3d58deba https://curl.haxx.se/docs/adv_2018-b047.html https://curl.haxx.se/CVE-2018-1000122.patch https://github.com/curl/curl/commit/d52dc4760f6d9ca1937eefa2093058a952465128 https://security.archlinux.org/CVE-2018-1000120 https://security.archlinux.org/CVE-2018-1000121 https://security.archlinux.org/CVE-2018-1000122

1 0

[ASA-201803-19] libcurl-gnutls: multiple issues
by Levente Polyak 19 Mar '18

19 Mar '18

Arch Linux Security Advisory ASA-201803-19 ========================================== Severity: Medium Date : 2018-03-19 CVE-ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Package : libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-661 Summary ======= The package libcurl-gnutls before version 7.59.0-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 7.59.0-1. # pacman -Syu "libcurl-gnutls>=7.59.0-1" The problems have been fixed upstream in version 7.59.0. Workaround ========== None. Description =========== - CVE-2018-1000120 (denial of service) It was found that libcurl did not safely parse FTP URLs when using the CURLOPT_FTP_FILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash, or an unspecified behavior. - CVE-2018-1000121 (denial of service) A NULL pointer dereference exists in the LDAP code of curl >= 7.21.0 and < curl 7.59.0, allowing an attacker to cause a denial of service. libcurl-using applications that allow LDAP URLs, or that allow redirects to LDAP URLs could be made to crash by a malicious server. - CVE-2018-1000122 (information disclosure) A buffer over-read exists in curl >= 7.20.0 and < 7.59.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it didn't cause a crash). This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this. Impact ====== A remote attacker is able to crash the application or disclose sensitive information on the affected host. References ========== https://curl.haxx.se/docs/adv_2018-9cd6.html https://curl.haxx.se/CVE-2018-1000120.patch https://github.com/curl/curl/commit/535432c0adb62fe167ec09621500470b6fa4eb0f https://curl.haxx.se/docs/adv_2018-97a2.html https://curl.haxx.se/CVE-2018-1000121.patch https://github.com/curl/curl/commit/9889db043393092e9d4b5a42720bba0b3d58deba https://curl.haxx.se/docs/adv_2018-b047.html https://curl.haxx.se/CVE-2018-1000122.patch https://github.com/curl/curl/commit/d52dc4760f6d9ca1937eefa2093058a952465128 https://security.archlinux.org/CVE-2018-1000120 https://security.archlinux.org/CVE-2018-1000121 https://security.archlinux.org/CVE-2018-1000122

1 0