- Arch-security - lists.archlinux.org

[ASA-201803-8] calibre: arbitrary command execution
by Jelle van der Waa 13 Mar '18

13 Mar '18

Arch Linux Security Advisory ASA-201803-8 ========================================= Severity: High Date : 2018-03-11 CVE-ID : CVE-2018-7889 Package : calibre Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-650 Summary ======= The package calibre before version 3.19.0-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.19.0-1. # pacman -Syu "calibre>=3.19.0-1" The problem has been fixed upstream in version 3.19.0. Workaround ========== None. Description =========== gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call. Impact ====== A remote attacker is able to execute arbitrary commands by tricking the user into importing a specially crafted bookmark. References ========== https://bugs.launchpad.net/calibre/+bug/1753870 https://github.com/kovidgoyal/calibre/commit/aeb5b036a0bf657951756688b3c72b… https://security.archlinux.org/CVE-2018-7889

1 0

[ASA-201803-7] dovecot: multiple issues
by Jelle van der Waa 13 Mar '18

13 Mar '18

Arch Linux Security Advisory ASA-201803-7 ========================================= Severity: High Date : 2018-03-06 CVE-ID : CVE-2017-14461 CVE-2017-15130 CVE-2017-15132 Package : dovecot Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-645 Summary ======= The package dovecot before version 2.3.0.1-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 2.3.0.1-1. # pacman -Syu "dovecot>=2.3.0.1-1" The problems have been fixed upstream in version 2.3.0.1. Workaround ========== None. Description =========== - CVE-2017-14461 (information disclosure) A specially crafted email delivered over SMTP and passed on to Dovecot by MTA can trigger an out of bounds read resulting in potential sensitive information disclosure of an email from another user or may cause an application crash. In order to trigger this vulnerability, an imap-authenticated attacker needs to send a specially crafted email message to the server. - CVE-2017-15130 (denial of service) A denial of service flaw was found in dovecot before 2.2.34 and 2.3.0.1. An attacker able to generate random SNI server names could exploit TLS SNI configuration lookups, leading to excessive memory usage, causing imap-login/pop3-login VSZ limit to be reached and the process restarted. This happens only if Dovecot config has local_name { } or local { } configuration blocks and attacker uses randomly generated SNI servernames. - CVE-2017-15132 (denial of service) A flaw was found in dovecot before 2.2.34 and 2.3.0.1. An abort of SASL authentication results in a memory leak in dovecot's auth client used by login processes. The leak has impact in high performance configuration where same login processes are reused and can cause the process to crash due to memory exhaustion. Impact ====== A remote attacker is able to crash the application or disclose information by sending a specially crafted email. References ========== https://www.dovecot.org/list/dovecot-news/2018-February/000371.html https://talosintelligence.com/vulnerability_reports/TALOS-2017-0510 https://github.com/dovecot/core/commit/30dc856f7b97b75b0e0d69f5003d5d99a132… https://github.com/dovecot/core/commit/8d65e2345e1dbedb00b662ee0abd05be2e7e… https://github.com/dovecot/core/commit/b72d864b8c34cb21076214c0b28101baec53… https://github.com/dovecot/core/commit/e9b86842441a668b30796bff7d6082861457… https://github.com/dovecot/core/commit/f5cd17a27f0b666567747f8c921ebe102697… https://github.com/dovecot/core/commit/18a7a161c8dae6f630770a3cbab7374a0c3d… https://github.com/dovecot/core/commit/0ed696987e5e5d44e971da2a10f6275b276e… https://www.dovecot.org/list/dovecot-news/2018-February/000370.html https://github.com/dovecot/core/commit/1a29ed2f96da1be22fa5a4d96c7583aa81b8… https://security.archlinux.org/CVE-2017-14461 https://security.archlinux.org/CVE-2017-15130 https://security.archlinux.org/CVE-2017-15132

1 0

[ASA-201803-6] python2-django: denial of service
by Jelle van der Waa 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-6 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python2-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package python2-django before version 1.11.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.11.11-1. # pacman -Syu "python2-django>=1.11.11-1" The problems have been fixed upstream in version 1.11.11. Workaround ========== None. Description =========== - CVE-2018-7536 (denial of service) The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. - CVE-2018-7537 (denial of service) If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. Impact ====== A remote attacker is able to crash the application by providing specially crafted input. References ========== https://docs.djangoproject.com/en/dev/releases/1.11.11/ https://github.com/django/django/commit/8618271caa0b09daba39ff3b46567d33ae1… https://github.com/django/django/commit/97b7dd59bb8d6163239061e2022153c3415… https://security.archlinux.org/CVE-2018-7536 https://security.archlinux.org/CVE-2018-7537

1 1

[ASA-201803-5] python-django: denial of service
by Jelle van der Waa 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-5 ========================================= Severity: Medium Date : 2018-03-06 CVE-ID : CVE-2018-7536 CVE-2018-7537 Package : python-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-649 Summary ======= The package python-django before version 1.11.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.11.11-1. # pacman -Syu "python-django>=1.11.11-1" The problems have been fixed upstream in version 1.11.11. Workaround ========== None. Description =========== - CVE-2018-7536 (denial of service) The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. - CVE-2018-7537 (denial of service) If django.utils.text.Truncator’s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. Impact ====== A remote attacker is able to crash the application by providing specially crafted input. References ========== https://docs.djangoproject.com/en/dev/releases/1.11.11/ https://github.com/django/django/commit/8618271caa0b09daba39ff3b46567d33ae1… https://github.com/django/django/commit/97b7dd59bb8d6163239061e2022153c3415… https://security.archlinux.org/CVE-2018-7536 https://security.archlinux.org/CVE-2018-7537

1 0

[ASA-201803-4] dhcp: denial of service
by Santiago Torres-Arias 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-4 ========================================= Severity: High Date : 2018-03-05 CVE-ID : CVE-2018-5733 Package : dhcp Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-646 Summary ======= The package dhcp before version 4.4.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.4.1-1. # pacman -Syu "dhcp>=4.4.1-1" The problem has been fixed upstream in version 4.4.1. Workaround ========== None. Description =========== A denial of service flaw was found in the way dhcpd handled reference counting when processing client requests. A malicious DHCP client could use this flaw to trigger a reference count overflow on the server side, potentially causing dhcpd to crash, by sending large amounts of traffic. Impact ====== A remote attacker is able to crash the dhcpd process by sending large amounts of traffic. References ========== https://kb.isc.org/article/AA-01567 https://lists.isc.org/pipermail/dhcp-announce/2018-February/000418.html https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commitdiff;h=197b26f… https://bugs.isc.org/Public/Bug/Display.html?id=47140 https://security.archlinux.org/CVE-2018-5733

1 0

[ASA-201803-3] dhclient: denial of service
by Santiago Torres-Arias 06 Mar '18

06 Mar '18

Arch Linux Security Advisory ASA-201803-3 ========================================= Severity: High Date : 2018-03-05 CVE-ID : CVE-2018-5732 Package : dhclient Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-648 Summary ======= The package dhclient before version 4.4.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.4.1-1. # pacman -Syu "dhclient>=4.4.1-1" The problem has been fixed upstream in version 4.4.1. Workaround ========== None. Description =========== An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use this flaw to crash dhclient processes running on DHCP client machines via a crafted DHCP response packet. Impact ====== A remote attacker is able to crash the dhclient processes via a crafted DHCP response packet. References ========== https://kb.isc.org/article/AA-01565 https://lists.isc.org/pipermail/dhcp-announce/2018-February/000418.html https://source.isc.org/cgi-bin/gitweb.cgi?p=dhcp.git;a=commitdiff;h=c593172… https://bugs.isc.org/Public/Bug/Display.html?id=47139 https://security.archlinux.org/CVE-2018-5732

1 0

[ASA-201803-2] mkinitcpio-busybox: arbitrary code execution
by Santiago Torres-Arias 05 Mar '18

05 Mar '18

Arch Linux Security Advisory ASA-201803-2 ========================================= Severity: High Date : 2018-03-01 CVE-ID : CVE-2017-16544 Package : mkinitcpio-busybox Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-514 Summary ======= The package mkinitcpio-busybox before version 1.28.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.28.1-1. # pacman -Syu "mkinitcpio-busybox>=1.28.1-1" The problem has been fixed upstream in version 1.28.1. Workaround ========== None. Description =========== In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. Impact ====== An attacker is able to execute arbitrary code by tricking the user into auto-completing a crafted filename. References ========== https://bugs.archlinux.org/task/56391 https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e… https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-… https://security.archlinux.org/CVE-2017-16544

1 0

[ASA-201803-1] busybox: arbitrary code execution
by Santiago Torres-Arias 05 Mar '18

05 Mar '18

Arch Linux Security Advisory ASA-201803-1 ========================================= Severity: High Date : 2018-03-01 CVE-ID : CVE-2017-16544 Package : busybox Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-512 Summary ======= The package busybox before version 1.28.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.28.1-1. # pacman -Syu "busybox>=1.28.1-1" The problem has been fixed upstream in version 1.28.1. Workaround ========== None. Description =========== In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks. Impact ====== An attacker is able to execute arbitrary code by tricking the user into auto-completing a crafted filename. References ========== https://bugs.archlinux.org/task/56391 https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e… https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-… https://security.archlinux.org/CVE-2017-16544

1 0

[ASA-201802-15] mbedtls: arbitrary code execution
by Santiago Torres-Arias 28 Feb '18

28 Feb '18

Arch Linux Security Advisory ASA-201802-15 ========================================== Severity: High Date : 2018-02-24 CVE-ID : CVE-2018-0487 CVE-2018-0488 Package : mbedtls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-617 Summary ======= The package mbedtls before version 2.7.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.7.0-1. # pacman -Syu "mbedtls>=2.7.0-1" The problems have been fixed upstream in version 2.7.0. Workaround ========== None. Description =========== - CVE-2018-0487 (arbitrary code execution) ARM mbed TLS before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session. - CVE-2018-0488 (arbitrary code execution) ARM mbed TLS before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session. Impact ====== A remote attacker is able to execute arbitrary code on the affected host. References ========== https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://security.archlinux.org/CVE-2018-0487 https://security.archlinux.org/CVE-2018-0488

1 0

[ASA-201802-14] unixodbc: arbitrary code execution
by Levente Polyak 24 Feb '18

24 Feb '18

Arch Linux Security Advisory ASA-201802-14 ========================================== Severity: High Date : 2018-02-23 CVE-ID : CVE-2018-7409 Package : unixodbc Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-627 Summary ======= The package unixodbc before version 2.3.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.3.5-1. # pacman -Syu "unixodbc>=2.3.5-1" The problem has been fixed upstream in version 2.3.5. Workaround ========== None. Description =========== In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c possibly leading to arbitrary code execution. Impact ====== A remote attacker is able to execute arbitrary code on the affected host. References ========== https://security.archlinux.org/CVE-2018-7409

1 0