- Arch-security - lists.archlinux.org

[ASA-201801-16] bind: denial of service
by Levente Polyak 18 Jan '18

18 Jan '18

Arch Linux Security Advisory ASA-201801-16 ========================================== Severity: High Date : 2018-01-18 CVE-ID : CVE-2017-3145 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-589 Summary ======= The package bind before version 9.11.2.P1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.2.P1-1. # pacman -Syu "bind>=9.11.2.P1-1" The problem has been fixed upstream in version 9.11.2.P1. Workaround ========== None. Description =========== A use-after-free flaw leading to denial of service was found in the way BIND before 9.11.2.P1, 9.10.6-P1 and 9.9.11-P1 internally handled cleanup operations on upstream recursion fetch contexts. A remote attacker could potentially use this flaw to make named, acting as a DNSSEC validating resolver, exit unexpectedly with an assertion failure via a specially crafted DNS request. Impact ====== A remote attacker is able to crash named while acting as a DNSSEC validating resolver via a specially crafted DNS request. References ========== https://kb.isc.org/article/AA-01542 https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=053b51… https://security.archlinux.org/CVE-2017-3145

1 0

[ASA-201801-15] perl-xml-libxml: arbitrary code execution
by Levente Polyak 18 Jan '18

18 Jan '18

Arch Linux Security Advisory ASA-201801-15 ========================================== Severity: High Date : 2018-01-18 CVE-ID : CVE-2017-10672 Package : perl-xml-libxml Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-501 Summary ======= The package perl-xml-libxml before version 2.0130-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.0130-1. # pacman -Syu "perl-xml-libxml>=2.0130-1" The problem has been fixed upstream in version 2.0130. Workaround ========== None. Description =========== A use-after-free vulnerability has been discovered in the perl XML- LibXML module before 2.0130 which allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call. Impact ====== A remote attacker is able to execute arbitrary code on the affected host by controlling the arguments to a replaceChild call. References ========== https://bugs.archlinux.org/task/56377 https://rt.cpan.org/Public/Bug/Display.html?id=122246 https://security.archlinux.org/CVE-2017-10672

1 0

[ASA-201801-14] nrpe: arbitrary command execution
by Levente Polyak 18 Jan '18

18 Jan '18

Arch Linux Security Advisory ASA-201801-14 ========================================== Severity: High Date : 2018-01-18 CVE-ID : CVE-2013-1362 CVE-2014-2913 Package : nrpe Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-587 Summary ======= The package nrpe before version 3.2.1-3 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 3.2.1-3. # pacman -Syu "nrpe>=3.2.1-3" The problems have been fixed upstream but no release is available yet. Workaround ========== Ensure the "dont_blame_nrpe" option in nrpe.conf is disabled. Description =========== - CVE-2013-1362 (arbitrary command execution) Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash. - CVE-2014-2913 (arbitrary command execution) Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe. Impact ====== A remote attacker is able to execute arbitrary commands on the affected host by passing malicious command arguments via check_nrpe. References ========== https://bugs.archlinux.org/task/57120 http://seclists.org/bugtraq/2013/Feb/119 https://github.com/NagiosEnterprises/nrpe/commit/eaaebb3c2925f9aee74319b612… http://seclists.org/fulldisclosure/2014/Apr/240 http://seclists.org/oss-sec/2014/q2/154 https://security.archlinux.org/CVE-2013-1362 https://security.archlinux.org/CVE-2014-2913

1 0

[ASA-201801-13] transmission-cli: arbitrary command execution
by Levente Polyak 18 Jan '18

18 Jan '18

Arch Linux Security Advisory ASA-201801-13 ========================================== Severity: High Date : 2018-01-17 CVE-ID : CVE-2018-5702 Package : transmission-cli Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-588 Summary ======= The package transmission-cli before version 2.92-8 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2.92-8. # pacman -Syu "transmission-cli>=2.92-8" The problem has been fixed upstream but no release is available yet. Workaround ========== Enable authentication in the transmission-daemon using a strong password. Description =========== The transmission-daemon in Transmission before 2.93 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack. Impact ====== A remote attacker is able to execute arbitrary RPC commands and consequently write to arbitrary files by tricking a user into visiting a malicious website. References ========== https://bugs.archlinux.org/task/57086 http://www.openwall.com/lists/oss-security/2018/01/12/1 https://bugs.chromium.org/p/project-zero/issues/detail?id=1447 https://github.com/transmission/transmission/commit/eb5d1a79cbe1b9bc5b22fdc… https://github.com/transmission/transmission/pull/468 https://security.archlinux.org/CVE-2018-5702

1 0

[ASA-201801-12] irssi: denial of service
by Levente Polyak 18 Jan '18

18 Jan '18

Arch Linux Security Advisory ASA-201801-12 ========================================== Severity: Medium Date : 2018-01-16 CVE-ID : CVE-2018-5205 CVE-2018-5206 CVE-2018-5207 CVE-2018-5208 Package : irssi Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-575 Summary ======= The package irssi before version 1.0.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.6-1. # pacman -Syu "irssi>=1.0.6-1" The problems have been fixed upstream in version 1.0.6. Workaround ========== None. Description =========== - CVE-2018-5205 (denial of service) When using incomplete escape codes, irssi before 1.0.6 may access data beyond the end of the string. - CVE-2018-5206 (denial of service) When the channel topic is set without specifying a sender, irssi before 1.0.6 may dereference a NULL pointer. - CVE-2018-5207 (denial of service) When using an incomplete variable argument, irssi before 1.0.6 may access data beyond the end of the string. - CVE-2018-5208 (denial of service) In Irssi before 1.0.6 a calculation error in the completion code could cause a heap buffer overflow when completing certain strings. Impact ====== A remote attacker is able to crash the application via a malicious server or by tricking a user to use malicious commands. References ========== http://www.openwall.com/lists/oss-security/2018/01/06/2 https://irssi.org/security/irssi_sa_2018_01.txt https://github.com/irssi/irssi/commit/7a83c63701b7395ee6cc606905314318eef77… https://github.com/irssi/irssi/commit/54d453623d879ea83d0818a80bd1415119295… https://github.com/irssi/irssi/commit/cc17837a9b326ec9100a35981348fa0f5d631… https://github.com/irssi/irssi/commit/2361d4b1e5d38701f35146219ceddd318ac4e… https://security.archlinux.org/CVE-2018-5205 https://security.archlinux.org/CVE-2018-5206 https://security.archlinux.org/CVE-2018-5207 https://security.archlinux.org/CVE-2018-5208

1 0

[ASA-201801-11] qtpass: private key recovery
by Jelle van der Waa 14 Jan '18

14 Jan '18

Arch Linux Security Advisory ASA-201801-11 ========================================== Severity: High Date : 2018-01-11 CVE-ID : CVE-2017-18021 Package : qtpass Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-576 Summary ======= The package qtpass before version 1.2.1-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1.2.1-1. # pacman -Syu "qtpass>=1.2.1-1" The problem has been fixed upstream in version 1.2.1. Workaround ========== Use pwgen for generating new passwords. Description =========== It was discovered that QtPass before 1.2.1, when using the built-in password generator, generates possibly predictable and enumerable passwords. This only applies to the QtPass GUI. The generator used libc's random(), seeded with srand(msecs), where msecs is not the msecs since 1970 (not that that'd be secure anyway), but rather the msecs since the last second. This means there are only 1000 different sequences of generated passwords. Impact ====== Passwords generated using QtPass can potentially be recovered by an attacker due to the use of a non-cryptographically secure random number generator with a predictable seed. It is recommend to change all passwords created by QtPass. References ========== http://www.openwall.com/lists/oss-security/2018/01/05/5 https://lists.zx2c4.com/pipermail/password-store/2018-January/003165.html https://github.com/IJHack/QtPass/issues/338 https://github.com/IJHack/QtPass/commit/e7bd0651335e1bf4f01512d1555fe0b960f… https://security.archlinux.org/CVE-2017-18021

1 0

[ASA-201801-10] intel-ucode: access restriction bypass
by Levente Polyak 11 Jan '18

11 Jan '18

Arch Linux Security Advisory ASA-201801-10 ========================================== Severity: High Date : 2018-01-10 CVE-ID : CVE-2017-5715 Package : intel-ucode Type : access restriction bypass Remote : No Link : https://security.archlinux.org/AVG-582 Summary ======= The package intel-ucode before version 20180108-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 20180108-1. # pacman -Syu "intel-ucode>=20180108-1" The problem has been fixed upstream in version 20180108. Workaround ========== None. Description =========== An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). This variant triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. Impact ====== A local unprivileged attacker is able to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. References ========== https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-wi… https://spectreattack.com https://www.kb.cert.org/vuls/id/584653 https://xenbits.xen.org/xsa/advisory-254.html https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00088&lang… https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/Intel-Analys… https://security.archlinux.org/CVE-2017-5715

1 0

[ASA-201801-9] glibc: multiple issues
by Santiago Torres-Arias 10 Jan '18

10 Jan '18

Arch Linux Security Advisory ASA-201801-9 ========================================= Severity: High Date : 2018-01-10 CVE-ID : CVE-2017-15670 CVE-2017-15671 Package : glibc Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-460 Summary ======= The package glibc before version 2.26-9 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.26-9. # pacman -Syu "glibc>=2.26-9" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-15670 (arbitrary code execution) The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by- one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string. - CVE-2017-15671 (denial of service) The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak). Impact ====== A remote attacker is able to execute arbitrary code on the host or crash a target application that is using glibc functions for globbing by providing a crafted input to it. References ========== http://seclists.org/oss-sec/2017/q4/119 https://sourceware.org/bugzilla/show_bug.cgi?id=22320 https://bugzilla.redhat.com/show_bug.cgi?id=1504804 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=a76376df7c07e577a951… https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=2d1bd71ec70a31b01d0… https://sourceware.org/bugzilla/show_bug.cgi?id=22325 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=f1cf98b583787cfb6278… https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=6803dda53781f7da920… https://security.archlinux.org/CVE-2017-15670 https://security.archlinux.org/CVE-2017-15671

1 0

[ASA-201801-8] lib32-glibc: multiple issues
by Santiago Torres-Arias 10 Jan '18

10 Jan '18

Arch Linux Security Advisory ASA-201801-8 ========================================= Severity: High Date : 2018-01-10 CVE-ID : CVE-2017-15670 CVE-2017-15671 Package : lib32-glibc Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-460 Summary ======= The package lib32-glibc before version 2.26-9 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.26-9. # pacman -Syu "lib32-glibc>=2.26-9" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-15670 (arbitrary code execution) The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by- one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string. - CVE-2017-15671 (denial of service) The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27, when invoked with GLOB_TILDE, could skip freeing allocated memory when processing the ~ operator with a long user name, potentially leading to a denial of service (memory leak). Impact ====== A remote attacker is able to execute arbitrary code on the host or crash a target application that is using glibc functions for globbing by providing a crafted input to it. References ========== http://seclists.org/oss-sec/2017/q4/119 https://sourceware.org/bugzilla/show_bug.cgi?id=22320 https://bugzilla.redhat.com/show_bug.cgi?id=1504804 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=a76376df7c07e577a951… https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=2d1bd71ec70a31b01d0… https://sourceware.org/bugzilla/show_bug.cgi?id=22325 https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=f1cf98b583787cfb6278… https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=6803dda53781f7da920… https://security.archlinux.org/CVE-2017-15670 https://security.archlinux.org/CVE-2017-15671

1 0

[ASA-201801-7] graphicsmagick: multiple issues
by Santiago Torres-Arias 09 Jan '18

09 Jan '18

Arch Linux Security Advisory ASA-201801-7 ========================================= Severity: High Date : 2018-01-08 CVE-ID : CVE-2017-11403 CVE-2017-12935 CVE-2017-12936 CVE-2017-12937 CVE-2017-13063 CVE-2017-13064 CVE-2017-13065 CVE-2017-13066 CVE-2017-13134 CVE-2017-13776 CVE-2017-13777 CVE-2017-14165 CVE-2017-15930 CVE-2017-16547 Package : graphicsmagick Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-355 Summary ======= The package graphicsmagick before version 1.3.27-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.3.27-1. # pacman -Syu "graphicsmagick>=1.3.27-1" The problems have been fixed upstream in version 1.3.27. Workaround ========== None. Description =========== - CVE-2017-11403 (arbitrary code execution) The ReadMNGImage function in coders/png.c in GraphicsMagick before 1.3.27 has an out-of-order CloseBlob call, resulting in a use-after- free via a crafted file. - CVE-2017-12935 (arbitrary code execution) The ReadMNGImage function in coders/png.c in GraphicsMagick before 1.3.27 mishandles large MNG images, leading to an invalid memory read in the SetImageColorCallBack function in magick/image.c. - CVE-2017-12936 (arbitrary code execution) The ReadWMFImage function in coders/wmf.c in GraphicsMagick before 1.3.27 has a use-after-free issue for data associated with exception reporting. - CVE-2017-12937 (arbitrary code execution) The ReadSUNImage function in coders/sun.c in GraphicsMagick before 1.3.27 has a colormap heap-based buffer over-read. - CVE-2017-13063 (arbitrary code execution) A heap buffer overflow vulnerability was found in the function GetStyleTokens in GraphicsMagick before 1.3.27, which allow attackers to cause a denial of service, or possible remote code execution via a crafted file. - CVE-2017-13064 (arbitrary code execution) A heap buffer overflow vulnerability was found in function GetStyleTokens in GraphicsMagick before 1.3.27, which allow attackers to cause a denial of service or possible remote code execution via a crafted file. - CVE-2017-13065 (denial of service) A null pointer dereference vulnerability was found in function SVGStartElement in GraphicsMagick before 1.3.27, which allow attackers to cause a denial of service via a crafted file. - CVE-2017-13066 (denial of service) A memory leak vulnerability was found in function CloneImage in magick/image.c in GraphicsMagick before 1.3.27, which allow attackers to cause a denial of service via a crafted file. - CVE-2017-13134 (denial of service) In ImageMagick 6.9.9.1, 7.0.6.7 and GraphicsMagick before 1.3.27, a heap-based buffer over-read was found in the function SFWScan in coders/sfw.c, which allows attackers to cause a denial of service via a crafted file. - CVE-2017-13776 (denial of service) GraphicsMagick before 1.3.27 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version!=10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it. - CVE-2017-13777 (denial of service) GraphicsMagick before 1.3.27 has a denial of service issue in ReadXBMImage() in a coders/xbm.c "Read hex image data" version==10 case that results in the reader not returning; it would cause large amounts of CPU and memory consumption although the crafted file itself does not request it. - CVE-2017-14165 (denial of service) The ReadSUNImage function in coders/sun.c in GraphicsMagick before 1.3.27 has an issue where memory allocation is excessive because it depends only on a length field in a header. This may lead to remote denial of service in the MagickMalloc function in magick/memory.c. - CVE-2017-15930 (denial of service) In ReadOneJNGImage in coders/png.c in GraphicsMagick before 1.3.27, a null pointer dereference occurs while transferring JPEG scanlines, related to a PixelPacket pointer. - CVE-2017-16547 (denial of service) The DrawImage function in magick/render.c in GraphicsMagick before 1.3.27 does not properly look for pop keywords that are associated with push keywords, which allows remote attackers to cause a denial of service (negative strncpy and application crash) or possibly have unspecified other impact via a crafted file. Impact ====== A remote attacker is able to read sensitive information, crash the application or execute arbitrary code on the host by providing a maliciously-crafted input to GraphicsMagick's convert. References ========== https://blogs.gentoo.org/ago/2017/07/12/graphicsmagick-use-after-free-in-cl… http://hg.code.sf.net/p/graphicsmagick/code/rev/d0a76868ca37 https://marc.info/?l=oss-security&m=150306448426399 https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-invalid-memory-read-… http://hg.code.sf.net/p/graphicsmagick/code/rev/cd699a44f188 http://www.openwall.com/lists/oss-security/2017/08/18/3 https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-use-after-free-in-re… http://hg.code.sf.net/p/graphicsmagick/code/rev/be898b7c97bd https://blogs.gentoo.org/ago/2017/08/05/graphicsmagick-heap-based-buffer-ov… http://hg.code.sf.net/p/graphicsmagick/code/rev/95d00d55e978 http://seclists.org/oss-sec/2017/q3/325 https://sourceforge.net/p/graphicsmagick/bugs/434/ http://hg.code.sf.net/p/graphicsmagick/code/rev/54f48ab2d52a https://sourceforge.net/p/graphicsmagick/bugs/436/ https://sourceforge.net/p/graphicsmagick/bugs/435/ https://sourceforge.net/p/graphicsmagick/bugs/430/ http://www.securityfocus.com/bid/100463 https://github.com/ImageMagick/ImageMagick/issues/670 https://github.com/ImageMagick/ImageMagick/commit/5304ae14655a67b9a3db00563… http://hg.code.sf.net/p/graphicsmagick/code/rev/1b47e0078e05 http://openwall.com/lists/oss-security/2017/08/31/2 http://hg.code.sf.net/p/graphicsmagick/code/rev/233a720bfd5e http://openwall.com/lists/oss-security/2017/08/31/1 https://blogs.gentoo.org/ago/2017/09/06/graphicsmagick-memory-allocation-fa… http://hg.code.sf.net/p/graphicsmagick/code/rev/493da54370aa https://sourceforge.net/p/graphicsmagick/bugs/518/ http://hg.code.sf.net/p/graphicsmagick/code/rev/da135eaedc3b http://hg.code.sf.net/p/graphicsmagick/code/rev/6fc54b6d2be8 https://sourceforge.net/p/graphicsmagick/bugs/517/ http://hg.code.sf.net/p/graphicsmagick/code/rev/785758bbbfcc https://security.archlinux.org/CVE-2017-11403 https://security.archlinux.org/CVE-2017-12935 https://security.archlinux.org/CVE-2017-12936 https://security.archlinux.org/CVE-2017-12937 https://security.archlinux.org/CVE-2017-13063 https://security.archlinux.org/CVE-2017-13064 https://security.archlinux.org/CVE-2017-13065 https://security.archlinux.org/CVE-2017-13066 https://security.archlinux.org/CVE-2017-13134 https://security.archlinux.org/CVE-2017-13776 https://security.archlinux.org/CVE-2017-13777 https://security.archlinux.org/CVE-2017-14165 https://security.archlinux.org/CVE-2017-15930 https://security.archlinux.org/CVE-2017-16547

1 0