- Arch-security - lists.archlinux.org

[arch-security] [ASA-201705-8] flashplugin: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-8 ========================================= Severity: Critical Date : 2017-05-09 CVE-ID : CVE-2017-3068 CVE-2017-3069 CVE-2017-3070 CVE-2017-3071 CVE-2017-3072 CVE-2017-3073 CVE-2017-3074 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-265 Summary ======= The package flashplugin before version 25.0.0.171-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 25.0.0.171-1. # pacman -Syu "flashplugin>=25.0.0.171-1" The problems have been fixed upstream in version 25.0.0.171. Workaround ========== None. Description =========== - CVE-2017-3068 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Advanced Video Coding engine of Adobe Flash Player < 25.0.0.171. - CVE-2017-3069 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BlendMode class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3070 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the ConvolutionFilter class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3071 (arbitrary code execution) A use-after-free vulnerability that could lead to code execution has been found in Adobe Flash Player < 25.0.0.171, when masking display object. - CVE-2017-3072 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the BitmapData class of Adobe Flash Player < 25.0.0.171. - CVE-2017-3073 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in Adobe Flash Player < 25.0.0.171, when handling multiple mask properties of display objects. - CVE-2017-3074 (arbitrary code execution) A memory corruption vulnerability leading to code execution has been found in the Graphics class of Adobe Flash Player < 25.0.0.171. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb17-15.html https://security.archlinux.org/CVE-2017-3068 https://security.archlinux.org/CVE-2017-3069 https://security.archlinux.org/CVE-2017-3070 https://security.archlinux.org/CVE-2017-3071 https://security.archlinux.org/CVE-2017-3072 https://security.archlinux.org/CVE-2017-3073 https://security.archlinux.org/CVE-2017-3074

1 0

[arch-security] [ASA-201705-7] freetype2: arbitrary code execution
by Remi Gacogne 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-7 ========================================= Severity: High Date : 2017-05-09 CVE-ID : CVE-2017-8105 CVE-2017-8287 Package : freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-257 Summary ======= The package freetype2 before version 2.7.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.7.1-2. # pacman -Syu "freetype2>=2.7.1-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-8105 (arbitrary code execution) FreeType 2 <= 2.7.1 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c. - CVE-2017-8287 (arbitrary code execution) FreeType 2 <= 2.7.1 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c. Impact ====== A remote attacker can execute arbitrary code on the affected host via a crafted font. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=941 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=935 https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48… https://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc0… https://security.archlinux.org/CVE-2017-8105 https://security.archlinux.org/CVE-2017-8287

1 0

[arch-security] [ASA-201705-6] lib32-libtirpc: denial of service
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-6 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : lib32-libtirpc Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-263 Summary ======= The package lib32-libtirpc before version 1.0.1-2 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.1-2. # pacman -Syu "lib32-libtirpc>=1.0.1-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ========== https://bugs.archlinux.org/task/53928 https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial… https://security.archlinux.org/CVE-2017-8779

1 0

[arch-security] [ASA-201705-5] libtirpc: denial of service
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-5 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : libtirpc Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-262 Summary ======= The package libtirpc before version 1.0.1-3 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.1-3. # pacman -Syu "libtirpc>=1.0.1-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ========== https://bugs.archlinux.org/task/53928 https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial… https://security.archlinux.org/CVE-2017-8779

1 0

[arch-security] [ASA-201705-4] rpcbind: denial of service
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-4 ========================================= Severity: Medium Date : 2017-05-07 CVE-ID : CVE-2017-8779 Package : rpcbind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-261 Summary ======= The package rpcbind before version 0.2.4-3 is vulnerable to denial of service. Resolution ========== Upgrade to 0.2.4-3. # pacman -Syu "rpcbind>=0.2.4-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that libtirpc and libntirpc fails to free a buffer allocated for parsing XDR blocks when parsing fails due to insufficient input data being available. A specially crafted message sent to a service such as rpcbind results in a memory leak, causing the application to crash or other processes to be impacted via the OOM killer. Impact ====== A remote attacker is able to send specially crafted input to leak memory, possibly leading to denial of service. References ========== https://bugs.archlinux.org/task/53927 https://guidovranken.wordpress.com/2017/05/03/rpcbomb-remote-rpcbind-denial… https://security.archlinux.org/CVE-2017-8779

1 0

[arch-security] [ASA-201705-3] ghostscript: arbitrary command execution
by Levente Polyak 10 May '17

10 May '17

Arch Linux Security Advisory ASA-201705-3 ========================================= Severity: High Date : 2017-05-07 CVE-ID : CVE-2017-8291 Package : ghostscript Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-256 Summary ======= The package ghostscript before version 9.21-2 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 9.21-2. # pacman -Syu "ghostscript>=9.21-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code via a "/OutputFile (%pipe%" substring in the context of the ghostscript process, bypassing the -dSAFER protection. Impact ====== A remote attacker is able to execute arbitrary commands via a specially crafted PostScript document. References ========== https://bugs.ghostscript.com/show_bug.cgi?id=697808 https://security.archlinux.org/CVE-2017-8291

1 0

[arch-security] [ASA-201705-2] chromium: arbitrary code execution
by Remi Gacogne 03 May '17

03 May '17

Arch Linux Security Advisory ASA-201705-2 ========================================= Severity: High Date : 2017-05-03 CVE-ID : CVE-2017-5068 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-260 Summary ======= The package chromium before version 58.0.3029.96-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 58.0.3029.96-1. # pacman -Syu "chromium>=58.0.3029.96-1" The problem has been fixed upstream in version 58.0.3029.96. Workaround ========== None. Description =========== A race condition issue has been found in the WebRTC component of the Chromium browser. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-des… https://security.archlinux.org/CVE-2017-5068

1 0

[arch-security] [ASA-201705-1] dovecot: denial of service
by Remi Gacogne 01 May '17

01 May '17

Arch Linux Security Advisory ASA-201705-1 ========================================= Severity: Medium Date : 2017-05-01 CVE-ID : CVE-2017-2669 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-238 Summary ======= The package dovecot before version 2.2.29.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.2.29.1-1. # pacman -Syu "dovecot>=2.2.29.1-1" The problem has been fixed upstream in version 2.2.29.1. Workaround ========== None. Description =========== A security issue has been found in Dovecot >= 2.2.26 and <= 2.2.28. If the "dict" passdb is used for authentication, the username sent by the client is passed to the var_expand() function and double expansion of %-variables is performed. A remote unauthenticated attacker could then send a specially crafted username containing %variables to cause a denial of service. Impact ====== A remote, unauthenticated attacker can cause a denial of service by sending a specially crafted username. References ========== https://dovecot.org/list/dovecot-news/2017-April/000341.html https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b4… https://security.archlinux.org/CVE-2017-2669

1 0

[arch-security] [ASA-201704-12] curl: certificate verification bypass
by Remi Gacogne 29 Apr '17

29 Apr '17

Arch Linux Security Advisory ASA-201704-12 ========================================== Severity: Medium Date : 2017-04-29 CVE-ID : CVE-2017-7468 Package : curl Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-241 Summary ======= The package curl before version 7.54.0-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 7.54.0-1. # pacman -Syu "curl>=7.54.0-1" The problem has been fixed upstream in version 7.54.0. Workaround ========== None. Description =========== libcurl from 7.52.0 to and including 7.53.1 would attempt to resume a TLS session even if the client certificate had changed. That is unacceptable since a server by specification is allowed to skip the client certificate check on resume, and may instead use the old identity which was established by the previous certificate (or no certificate). This flaw is a regression and identical to CVE-2016-5419 reported on August 3rd 2016, but affecting a different version range. Impact ====== An attacker can bypass a client certificate check by taking advantage of TLS session resumption to reuse a previously established session. References ========== https://curl.haxx.se/docs/adv_20170419.html https://security.archlinux.org/CVE-2017-7468

1 0

[arch-security] [ASA-201704-11] bind: denial of service
by Remi Gacogne 29 Apr '17

29 Apr '17

Arch Linux Security Advisory ASA-201704-11 ========================================== Severity: High Date : 2017-04-29 CVE-ID : CVE-2017-3136 CVE-2017-3137 CVE-2017-3138 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-239 Summary ======= The package bind before version 9.11.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.11.1-1. # pacman -Syu "bind>=9.11.1-1" The problems have been fixed upstream in version 9.11.1. Workaround ========== None. Description =========== - CVE-2017-3136 (denial of service) A security issue has been found in bind, where an error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;". - CVE-2017-3137 (denial of service) A security issue has been found in bind, where a server which is performing recursion can be forced to exit with an assertion failure if it can be caused to receive a response containing CNAME or DNAME resource records with certain ordering. - CVE-2017-3138 (denial of service) A security issue has been found in the bind named daemon, that will exit with a "require" assertion failure if it receives a null command string on its control channel. The control channel is not enabled by default and is usually restricted to a few remote hosts via an ACL and/or a transaction key. Impact ====== A remote attacker can crash the application, leading to denial of service. References ========== https://deepthought.isc.org/article/AA-01471 https://deepthought.isc.org/article/AA-01465 https://deepthought.isc.org/article/AA-01466 https://security.archlinux.org/CVE-2017-3136 https://security.archlinux.org/CVE-2017-3137 https://security.archlinux.org/CVE-2017-3138

1 0