- Arch-security - lists.archlinux.org

[arch-security] [ASA-201608-3] jdk7-openjdk: multiple issues
by Levente Polyak 05 Aug '16

05 Aug '16

Arch Linux Security Advisory ASA-201608-3 ========================================= Severity: Critical Date : 2016-08-05 CVE-ID : CVE-2016-3458 CVE-2016-3500 CVE-2016-3508 CVE-2016-3550 CVE-2016-3598 CVE-2016-3606 CVE-2016-3610 Package : jdk7-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk7-openjdk before version 7.u111_2.6.7-1 is vulnerable to multiple issues including denial of service and sandbox restriction bypass. Resolution ========== Upgrade to 7.u111_2.6.7-1. # pacman -Syu "jdk7-openjdk>=7.u111_2.6.7-1" The problems have been fixed upstream in version 7.u111_2.6.7. Workaround ========== None. Description =========== - CVE-2016-3458 (sandbox restriction bypass) It was discovered that the CORBA component of OpenJDK did not sufficiently restrict the use of custom ValueHandler when performing object deserialization. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3500 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing namespace URIs in XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2016-3508 (denial of service) It was discovered that the JAXP component of OpenJDK did not place a limit on the number of entity replacements performed when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Updates correcting this issue address the problem by introducing a limit on the number of entity replacements that can be performed. The limit can be controlled using the jdk.xml.entityReplacementLimit system property. - CVE-2016-3550 (sandbox restriction bypass) Integer overflow flaws were found in the way the Hotspot component of OpenJDK read bytecode from class files. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2016-3598 (sandbox restriction bypass) A flaw was found in the way the dropArguments() method of the MethodHandles class in the Libraries component of OpenJDK handled its valueTypes argument. As it did not create a copy of the list, caller could modify it after it was checked by the dropArguments() method. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3606 (sandbox restriction bypass) It was discovered that the bytecode verifier in the Hotspot component of OpenJDK did not properly verify correctness of the bytecode in the loaded class files. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2016-3610 (sandbox restriction bypass) It was discovered that the filterReturnValue() method of the MethodHandles in the Libraries component of OpenJDK did not properly check filter MethodHandle parameter count. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. Impact ====== A remote attacker is able to perform a denial of service attack or bypass sandbox restrictions via various vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2016-July/036560.html https://access.redhat.com/security/cve/CVE-2016-3458 https://access.redhat.com/security/cve/CVE-2016-3500 https://access.redhat.com/security/cve/CVE-2016-3508 https://access.redhat.com/security/cve/CVE-2016-3550 https://access.redhat.com/security/cve/CVE-2016-3598 https://access.redhat.com/security/cve/CVE-2016-3606 https://access.redhat.com/security/cve/CVE-2016-3610

1 0

[arch-security] [ASA-201608-2] firefox: multiple issues
by Jelle van der Waa 05 Aug '16

05 Aug '16

Arch Linux Security Advisory ASA-201608-2 ========================================= Severity: Critical Date : 2016-08-05 CVE-ID : CVE-2016-0718 CVE-2016-2830 CVE-2016-2835 CVE-2016-2836 CVE-2016-2837 CVE-2016-2838 CVE-2016-5250 CVE-2016-5251 CVE-2016-5252 CVE-2016-5254 CVE-2016-5255 CVE-2016-5258 CVE-2016-5259 CVE-2016-5260 CVE-2016-5261 CVE-2016-5262 CVE-2016-5263 CVE-2016-5264 CVE-2016-5265 CVE-2016-5266 CVE-2016-5268 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 48.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 48.0-1. # pacman -Syu "firefox>=48.0-1" The problems have been fixed upstream in version 48.0. Workaround ========== None. Description =========== - CVE-2016-0718 (arbitrary code execution) Out-of-bounds read during XML parsing in Expat library. - CVE-2016-2830 (information disclosure) Favicon network connection can persist when page is closed. - CVE-2016-2835 CVE-2016-2836 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-2837 (arbitrary code execution) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback - CVE-2016-2838 (arbitrary code execution) Buffer overflow rendering SVG with bidirectional content. - CVE-2016-5250 (information disclosure) Information disclosure through Resource Timing API during page navigation. - CVE-2016-5251 (URL spoofing) Location bar spoofing via data URLs with malformed/invalid mediatypes. - CVE-2016-5252 (arbitrary code execution) Stack underflow during 2D graphics rendering. - CVE-2016-5254 (arbitrary code execution) Use-after-free when using alt key and toplevel menus. - CVE-2016-5255 (arbitrary code execution) Crash in incremental garbage collection in JavaScript. - CVE-2016-5258 (arbitrary code execution) Use-after-free in DTLS during WebRTC session shutdown. - CVE-2016-5259 (arbitrary code execution) Use-after-free in service workers with nested sync events. - CVE-2016-5260 (information disclosure) Form input type change from password to text can store plain text password in session restore file. - CVE-2016-5261 (arbitrary code execution) Integer overflow in WebSockets during data buffering. - CVE-2016-5262 (cross-site scripting) Scripts on marquee tag can execute in sandboxed iframes. - CVE-2016-5263 (type confusion) Type confusion in display transformation - CVE-2016-5264 (use after free) Use-after-free when applying SVG effects. - CVE-2016-5265 (same-origin policy bypass) Same-origin policy violation using local HTML file and saved shortcut file. - CVE-2016-5266 (information disclosure) Information disclosure and local file manipulation through drag and drop. - CVE-2016-5268 (spoofing) Spoofing attack through text injection into internal error pages. Impact ====== A remote attacker can access sensitive information, bypass policies or execute arbitrary code on the affected host. References ========== https://access.redhat.com/security/cve/CVE-2016-0718 https://access.redhat.com/security/cve/CVE-2016-2830 https://access.redhat.com/security/cve/CVE-2016-2835 https://access.redhat.com/security/cve/CVE-2016-2836 https://access.redhat.com/security/cve/CVE-2016-2837 https://access.redhat.com/security/cve/CVE-2016-2838 https://access.redhat.com/security/cve/CVE-2016-5250 https://access.redhat.com/security/cve/CVE-2016-5251 https://access.redhat.com/security/cve/CVE-2016-5252 https://access.redhat.com/security/cve/CVE-2016-5254 https://access.redhat.com/security/cve/CVE-2016-5255 https://access.redhat.com/security/cve/CVE-2016-5258 https://access.redhat.com/security/cve/CVE-2016-5259 https://access.redhat.com/security/cve/CVE-2016-5260 https://access.redhat.com/security/cve/CVE-2016-5261 https://access.redhat.com/security/cve/CVE-2016-5262 https://access.redhat.com/security/cve/CVE-2016-5263 https://access.redhat.com/security/cve/CVE-2016-5264 https://access.redhat.com/security/cve/CVE-2016-5265 https://access.redhat.com/security/cve/CVE-2016-5266 https://access.redhat.com/security/cve/CVE-2016-5268 https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef…

1 0

[arch-security] [ASA-201608-1] openssh: information leakage
by Christian Rebischke 02 Aug '16

02 Aug '16

Arch Linux Security Advisory ASA-201608-1 ========================================= Severity: Medium Date : 2016-08-02 CVE-ID : CVE-2016-6210 Package : openssh Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssh before version 7.3p1-1 is vulnerable to information leakage. Resolution ========== Upgrade to 7.3p1-1. # pacman -Syu "openssh>=7.3p1-1" The problem has been fixed upstream in version 7.3p1. Workaround ========== None. Description =========== Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. Reported by EddieEzra.Harari at verint.com Impact ====== A remote attacker is able to enumerate users by sending large passwords. References ========== https://access.redhat.com/security/cve/CVE-2016-6210 http://seclists.org/fulldisclosure/2016/Jul/51 http://www.openssh.com/txt/release-7.3

1 0

[arch-security] [ASA-201607-14] libidn: denial of service
by Remi Gacogne 30 Jul '16

30 Jul '16

Arch Linux Security Advisory ASA-201607-14 ========================================== Severity: Low Date : 2016-07-30 CVE-ID : CVE-2015-8948 CVE-2016-6261 CVE-2016-6262 CVE-2016-6263 Package : libidn Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libidn before version 1.33-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.33-1. # pacman -Syu "libidn>=1.33-1" The problems have been fixed upstream in version 1.33. Workaround ========== None. Description =========== - CVE-2015-8948 (denial of service) Solve out-of-bounds-read when reading one zero byte as input. Also replaced fgets with getline. Reported by Hanno Boeck. - CVE-2016-6261 (denial of service) Fix out-of-bounds stack read in idna_to_ascii_4i. Reported by Hanno Boeck. - CVE-2016-6262 (denial of service) Really fix bug when reading \00 inputs. This issue results from an incomplete fix for CVE-2015-8948. - CVE-2016-6263 (denial of service) stringprep_utf8_nfkc_normalize reject invalid UTF-8. It was always documented to only accept UTF-8 data, but now it doesn't crash when presented with such data. Reported by Hanno Boeck. Impact ====== A local attacker can crash an application using libidn or the idn program using a specially crafted input, leading to denial of service. References ========== http://www.openwall.com/lists/oss-security/2016/07/21/4 https://access.redhat.com/security/cve/CVE-2015-8948 http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=570e68886c41c2e765e6… https://access.redhat.com/security/cve/CVE-2016-6261 http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=f20ce1128fb7f4d33297… https://access.redhat.com/security/cve/CVE-2016-6262 http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=5e3cb9c7b5bf0ce665b9… https://access.redhat.com/security/cve/CVE-2016-6263 http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=1fbee57ef3c72db2206d…

1 0

[arch-security] [ASA-201607-13] imagemagick: information leakage
by Remi Gacogne 29 Jul '16

29 Jul '16

Arch Linux Security Advisory ASA-201607-13 ========================================== Severity: Low Date : 2016-07-29 CVE-ID : CVE-2016-6491 Package : imagemagick Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imagemagick before version 6.9.5.3-1 is vulnerable to information leakage. Resolution ========== Upgrade to 6.9.5.3-1. # pacman -Syu "imagemagick>=6.9.5.3-1" The problem has been fixed upstream in version 6.9.5-3. Workaround ========== None. Description =========== An out-of-bounds read has been found in ImageMagick's Get8BIMProperty() function. This issue can lead to memory leak since the data read is written to the output image afterwards. Impact ====== A remote attacker can access sensitive information present in memory by submitting a crafted image file. References ========== http://git.imagemagick.org/repos/ImageMagick/commit/5cb6c1acd3e3b12f9260daf… http://seclists.org/oss-sec/2016/q3/194 https://access.redhat.com/security/cve/CVE-2016-6491

1 0

[arch-security] [ASA-201607-12] chromium: multiple issues
by Remi Gacogne 24 Jul '16

24 Jul '16

Arch Linux Security Advisory ASA-201607-12 ========================================== Severity: Critical Date : 2016-07-24 CVE-ID : CVE-2016-1705 CVE-2016-1706 CVE-2016-1708 CVE-2016-1709 CVE-2016-1710 CVE-2016-1711 CVE-2016-5127 CVE-2016-5128 CVE-2016-5129 CVE-2016-5130 CVE-2016-5131 CVE-2016-5132 CVE-2016-5133 CVE-2016-5134 CVE-2016-5135 CVE-2016-5136 CVE-2016-5137 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 52.0.2743.82-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 52.0.2743.82-1. # pacman -Syu "chromium>=52.0.2743.82-1" The problems have been fixed upstream in version 52.0.2743.82. Workaround ========== None. Description =========== - CVE-2016-1705 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. - CVE-2016-1706 (sandbox escape) Sandbox escape in PPAPI. Credit to Pinkie Pie. - CVE-2016-1708 (arbitrary code execution) Use-after-free in Extensions. Credit to Adam Varsan. - CVE-2016-1709 (arbitrary code execution) Heap-buffer-overflow in sfntly. Credit to ChenQin of Topsec Security Team. - CVE-2016-1710, CVE-2016-1711 (same-origin policy bypass) Same-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-5127 (arbitrary code execution) Use-after-free in Blink. Credit to cloudfuzzer. - CVE-2016-5128 (same-origin policy bypass) Same-origin bypass in V8. - CVE-2016-5129 (arbitrary code execution) Memory corruption in V8. Credit to Jeonghoon Shin. - CVE-2016-5130 (URL spoofing) URL spoofing. Credit to Wadih Matar. - CVE-2016-5131 (arbitrary code execution) Use-after-free in libxml. Credit to Nick Wellnhofer. - CVE-2016-5132 (same-origin policy bypass) Limited same-origin bypass in Service Workers. Credit to Ben Kelly. - CVE-2016-5133 (man-in-the-middle) Origin confusion in proxy authentication. Credit to Patch Eudor. - CVE-2016-5134 (information leakage) URL leakage via PAC script. Credit to Paul Stone. - CVE-2016-5135 (content security policy bypass) Content-Security-Policy bypass. Credit to ShenYeYinJiu of Tencent Security Response Center, TSRC. - CVE-2016-5136 (arbitrary code execution) Use after free in extensions. Credit to Rob Wu. - CVE-2016-5137 (information leakage) History sniffing with HSTS and CSP. Credit to Xiaoyin Liu. Impact ====== A remote attacker can access sensitive information, bypass policies or execute arbitrary code on the affected host. References ========== https://googlechromereleases.blogspot.fr/2016/07/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2016-1705 https://access.redhat.com/security/cve/CVE-2016-1706 https://access.redhat.com/security/cve/CVE-2016-1708 https://access.redhat.com/security/cve/CVE-2016-1709 https://access.redhat.com/security/cve/CVE-2016-1710 https://access.redhat.com/security/cve/CVE-2016-1711 https://access.redhat.com/security/cve/CVE-2016-5127 https://access.redhat.com/security/cve/CVE-2016-5128 https://access.redhat.com/security/cve/CVE-2016-5129 https://access.redhat.com/security/cve/CVE-2016-5130 https://access.redhat.com/security/cve/CVE-2016-5131 https://access.redhat.com/security/cve/CVE-2016-5132 https://access.redhat.com/security/cve/CVE-2016-5133 https://access.redhat.com/security/cve/CVE-2016-5134 https://access.redhat.com/security/cve/CVE-2016-5135 https://access.redhat.com/security/cve/CVE-2016-5136 https://access.redhat.com/security/cve/CVE-2016-5137

1 0

[arch-security] [ASA-201607-11] python2-django: cross-site scripting
by Jelle van der Waa 22 Jul '16

22 Jul '16

Arch Linux Security Advisory ASA-201607-11 ========================================== Severity: Medium Date : 2016-07-22 CVE-ID : CVE-2016-6186 Package : python2-django Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python2-django before version 1.9.8-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.9.8-1. # pacman -Syu "python2-django>=1.9.8-1" The problem has been fixed upstream in version 1.9.8. Workaround ========== None. Description =========== Unsafe usage of JavaScript's Element.innerHTML could result in XSS in the admin's add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML. Although a security issue wasn't identified there, out of an abundance of caution it's also updated to use textContent. Impact ====== An attacker is able to execute arbitrary javascript code in the client's browser by inserting code in the admin's add/change related popup. References ========== https://www.djangoproject.com/weblog/2016/jul/18/security-releases/ http://article.gmane.org/gmane.comp.python.django.announce/54 https://access.redhat.com/security/cve/CVE-2016-6186

1 0

[arch-security] [ASA-201607-10] python-django: cross-site scripting
by Jelle van der Waa 22 Jul '16

22 Jul '16

Arch Linux Security Advisory ASA-201607-10 ========================================== Severity: Medium Date : 2016-07-22 CVE-ID : CVE-2016-6186 Package : python-django Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package python-django before version 1.9.8-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.9.8-1. # pacman -Syu "python-django>=1.9.8-1" The problem has been fixed upstream in version 1.9.8. Workaround ========== None. Description =========== Unsafe usage of JavaScript's Element.innerHTML could result in XSS in the admin's add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML. Although a security issue wasn't identified there, out of an abundance of caution it's also updated to use textContent. Impact ====== An attacker is able to execute arbitrary javascript code in the client's browser by inserting code in the admin's add/change related popup. References ========== https://www.djangoproject.com/weblog/2016/jul/18/security-releases/ http://article.gmane.org/gmane.comp.python.django.announce/54 https://access.redhat.com/security/cve/CVE-2016-6186

1 0

[arch-security] [ASA-201607-9] drupal: proxy injection
by Christian Rebischke 21 Jul '16

21 Jul '16

Arch Linux Security Advisory ASA-201607-9 ========================================= Severity: High Date : 2016-07-21 CVE-ID : CVE-2016-5385 Package : drupal Type : proxy injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package drupal before version 8.1.7-1 is vulnerable to proxy injection via environment variable. Resolution ========== Upgrade to 8.1.7-1. # pacman -Syu "drupal>=8.1.7-1" The problem has been fixed upstream in version 8.1.7. Workaround ========== Apache (.htaccess) <IfModule mod_headers.c> RequestHeader unset Proxy </IfModule> NGINX/FastCGI fastcgi_param HTTP_PROXY ""; For any other service please visit: https://httpoxy.org/ Description =========== Drupal 8 uses the third-party PHP library Guzzle for making server-side HTTP requests. An attacker can provide a proxy server that Guzzle will use. This vulnerability is called 'httpoxy'. httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments. It comes down to a simple namespace conflict: RFC 3875 (CGI) puts the HTTP Proxy header from a request into the environment variables as HTTP_PROXY HTTP_PROXY is a popular environment variable used to configure an outgoing proxy This leads to a remotely exploitable vulnerability. If you’re running PHP or CGI, you should block the Proxy header now. Impact ====== A remote attacker is able to proxy the outgoing HTTP requests made by the web application, direct the server to open outgoing connections to an address and port of their choosing or tie up server resources by forcing the vulnerable software to use a malicious proxy. References ========== https://access.redhat.com/security/cve/CVE-2016-5385 https://www.drupal.org/SA-CORE-2016-003 https://httpoxy.org/ https://bugzilla.redhat.com/show_bug.cgi?id=1353794

1 0

[arch-security] [ASA-201607-8] bind: denial of service
by Remi Gacogne 20 Jul '16

20 Jul '16

Arch Linux Security Advisory ASA-201607-8 ========================================= Severity: Medium Date : 2016-07-20 CVE-ID : CVE-2016-2775 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.4.P2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.4.P2-1. # pacman -Syu "bind>=9.10.4.P2-1" The problem has been fixed upstream in version 9.10.4.P2. Workaround ========== None. Description =========== Although not commonly used, the BIND package contains provisions to allow systems to resolve names using the lightweight resolver protocol, a protocol similar to (but distinct from) the normal DNS protocols. The lightweight resolver protocol can be used either by running the lwresd utility installed with BIND or by configuring named using the "lwres" statement in named.conf. An error has been discovered in the BIND implementation of the lightweight resolver protocol affecting systems which use this alternate method to do name resolution. A server which is affected by this defect will terminate with a segmentation fault error, resulting in a denial of service to client programs attempting to resolve names. Impact ====== A remote attacker can crash the server by sending a crafted request, causing a denial of service. References ========== https://kb.isc.org/article/AA-01393/74/CVE-2016-2775 https://access.redhat.com/security/cve/CVE-2016-2775

1 0