- Arch-security - lists.archlinux.org

[arch-security] [ASA-201607-7] lib32-flashplugin: multiple issues
by Levente Polyak 18 Jul '16

18 Jul '16

Arch Linux Security Advisory ASA-201607-7 ========================================= Severity: Critical Date : 2016-07-18 CVE-ID : CVE-2016-4173 CVE-2016-4174 CVE-2016-4175 CVE-2016-4176 CVE-2016-4177 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4222 CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4232 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 CVE-2016-4247 CVE-2016-4248 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.632-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 11.2.202.632-1. # pacman -Syu "lib32-flashplugin>=11.2.202.632-1" The problems have been fixed upstream in version 11.2.202.632. Workaround ========== None. Description =========== - CVE-2016-4175 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 (arbitrary code execution) Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by willJ of Tencent PC Manager, Sébastien Morin of COSIG, Yuki Chen of Qihoo 360 Vulcan Team, Wen Guanxing from Pangu LAB, and Jie Zeng of Tencent Zhanlu Lab. - CVE-2016-4247 (information disclosure) A race condition that could lead to information disclosure has been discovered. This vulnerability has been discovered by Stefan Kanthak. - CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 (arbitrary code execution) Three type confusion vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by Ohara Rinne, Kurutsu Karen, and Garandou Sara working with Trend Micro's Zero Day Initiative. - CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4248 (arbitrary code execution) Multiple use-after-free vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities have been discovered by Nicolas Joly of Microsoft Vulnerability Research, Kai Kang (a.k.a 4B5F5F4B) working with Trend Micro's Zero Day Initiative, Jaehun Jeong(@n3sk) of WINS WSEC Analysis Team working with Trend Micro's Zero Day Initiative, and Natalie Silvanovich of Google Project Zero, and Wen Guanxing from Pangu LAB. - CVE-2016-4249 (arbitrary code execution) A heap buffer overflow vulnerability that could lead to arbitrary code execution has been found. This vulnerability has been discovered to Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program. - CVE-2016-4232 (memory leak) A memory leak vulnerability has been discovered. This vulnerability has been discovered by Natalie Silvanovich of Google Project Zero. - CVE-2016-4176 CVE-2016-4177 (arbitrary code execution) Two stack corruption vulnerabilities that could lead to arbitrary code execution have been found. These have been found by Francis Provencher of COSIG. - CVE-2016-4178 (information disclosure) A security bypass vulnerability that could lead to information disclosure has been discovered. These issues have been discovered by Soroush Dalili and Matthew Evans from NCC Group. Impact ====== A remote attacker can execute arbitrary code, crash the process, or disclose information on the affected host via unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-25.html https://access.redhat.com/security/cve/CVE-2016-4173 https://access.redhat.com/security/cve/CVE-2016-4174 https://access.redhat.com/security/cve/CVE-2016-4175 https://access.redhat.com/security/cve/CVE-2016-4176 https://access.redhat.com/security/cve/CVE-2016-4177 https://access.redhat.com/security/cve/CVE-2016-4179 https://access.redhat.com/security/cve/CVE-2016-4180 https://access.redhat.com/security/cve/CVE-2016-4181 https://access.redhat.com/security/cve/CVE-2016-4182 https://access.redhat.com/security/cve/CVE-2016-4183 https://access.redhat.com/security/cve/CVE-2016-4184 https://access.redhat.com/security/cve/CVE-2016-4185 https://access.redhat.com/security/cve/CVE-2016-4186 https://access.redhat.com/security/cve/CVE-2016-4187 https://access.redhat.com/security/cve/CVE-2016-4188 https://access.redhat.com/security/cve/CVE-2016-4189 https://access.redhat.com/security/cve/CVE-2016-4190 https://access.redhat.com/security/cve/CVE-2016-4217 https://access.redhat.com/security/cve/CVE-2016-4218 https://access.redhat.com/security/cve/CVE-2016-4219 https://access.redhat.com/security/cve/CVE-2016-4220 https://access.redhat.com/security/cve/CVE-2016-4221 https://access.redhat.com/security/cve/CVE-2016-4222 https://access.redhat.com/security/cve/CVE-2016-4223 https://access.redhat.com/security/cve/CVE-2016-4224 https://access.redhat.com/security/cve/CVE-2016-4225 https://access.redhat.com/security/cve/CVE-2016-4226 https://access.redhat.com/security/cve/CVE-2016-4227 https://access.redhat.com/security/cve/CVE-2016-4228 https://access.redhat.com/security/cve/CVE-2016-4229 https://access.redhat.com/security/cve/CVE-2016-4230 https://access.redhat.com/security/cve/CVE-2016-4231 https://access.redhat.com/security/cve/CVE-2016-4232 https://access.redhat.com/security/cve/CVE-2016-4233 https://access.redhat.com/security/cve/CVE-2016-4234 https://access.redhat.com/security/cve/CVE-2016-4235 https://access.redhat.com/security/cve/CVE-2016-4236 https://access.redhat.com/security/cve/CVE-2016-4237 https://access.redhat.com/security/cve/CVE-2016-4238 https://access.redhat.com/security/cve/CVE-2016-4239 https://access.redhat.com/security/cve/CVE-2016-4240 https://access.redhat.com/security/cve/CVE-2016-4241 https://access.redhat.com/security/cve/CVE-2016-4242 https://access.redhat.com/security/cve/CVE-2016-4243 https://access.redhat.com/security/cve/CVE-2016-4244 https://access.redhat.com/security/cve/CVE-2016-4245 https://access.redhat.com/security/cve/CVE-2016-4246 https://access.redhat.com/security/cve/CVE-2016-4247 https://access.redhat.com/security/cve/CVE-2016-4248

1 0

[arch-security] [ASA-201607-6] flashplugin: multiple issues
by Levente Polyak 18 Jul '16

18 Jul '16

Arch Linux Security Advisory ASA-201607-6 ========================================= Severity: Critical Date : 2016-07-18 CVE-ID : CVE-2016-4173 CVE-2016-4174 CVE-2016-4175 CVE-2016-4176 CVE-2016-4177 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4222 CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4232 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 CVE-2016-4247 CVE-2016-4248 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.632-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 11.2.202.632-1. # pacman -Syu "flashplugin>=11.2.202.632-1" The problems have been fixed upstream in version 11.2.202.632. Workaround ========== None. Description =========== - CVE-2016-4175 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235 CVE-2016-4236 CVE-2016-4237 CVE-2016-4238 CVE-2016-4239 CVE-2016-4240 CVE-2016-4241 CVE-2016-4242 CVE-2016-4243 CVE-2016-4244 CVE-2016-4245 CVE-2016-4246 (arbitrary code execution) Multiple Memory corruption vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by willJ of Tencent PC Manager, Sébastien Morin of COSIG, Yuki Chen of Qihoo 360 Vulcan Team, Wen Guanxing from Pangu LAB, and Jie Zeng of Tencent Zhanlu Lab. - CVE-2016-4247 (information disclosure) A race condition that could lead to information disclosure has been discovered. This vulnerability has been discovered by Stefan Kanthak. - CVE-2016-4223 CVE-2016-4224 CVE-2016-4225 (arbitrary code execution) Three type confusion vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities were discovered by Ohara Rinne, Kurutsu Karen, and Garandou Sara working with Trend Micro's Zero Day Initiative. - CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 CVE-2016-4248 (arbitrary code execution) Multiple use-after-free vulnerabilities that could lead to arbitrary code execution have been found. These vulnerabilities have been discovered by Nicolas Joly of Microsoft Vulnerability Research, Kai Kang (a.k.a 4B5F5F4B) working with Trend Micro's Zero Day Initiative, Jaehun Jeong(@n3sk) of WINS WSEC Analysis Team working with Trend Micro's Zero Day Initiative, and Natalie Silvanovich of Google Project Zero, and Wen Guanxing from Pangu LAB. - CVE-2016-4249 (arbitrary code execution) A heap buffer overflow vulnerability that could lead to arbitrary code execution has been found. This vulnerability has been discovered to Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program. - CVE-2016-4232 (memory leak) A memory leak vulnerability has been discovered. This vulnerability has been discovered by Natalie Silvanovich of Google Project Zero. - CVE-2016-4176 CVE-2016-4177 (arbitrary code execution) Two stack corruption vulnerabilities that could lead to arbitrary code execution have been found. These have been found by Francis Provencher of COSIG. - CVE-2016-4178 (information disclosure) A security bypass vulnerability that could lead to information disclosure has been discovered. These issues have been discovered by Soroush Dalili and Matthew Evans from NCC Group. Impact ====== A remote attacker can execute arbitrary code, crash the process, or disclose information on the affected host via unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-25.html https://access.redhat.com/security/cve/CVE-2016-4173 https://access.redhat.com/security/cve/CVE-2016-4174 https://access.redhat.com/security/cve/CVE-2016-4175 https://access.redhat.com/security/cve/CVE-2016-4176 https://access.redhat.com/security/cve/CVE-2016-4177 https://access.redhat.com/security/cve/CVE-2016-4179 https://access.redhat.com/security/cve/CVE-2016-4180 https://access.redhat.com/security/cve/CVE-2016-4181 https://access.redhat.com/security/cve/CVE-2016-4182 https://access.redhat.com/security/cve/CVE-2016-4183 https://access.redhat.com/security/cve/CVE-2016-4184 https://access.redhat.com/security/cve/CVE-2016-4185 https://access.redhat.com/security/cve/CVE-2016-4186 https://access.redhat.com/security/cve/CVE-2016-4187 https://access.redhat.com/security/cve/CVE-2016-4188 https://access.redhat.com/security/cve/CVE-2016-4189 https://access.redhat.com/security/cve/CVE-2016-4190 https://access.redhat.com/security/cve/CVE-2016-4217 https://access.redhat.com/security/cve/CVE-2016-4218 https://access.redhat.com/security/cve/CVE-2016-4219 https://access.redhat.com/security/cve/CVE-2016-4220 https://access.redhat.com/security/cve/CVE-2016-4221 https://access.redhat.com/security/cve/CVE-2016-4222 https://access.redhat.com/security/cve/CVE-2016-4223 https://access.redhat.com/security/cve/CVE-2016-4224 https://access.redhat.com/security/cve/CVE-2016-4225 https://access.redhat.com/security/cve/CVE-2016-4226 https://access.redhat.com/security/cve/CVE-2016-4227 https://access.redhat.com/security/cve/CVE-2016-4228 https://access.redhat.com/security/cve/CVE-2016-4229 https://access.redhat.com/security/cve/CVE-2016-4230 https://access.redhat.com/security/cve/CVE-2016-4231 https://access.redhat.com/security/cve/CVE-2016-4232 https://access.redhat.com/security/cve/CVE-2016-4233 https://access.redhat.com/security/cve/CVE-2016-4234 https://access.redhat.com/security/cve/CVE-2016-4235 https://access.redhat.com/security/cve/CVE-2016-4236 https://access.redhat.com/security/cve/CVE-2016-4237 https://access.redhat.com/security/cve/CVE-2016-4238 https://access.redhat.com/security/cve/CVE-2016-4239 https://access.redhat.com/security/cve/CVE-2016-4240 https://access.redhat.com/security/cve/CVE-2016-4241 https://access.redhat.com/security/cve/CVE-2016-4242 https://access.redhat.com/security/cve/CVE-2016-4243 https://access.redhat.com/security/cve/CVE-2016-4244 https://access.redhat.com/security/cve/CVE-2016-4245 https://access.redhat.com/security/cve/CVE-2016-4246 https://access.redhat.com/security/cve/CVE-2016-4247 https://access.redhat.com/security/cve/CVE-2016-4248

1 0

[arch-security] [ASA-201607-5] gimp: arbitrary code execution
by Christian Rebischke 17 Jul '16

17 Jul '16

Arch Linux Security Advisory ASA-201607-5 ========================================= Severity: Medium Date : 2016-07-17 CVE-ID : CVE-2016-4994 Package : gimp Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gimp before version 2.8.18-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.8.18-1. # pacman -Syu "gimp>=2.8.18-1" The problem has been fixed upstream in version 2.8.18. Workaround ========== None. Description =========== Multiple Use-After-Free when parsing XCF channel and layer properties. Impact ====== An attacker is able to use a specially crafted XCF file, that when opened locally, is leading to arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2016-4994 https://bugzilla.gnome.org/show_bug.cgi?id=767873

1 0

[arch-security] [ASA-201607-4] thunderbird: arbitrary code execution
by Remi Gacogne 10 Jul '16

10 Jul '16

Arch Linux Security Advisory ASA-201607-4 ========================================= Severity: Critical Date : 2016-07-10 CVE-ID : CVE-2016-2815 CVE-2016-2818 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.2.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 45.2.0-1. # pacman -Syu "thunderbird>=45.2.0-1" The problems have been fixed upstream in version 45.2.0. Workaround ========== None. Description =========== - CVE-2016-2815 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-2818 (arbitrary code execution) Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://access.redhat.com/security/cve/CVE-2016-2815 https://access.redhat.com/security/cve/CVE-2016-2818

1 0

[arch-security] [ASA-201607-3] libreoffice-fresh: arbitrary code execution
by Levente Polyak 05 Jul '16

05 Jul '16

Arch Linux Security Advisory ASA-201607-3 ========================================= Severity: Critical Date : 2016-07-05 CVE-ID : CVE-2016-4324 Package : libreoffice-fresh Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libreoffice-fresh before version 5.1.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.1.4-1. # pacman -Syu "libreoffice-fresh>=5.1.4-1" The problem has been fixed upstream in version 5.1.4. Workaround ========== None. Description =========== A use after free vulnerability was found in the RTF parser of LibreOffice. The vulnerability lies in the parsing of documents containing both stylesheet and superscript tokens. A specially crafted RTF document containing both a stylesheet and superscript element causes LibreOffice to access an invalid pointer referencing previously used memory on the heap. By carefully manipulating the contents of the heap, this vulnerability can be used to execute arbitrary code. Impact ====== An attacker is able to use a specially crafted RTF document that, when opened locally, is leading to arbitrary code execution. References ========== https://www.libreoffice.org/about-us/security/advisories/cve-2016-4324/ http://www.talosintelligence.com/reports/TALOS-2016-0126/ https://access.redhat.com/security/cve/CVE-2016-4324

1 0

[arch-security] [ASA-201607-2] xerces-c: denial of service
by Levente Polyak 05 Jul '16

05 Jul '16

Arch Linux Security Advisory ASA-201607-2 ========================================= Severity: Medium Date : 2016-07-05 CVE-ID : CVE-2016-4463 Package : xerces-c Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package xerces-c before version 3.1.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.1.4-1. # pacman -Syu "xerces-c>=3.1.4-1" The problem has been fixed upstream in version 3.1.4. Workaround ========== None. Description =========== The Xerces-C XML parser fails to successfully parse a DTD that is deeply nested, and this causes a stack overflow, which makes a denial of service attack against many applications possible by an unauthenticated attacker. Impact ====== A remote attacker is able to use a specially crafted XML document that, when processed, is leading to application crash resulting in denial of service. References ========== https://xerces.apache.org/xerces-c/secadv/CVE-2016-4463.txt http://seclists.org/bugtraq/2016/Jun/115 https://access.redhat.com/security/cve/CVE-2016-4463

1 0

[arch-security] [ASA-201607-1] libarchive: arbitrary code execution
by Levente Polyak 05 Jul '16

05 Jul '16

Arch Linux Security Advisory ASA-201607-1 ========================================= Severity: Critical Date : 2016-07-05 CVE-ID : CVE-2016-1541 Package : libarchive Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libarchive before version 3.2.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.2.0-1. # pacman -Syu "libarchive>=3.2.0-1" The problem has been fixed upstream in version 3.2.0. Workaround ========== None. Description =========== A vulnerability was found in libarchive. A specially crafted zip file can provide an incorrect compressed size, which may allow an attacker to place arbitrary code on the heap and execute it in the context of the application. Impact ====== A remote attacker is able to use a specially crafted zip file that, when processed, is leading to arbitrary code execution. References ========== https://github.com/libarchive/libarchive/commit/d0331e8e https://www.kb.cert.org/vuls/id/862384 https://access.redhat.com/security/cve/CVE-2016-1541

1 0

[arch-security] [ASA-201606-25] phpmyadmin: multiple issues
by Jelle van der Waa 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-25 ========================================== Severity: High Date : 2016-06-25 CVE-ID : CVE-2016-5701 CVE-2016-5702 CVE-2016-5703 CVE-2016-5704 CVE-2016-5705 CVE-2016-5706 CVE-2016-5730 CVE-2016-5731 CVE-2016-5732 CVE-2016-5732 CVE-2016-5733 CVE-2016-5739 Package : phpmyadmin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package phpmyadmin before version 4.6.3-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 4.6.3-1. # pacman -Syu "phpmyadmin>=4.6.3-1" The problems have been fixed upstream in version 4.6.3. Workaround ========== None. Description =========== - CVE-2016-5702 (cookie attribute injection) A vulnerability was found where, under some circumstances, an attacker can inject arbitrary values in the browser cookies. Only affected when PHP_SELF is not set. - CVE-2016-5703 (SQL injection) A vulnerability was discovered that allows an SQL injection attack to run arbitrary commands as the control user. This attack requires a controluser to exist and be configured in `config.inc.php`, therefore the attack can be mitigated by temporarily disabling the controluser. - CVE-2016-5704 (cross-side scripting) An cross-side scripting vulnerability was discovered on the table structure page - CVE-2016-5705 (cross-side scripting) * An cross-side scripting vulnerability was discovered on the user privileges page. * An cross-side scripting vulnerability was discovered in the error console. * An cross-side scripting vulnerability was discovered in the central columns feature. * An cross-side scripting vulnerability was discovered in the query bookmarks feature. * An cross-side scripting vulnerability was discovered in the user groups feature. - CVE-2016-5706 (denial of service) A Denial Of Service (DOS) attack was discovered in the way phpMyAdmin loads some JavaScript files. - CVE-2016-5730 (information disclosure) By specially crafting requests in the following areas, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. 1. Setup script 2. Example OpenID authentication script To mitigate these issues, it is possible to remove the setup script and examples subdirectories: ./setup/ and ./examples/. - CVE-2016-5731 (cross-side scripting) With a specially crafted request, it is possible to trigger an cross-side scripting attack through the example OpenID authentication script. Only affected when the default php.ini is changed and set html_errors = Off. - CVE-2016-5732 (cross-side scripting) A vulnerability was reported allowing a specially crafted table parameters to cause an cross-side scripting attack through the table structure page. - CVE-2016-57033 (cross-side scripting) * A vulnerability was reported allowing a specially crafted table name to cause an cross-side scripting attack through the functionality to check database privileges. * This cross-side scripting doesn't exist in some translations due to different quotes being used there (eg. Czech). * A vulnerability was reported allowing a specifically-configured MySQL server to execute an cross-side scripting attack. This particular attack requires configuring the MySQL server log_bin directive with the payload. * Several cross-side scripting vulnerabilities were found with the Transformation feature * Several cross-side scripting vulnerabilities were found in AJAX error handling * Several cross-side scripting vulnerabilities were found in the Designer feature * An cross-side scripting vulnerability was found in the charts feature * An cross-side scripting vulnerability was found in the zoom search feature - CVE-2016-5739 (information disclosure) A vulnerability was reported where a specially crafted Transformation could be used to leak information including the authentication token. This could be used to direct a CSRF attack against a user. Impact ====== A remote attacker might be able to access sensitive information, cause a denial of service, cause a cross-side scripting attack or cause an SQL injection. References ========== https://access.redhat.com/security/cve/CVE-2016-5701 https://access.redhat.com/security/cve/CVE-2016-5702 https://access.redhat.com/security/cve/CVE-2016-5703 https://access.redhat.com/security/cve/CVE-2016-5704 https://access.redhat.com/security/cve/CVE-2016-5705 https://access.redhat.com/security/cve/CVE-2016-5706 https://access.redhat.com/security/cve/CVE-2016-5730 https://access.redhat.com/security/cve/CVE-2016-5731 https://access.redhat.com/security/cve/CVE-2016-5732 https://access.redhat.com/security/cve/CVE-2016-5733 https://access.redhat.com/security/cve/CVE-2016-5739 https://www.phpmyadmin.net/security/PMASA-2016-17/ https://www.phpmyadmin.net/security/PMASA-2016-18/ https://www.phpmyadmin.net/security/PMASA-2016-19/ https://www.phpmyadmin.net/security/PMASA-2016-20/ https://www.phpmyadmin.net/security/PMASA-2016-21/ https://www.phpmyadmin.net/security/PMASA-2016-22/ https://www.phpmyadmin.net/security/PMASA-2016-23/ https://www.phpmyadmin.net/security/PMASA-2016-24/ https://www.phpmyadmin.net/security/PMASA-2016-25/ https://www.phpmyadmin.net/security/PMASA-2016-26/ https://www.phpmyadmin.net/security/PMASA-2016-27/ https://www.phpmyadmin.net/security/PMASA-2016-28/

1 0

[arch-security] [ASA-201606-24] libpurple: multiple issues
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-24 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-2365 CVE-2016-2366 CVE-2016-2367 CVE-2016-2368 CVE-2016-2369 CVE-2016-2370 CVE-2016-2371 CVE-2016-2372 CVE-2016-2373 CVE-2016-2374 CVE-2016-2375 CVE-2016-2376 CVE-2016-2377 CVE-2016-2378 CVE-2016-2380 CVE-2016-4323 Package : libpurple Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libpurple before version 2.11.0-1 is vulnerable to multiple issues including information leakage, denial of service, directory traversal and arbitrary code execution. Resolution ========== Upgrade to 2.11.0-1. # pacman -Syu "libpurple>=2.11.0-1" The problems have been fixed upstream in version 2.11.0. Workaround ========== All flaws have been found in the support for the MXit protocol. Therefore libpurple is only vulnerable when this protocol is used, so disabling MXit accounts until the package can be upgraded should be enough. Description =========== - CVE-2016-2365 (denial of service) Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. - CVE-2016-2366 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. - CVE-2016-2367 (information leakage, denial of service) Specially crafted MXIT data sent via the server could potentially result in an out of bounds read. This issue can also potentially leak sensitive information from memory into the data after the avatar which can then be transferred when the avatar is copied. - CVE-2016-2368 (arbitrary code execution) Specially crafted MXIT data sent via the server could potentially result in a buffer overflow. The MXIT plugin for Pidgin uses the function g_snprintf() in about 27 places where it receives the return value of the function. When g_snprintf() returns, it will return the number of bytes that would have been written had the buffer been large enough, not the amount of bytes that have actually been written. The MXIT plugin uses the return value of g_snprintf() as an index or an offset into the string that is being manipulated in multiple locations without making sure that the return value is within bounds. - CVE-2016-2369 (denial of service) Specially crafted MXIT data sent via the server could potentially result in a NULL pointer dereference. - CVE-2016-2370 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. - CVE-2016-2371 (arbitrary code execution) Specially crafted MXIT data sent via the server could potentially result in a buffer overflow. The function mxit_parse_cmd_extprofile() is called when extended profile packets are received from the server. A malicious server, an attacker who intercepts the network traffic or a potentially malicious user (if the data is not validated by the server) can send an invalid number of records, which could result in an out-of-bounds write of data. - CVE-2016-2372 (information leakage, denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. This issue can also potentially leak sensitive information by appending sensitive information from memory to the end of a received file. - CVE-2016-2373 (denial of service) Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability. - CVE-2016-2374 (arbitrary code execution) Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution. - CVE-2016-2375 (information leakage) Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. In the function mxit_parse_cmd_suggestcontacts() in the file mxit/protocol.c at line 2020 the number of attributes will be read from the incoming packet into the variable count. - CVE-2016-2376 (arbitrary code execution) Specially crafted MXIT data sent from the server could potentially result in a buffer overflow. The function mxit_cb_rx in the file mxit/protocol.c is a callback function will be called by Pidgin whenever data is sent from the MXIT server. When data is received, the size of the incoming packet will also be received at line 2825. There is a check at line 2826 to ensure that this data isn't larger than the maximum size of that an MXIT packet can be which is defined as CP_MAX_PACKET. This is also the size of the buffer that the data is read into. However if the size is larger than CP_MAX_PACKET, an error will be logged but execution will simply continue. Moreover, if the size is negative (this is possible since rx_res is an int) then no error will be logged and execution will also continue. - CVE-2016-2377 (arbitrary code execution) Specially crafted MXIT data sent by the server could potentially result in an out of bounds write of one byte. - CVE-2016-2378 (arbitrary code execution) Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. - CVE-2016-2380 (information leakage) Specially crafted MXIT data sent to the server could potentially result in an out of bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read. - CVE-2016-4323 (directory traversal) Specially crafted MXIT data sent from the server could potentially result in an overwrite of files. A malicious server or someone with access to the network traffic can provide an invalid filename for a splash image triggering the vulnerability. Impact ====== A remote attacker might be able to access sensitive information, cause a denial of service or execute arbitrary code on the affected host. References ========== http://blog.talosintel.com/2016/06/vulnerability-spotlight-pidgin.html https://access.redhat.com/security/cve/CVE-2016-2365 https://access.redhat.com/security/cve/CVE-2016-2366 https://access.redhat.com/security/cve/CVE-2016-2367 https://access.redhat.com/security/cve/CVE-2016-2368 https://access.redhat.com/security/cve/CVE-2016-2369 https://access.redhat.com/security/cve/CVE-2016-2370 https://access.redhat.com/security/cve/CVE-2016-2371 https://access.redhat.com/security/cve/CVE-2016-2372 https://access.redhat.com/security/cve/CVE-2016-2373 https://access.redhat.com/security/cve/CVE-2016-2374 https://access.redhat.com/security/cve/CVE-2016-2375 https://access.redhat.com/security/cve/CVE-2016-2376 https://access.redhat.com/security/cve/CVE-2016-2377 https://access.redhat.com/security/cve/CVE-2016-2378 https://access.redhat.com/security/cve/CVE-2016-2380 https://access.redhat.com/security/cve/CVE-2016-4323

1 0

[arch-security] [ASA-201606-23] libdwarf: arbitrary code execution
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-23 ========================================== Severity: High Date : 2016-06-25 CVE-ID : CVE-2016-5027 CVE-2016-5028 CVE-2016-5029 CVE-2016-5030 CVE-2016-5031 CVE-2016-5032 CVE-2016-5033 CVE-2016-5034 CVE-2016-5035 CVE-2016-5036 CVE-2016-5037 CVE-2016-5038 CVE-2016-5039 CVE-2016-5040 CVE-2016-5041 CVE-2016-5042 CVE-2016-5043 CVE-2016-5044 Package : libdwarf Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libdwarf before version 20160613-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 20160613-1. # pacman -Syu "libdwarf>=20160613-1" The problems have been fixed upstream in version 20160613. Workaround ========== None. Description =========== - CVE-2016-5027 (denial of service) Multiple NULL pointer dereference issues in several functions of libdwarf/dwarf_leb.c, where leb128_length was wrongly assumed non-NULL. - CVE-2016-5028 (denial of service) NULL pointer dereference issue in print_frame_inst_bytes(). - CVE-2016-5029 (denial of service) NULL pointer dereference issue in create_fullest_file_path(). - CVE-2016-5030 (denial of service) NULL pointer dereference issue in _dwarf_calculate_info_section_end_ptr(). - CVE-2016-5031 (denial of service) Out-of-bounds read bug in print_frame_inst_bytes(). - CVE-2016-5032 (denial of service) Out-of-bounds read bug in dwarf_get_xu_hash_entry(). - CVE-2016-5033 (denial of service) Out-of-bounds read bug in print_exprloc_content(). - CVE-2016-5034 (arbitrary code execution) Invalid write in dwarf_elf_access.c. - CVE-2016-5035 (denial of service) Out-of-bounds read bug in _dwarf_read_line_table_header(). - CVE-2016-5036 (denial of service) Out-of-bounds read bug in dump_block(). - CVE-2016-5037 (denial of service) NULL pointer dereference issue in _dwarf_load_section(). - CVE-2016-5038 (denial of service) NULL pointer dereference issue in dwarf_get_macro_startend_file(). - CVE-2016-5039 (denial of service) Out-of-bounds read bug in get_attr_value(). - CVE-2016-5040 (denial of service) Out-of-bounds read bug. - CVE-2016-5041 (denial of service) NULL pointer dereference issue. - CVE-2016-5042 (denial of service) Infinite loop leading to out-of-bounds read in dwarf_get_aranges_list(). - CVE-2016-5043 (denial of service) Out-of-bounds read bug in dwarf_dealloc(). - CVE-2016-5044 (arbitrary code execution) Heap-overflow. Impact ====== An attacker might be able to execute arbitrary code on the affected host with a crafted ELF file, or crafted dwarf sections in a object file. References ========== http://seclists.org/oss-sec/2016/q2/393 https://www.prevanders.net/dwarfbug.html https://access.redhat.com/security/cve/CVE-2016-5027 https://access.redhat.com/security/cve/CVE-2016-5028 https://access.redhat.com/security/cve/CVE-2016-5029 https://access.redhat.com/security/cve/CVE-2016-5030 https://access.redhat.com/security/cve/CVE-2016-5031 https://access.redhat.com/security/cve/CVE-2016-5032 https://access.redhat.com/security/cve/CVE-2016-5033 https://access.redhat.com/security/cve/CVE-2016-5034 https://access.redhat.com/security/cve/CVE-2016-5035 https://access.redhat.com/security/cve/CVE-2016-5036 https://access.redhat.com/security/cve/CVE-2016-5037 https://access.redhat.com/security/cve/CVE-2016-5038 https://access.redhat.com/security/cve/CVE-2016-5039 https://access.redhat.com/security/cve/CVE-2016-5040 https://access.redhat.com/security/cve/CVE-2016-5041 https://access.redhat.com/security/cve/CVE-2016-5042 https://access.redhat.com/security/cve/CVE-2016-5043 https://access.redhat.com/security/cve/CVE-2016-5044

1 0