- Arch-security - lists.archlinux.org

[arch-security] [ASA-201606-22] xerces-c: arbitrary code execution
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-22 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-2099 Package : xerces-c Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package xerces-c before version 3.1.3-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.1.3-2. # pacman -Syu "xerces-c>=3.1.3-2" The problem has been fixed upstream in version 3.1.3. Workaround ========== None. Description =========== The DTDScanner fails to account for the fact that peeking characters in the XMLReader class can raise an exception if an invalid character is encountered, and the exception crosses stack frames in an unsafe way that causes a higher level exception handler to access an already-freed object. Impact ====== A remote attacker might be able to cause a denial of service or execute arbitrary code on the affected host by submitting a crafted DTD file. References ========== https://bugs.archlinux.org/task/49353 https://issues.apache.org/jira/browse/XERCESC-2066 http://www.openwall.com/lists/oss-security/2016/05/09/7 https://access.redhat.com/security/cve/CVE-2016-2099

1 0

[arch-security] [ASA-201606-21] vlc: arbitrary code execution
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-21 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-5108 Package : vlc Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package vlc before version 2.2.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.2.4-1. # pacman -Syu "vlc>=2.2.4-1" The problem has been fixed upstream in version 2.2.4. Workaround ========== None. Description =========== A buffer overflow has been found in the DecodeAdpcmImaQT() function of VLC's QuickTime IMA decoder. Impact ====== A remote attacker might be able to cause a denial of service or execute arbitrary code on the affected host via a crafted QuickTime IMA file. References ========== http://www.openwall.com/lists/oss-security/2016/05/27/7 https://access.redhat.com/security/cve/CVE-2016-5108

1 0

[arch-security] [ASA-201606-20] chromium: arbitrary code execution
by Remi Gacogne 25 Jun '16

25 Jun '16

Arch Linux Security Advisory ASA-201606-20 ========================================== Severity: Critical Date : 2016-06-25 CVE-ID : CVE-2016-1704 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 51.0.2704.103-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 51.0.2704.103-1. # pacman -Syu "chromium>=51.0.2704.103-1" The problem has been fixed upstream in version 51.0.2704.103. Workaround ========== None. Description =========== Various fixes from internal audits, fuzzing and other initiatives, including multiple issues in the processing of malformed web content. Impact ====== A remote attacker might be able to cause a denial of service, access sensitive information or execute arbitrary code on the affected host via a specially crafted web page. References ========== https://googlechromereleases.blogspot.fr/2016/06/stable-channel-update_16.h… https://access.redhat.com/security/cve/CVE-2016-1704

1 0

[arch-security] [ASA-201606-19] wget: arbitrary file overwrite
by Levente Polyak 20 Jun '16

20 Jun '16

Arch Linux Security Advisory ASA-201606-19 ========================================== Severity: High Date : 2016-06-20 CVE-ID : CVE-2016-4971 Package : wget Type : arbitrary file overwrite Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wget before version 1.18-1 is vulnerable to arbitrary file overwrite that could lead to potential code execution. Resolution ========== Upgrade to 1.18-1. # pacman -Syu "wget>=1.18-1" The problem has been fixed upstream in version 1.18. Workaround ========== None. Description =========== GNU Wget when supplied with a malicious website link can be tricked into saving an arbitrary remote file supplied by an attacker, with arbitrary content and filename under the current directory. This can lead to potential code execution by creating system scripts (such as .bash_profile and others) within home directory as well as other unauthorized actions (such as request sniffing by proxy modification, or arbitrary system file retrieval) by uploading .wgetrc configuration file. Because of this vulnerability, an attacker is able to overwrite an arbitrary file in the victim's current directory. Impact ====== A remote attacker is able to overwrite an arbitrary file in the victim's current directory that could potentially lead to code execution by creating system scripts that are executed. References ========== https://access.redhat.com/security/cve/CVE-2016-4971 https://lists.gnu.org/archive/html/bug-wget/2016-06/msg00033.html https://bugs.archlinux.org/task/49730

1 0

[arch-security] [ASA-201606-18] lib32-flashplugin: multiple issues
by Levente Polyak 20 Jun '16

20 Jun '16

Arch Linux Security Advisory ASA-201606-18 ========================================== Severity: Critical Date : 2016-06-20 CVE-ID : CVE-2016-4122 CVE-2016-4123 CVE-2016-4124 CVE-2016-4125 CVE-2016-4127 CVE-2016-4128 CVE-2016-4129 CVE-2016-4130 CVE-2016-4131 CVE-2016-4132 CVE-2016-4133 CVE-2016-4134 CVE-2016-4135 CVE-2016-4136 CVE-2016-4137 CVE-2016-4138 CVE-2016-4139 CVE-2016-4140 CVE-2016-4141 CVE-2016-4142 CVE-2016-4143 CVE-2016-4144 CVE-2016-4145 CVE-2016-4146 CVE-2016-4147 CVE-2016-4148 CVE-2016-4149 CVE-2016-4150 CVE-2016-4151 CVE-2016-4152 CVE-2016-4153 CVE-2016-4154 CVE-2016-4155 CVE-2016-4156 CVE-2016-4166 CVE-2016-4171 Package : lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-flashplugin before version 11.2.202.626-1 is vulnerable to multiple issues including same-origin policy bypass and arbitrary code execution. Resolution ========== Upgrade to 11.2.202.626-1. # pacman -Syu "lib32-flashplugin>=11.2.202.626-1" The problems have been fixed upstream in version 11.2.202.626. Workaround ========== None. Description =========== - CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171 (arbitrary code execution) Memory corruptions leading to arbitrary code execution. - CVE-2016-4135, CVE-2016-4136, CVE-2016-4138 (arbitrary code execution) Heap-based buffer overflows leading to arbitrary code execution. - CVE-2016-4139 (information leak) Vulnerability that could be exploited to bypass the same-origin policy and lead to information disclosure. - CVE-2016-4140 (arbitrary code execution) Vulnerability in the directory search path used to find resources that could lead to code execution. - CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148 (arbitrary code execution) Use-after-free vulnerabilities leading to arbitrary code execution. - CVE-2016-4144, CVE-2016-4149 (arbitrary code execution) Type confusion vulnerabilities leading to arbitrary code execution. Impact ====== A remote attacker can bypass the same-origin policy to access sensitive information, or execute arbitrary code by using a crafted flash application. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-18.html https://access.redhat.com/security/cve/CVE-2016-4122 https://access.redhat.com/security/cve/CVE-2016-4123 https://access.redhat.com/security/cve/CVE-2016-4124 https://access.redhat.com/security/cve/CVE-2016-4125 https://access.redhat.com/security/cve/CVE-2016-4127 https://access.redhat.com/security/cve/CVE-2016-4128 https://access.redhat.com/security/cve/CVE-2016-4129 https://access.redhat.com/security/cve/CVE-2016-4130 https://access.redhat.com/security/cve/CVE-2016-4131 https://access.redhat.com/security/cve/CVE-2016-4132 https://access.redhat.com/security/cve/CVE-2016-4133 https://access.redhat.com/security/cve/CVE-2016-4134 https://access.redhat.com/security/cve/CVE-2016-4135 https://access.redhat.com/security/cve/CVE-2016-4136 https://access.redhat.com/security/cve/CVE-2016-4137 https://access.redhat.com/security/cve/CVE-2016-4138 https://access.redhat.com/security/cve/CVE-2016-4139 https://access.redhat.com/security/cve/CVE-2016-4140 https://access.redhat.com/security/cve/CVE-2016-4141 https://access.redhat.com/security/cve/CVE-2016-4142 https://access.redhat.com/security/cve/CVE-2016-4143 https://access.redhat.com/security/cve/CVE-2016-4144 https://access.redhat.com/security/cve/CVE-2016-4145 https://access.redhat.com/security/cve/CVE-2016-4146 https://access.redhat.com/security/cve/CVE-2016-4147 https://access.redhat.com/security/cve/CVE-2016-4148 https://access.redhat.com/security/cve/CVE-2016-4149 https://access.redhat.com/security/cve/CVE-2016-4150 https://access.redhat.com/security/cve/CVE-2016-4151 https://access.redhat.com/security/cve/CVE-2016-4152 https://access.redhat.com/security/cve/CVE-2016-4153 https://access.redhat.com/security/cve/CVE-2016-4154 https://access.redhat.com/security/cve/CVE-2016-4155 https://access.redhat.com/security/cve/CVE-2016-4156 https://access.redhat.com/security/cve/CVE-2016-4166 https://access.redhat.com/security/cve/CVE-2016-4171

1 0

[arch-security] [ASA-201606-17] lib32-glibc: denial of service
by Levente Polyak 19 Jun '16

19 Jun '16

Arch Linux Security Advisory ASA-201606-17 ========================================== Severity: Medium Date : 2016-06-19 CVE-ID : CVE-2016-4429 Package : lib32-glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-glibc before version 2.23-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.23-5. # pacman -Syu "lib32-glibc>=2.23-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== clntudp_call allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack (frame) overflow (denial of service). The size of the allocated buffer depends on the request size. If the request size is close to the page size or even larger, this could cause the stack pointer to step over the guard page, leading to additional impact beyond denial of service. Impact ====== A remote attacker is able to send specially crafted ICMP and UDP packets that are leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-4429 https://sourceware.org/bugzilla/show_bug.cgi?id=20112

1 0

[arch-security] [ASA-201606-16] glibc: denial of service
by Levente Polyak 19 Jun '16

19 Jun '16

Arch Linux Security Advisory ASA-201606-16 ========================================== Severity: Medium Date : 2016-06-19 CVE-ID : CVE-2016-4429 Package : glibc Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.23-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.23-5. # pacman -Syu "glibc>=2.23-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== clntudp_call allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack (frame) overflow (denial of service). The size of the allocated buffer depends on the request size. If the request size is close to the page size or even larger, this could cause the stack pointer to step over the guard page, leading to additional impact beyond denial of service. Impact ====== A remote attacker is able to send specially crafted ICMP and UDP packets that are leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2016-4429 https://sourceware.org/bugzilla/show_bug.cgi?id=20112

1 0

[arch-security] [ASA-201606-15] flashplugin: multiple issues
by Remi Gacogne 19 Jun '16

19 Jun '16

Arch Linux Security Advisory ASA-201606-15 ========================================== Severity: Critical Date : 2016-06-19 CVE-ID : CVE-2016-4122 CVE-2016-4123 CVE-2016-4124 CVE-2016-4125 CVE-2016-4127 CVE-2016-4128 CVE-2016-4129 CVE-2016-4130 CVE-2016-4131 CVE-2016-4132 CVE-2016-4133 CVE-2016-4134 CVE-2016-4135 CVE-2016-4136 CVE-2016-4137 CVE-2016-4138 CVE-2016-4139 CVE-2016-4140 CVE-2016-4141 CVE-2016-4142 CVE-2016-4143 CVE-2016-4144 CVE-2016-4145 CVE-2016-4146 CVE-2016-4147 CVE-2016-4148 CVE-2016-4149 CVE-2016-4150 CVE-2016-4151 CVE-2016-4152 CVE-2016-4153 CVE-2016-4154 CVE-2016-4155 CVE-2016-4156 CVE-2016-4166 CVE-2016-4171 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.626-1 is vulnerable to multiple issues including same-origin policy bypass and arbitrary code execution. Resolution ========== Upgrade to 11.2.202.626-1. # pacman -Syu "flashplugin>=11.2.202.626-1" The problems have been fixed upstream in version 11.2.202.626. Workaround ========== None. Description =========== - CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154, CVE-2016-4155, CVE-2016-4156, CVE-2016-4166, CVE-2016-4171 (arbitrary code execution) Memory corruptions leading to arbitrary code execution. - CVE-2016-4135, CVE-2016-4136, CVE-2016-4138 (arbitrary code execution) Heap-based buffer overflows leading to arbitrary code execution. - CVE-2016-4139 (information leak) Vulnerability that could be exploited to bypass the same-origin policy and lead to information disclosure. - CVE-2016-4140 (arbitrary code execution) Vulnerability in the directory search path used to find resources that could lead to code execution. - CVE-2016-4142, CVE-2016-4143, CVE-2016-4145, CVE-2016-4146, CVE-2016-4147, CVE-2016-4148 (arbitrary code execution) Use-after-free vulnerabilities leading to arbitrary code execution. - CVE-2016-4144, CVE-2016-4149 (arbitrary code execution) Type confusion vulnerabilities leading to arbitrary code execution. Impact ====== A remote attacker can bypass the same-origin policy to access sensitive information, or execute arbitrary code by using a crafted flash application. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-18.html https://access.redhat.com/security/cve/CVE-2016-4122 https://access.redhat.com/security/cve/CVE-2016-4123 https://access.redhat.com/security/cve/CVE-2016-4124 https://access.redhat.com/security/cve/CVE-2016-4125 https://access.redhat.com/security/cve/CVE-2016-4127 https://access.redhat.com/security/cve/CVE-2016-4128 https://access.redhat.com/security/cve/CVE-2016-4129 https://access.redhat.com/security/cve/CVE-2016-4130 https://access.redhat.com/security/cve/CVE-2016-4131 https://access.redhat.com/security/cve/CVE-2016-4132 https://access.redhat.com/security/cve/CVE-2016-4133 https://access.redhat.com/security/cve/CVE-2016-4134 https://access.redhat.com/security/cve/CVE-2016-4135 https://access.redhat.com/security/cve/CVE-2016-4136 https://access.redhat.com/security/cve/CVE-2016-4137 https://access.redhat.com/security/cve/CVE-2016-4138 https://access.redhat.com/security/cve/CVE-2016-4139 https://access.redhat.com/security/cve/CVE-2016-4140 https://access.redhat.com/security/cve/CVE-2016-4141 https://access.redhat.com/security/cve/CVE-2016-4142 https://access.redhat.com/security/cve/CVE-2016-4143 https://access.redhat.com/security/cve/CVE-2016-4144 https://access.redhat.com/security/cve/CVE-2016-4145 https://access.redhat.com/security/cve/CVE-2016-4146 https://access.redhat.com/security/cve/CVE-2016-4147 https://access.redhat.com/security/cve/CVE-2016-4148 https://access.redhat.com/security/cve/CVE-2016-4149 https://access.redhat.com/security/cve/CVE-2016-4150 https://access.redhat.com/security/cve/CVE-2016-4151 https://access.redhat.com/security/cve/CVE-2016-4152 https://access.redhat.com/security/cve/CVE-2016-4153 https://access.redhat.com/security/cve/CVE-2016-4154 https://access.redhat.com/security/cve/CVE-2016-4155 https://access.redhat.com/security/cve/CVE-2016-4156 https://access.redhat.com/security/cve/CVE-2016-4166 https://access.redhat.com/security/cve/CVE-2016-4171

1 0

[arch-security] [ASA-201606-14] lib32-expat: multiple issues
by Levente Polyak 12 Jun '16

12 Jun '16

Arch Linux Security Advisory ASA-201606-14 ========================================== Severity: Medium Date : 2016-06-13 CVE-ID : CVE-2012-6702 CVE-2016-5300 Package : lib32-expat Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-expat before version 2.1.1-3 is vulnerable to multiple issues including predictable random numbers and insufficient hash entropy leading to denial of service. Resolution ========== Upgrade to 2.1.1-3. # pacman -Syu "lib32-expat>=2.1.1-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2012-6702 (predictable random numbers) It was found that when calling XML_Parse ahead of rand(), it causes the pseudo random generator to generate non-random predictable numbers. - CVE-2016-5300 (denial of service) It was found that original fix for CVE-2012-0876 used too little entropy for the hash initialization. This issue can be used to perform a hash collision based denial of service attack. Impact ====== A remote attacker is able to predict random numbers from the PRNG or perform a hash based collision attack resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2012-6702 https://access.redhat.com/security/cve/CVE-2016-5300

1 0

[arch-security] [ASA-201606-13] expat: multiple issues
by Levente Polyak 12 Jun '16

12 Jun '16

Arch Linux Security Advisory ASA-201606-13 ========================================== Severity: Medium Date : 2016-06-13 CVE-ID : CVE-2012-6702 CVE-2016-5300 Package : expat Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package expat before version 2.1.1-3 is vulnerable to multiple issues including predictable random numbers and insufficient hash entropy leading to denial of service. Resolution ========== Upgrade to 2.1.1-3. # pacman -Syu "expat>=2.1.1-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2012-6702 (predictable random numbers) It was found that when calling XML_Parse ahead of rand(), it causes the pseudo random generator to generate non-random predictable numbers. - CVE-2016-5300 (denial of service) It was found that original fix for CVE-2012-0876 used too little entropy for the hash initialization. This issue can be used to perform a hash collision based denial of service attack. Impact ====== A remote attacker is able to predict random numbers from the PRNG or perform a hash based collision attack resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2012-6702 https://access.redhat.com/security/cve/CVE-2016-5300

1 0