- Arch-security - lists.archlinux.org

[arch-security] [ASA-201603-22] botan: multiple issues
by Remi Gacogne 24 Mar '16

24 Mar '16

Arch Linux Security Advisory ASA-201603-22 ========================================== Severity: High Date : 2016-03-24 CVE-ID : CVE-2016-2849 CVE-2016-2850 Package : botan Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package botan before version 1.11.29-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 1.11.29-1. # pacman -Syu "botan>=1.11.29-1" The problem has been fixed upstream in version 1.11.29. Workaround ========== None. Description =========== - CVE-2016-2849 (ECDSA side channel): ECDSA (and DSA) signature algorithms perform a modular inverse on the signature nonce k. The modular inverse algorithm used had input dependent loops, and it is possible a side channel attack could recover sufficient information about the nonce to eventually recover the ECDSA secret key. Found by Sean Devlin. - CVE-2016-2850 (Failure to enforce TLS policy): TLS v1.2 allows negotiating which signature algorithms and hash functions each side is willing to accept. However received signatures were not actually checked against the specified policy. This had the effect of allowing a server to use an MD5 or SHA-1 signature, even though the default policy prohibits it. The same issue affected client cert authentication. The TLS client also failed to verify that the ECC curve the server chose to use was one which was acceptable by the client policy. Impact ====== A remote attacker might be able to recover an ECDSA secret key by using a side channel attack. A remote attacker can downgrade the TLS signatures and hash functions to vulnerable algorithms like MD5 or SHA-1 even if they are explicitely prohibited. References ========== http://botan.randombit.net/security.html#id1 https://access.redhat.com/security/cve/CVE-2016-2849 https://access.redhat.com/security/cve/CVE-2016-2850

1 0

[arch-security] [ASA-201603-21] thunderbird: multiple issues
by Remi Gacogne 20 Mar '16

20 Mar '16

Arch Linux Security Advisory ASA-201603-21 ========================================== Severity: Critical Date : 2016-03-20 CVE-ID : CVE-2016-1952 CVE-2016-1953 CVE-2016-1954 CVE-2016-1957 CVE-2016-1960 CVE-2016-1961 CVE-2016-1964 CVE-2016-1966 CVE-2016-1974 CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 38.7.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 38.7.0-1. # pacman -Syu "thunderbird>=38.7.0-1" The problem has been fixed upstream in version 38.7.0. Workaround ========== None. Description =========== - CVE-2016-1952 CVE-2016-1953 (arbitrary code execution): Mozilla developers fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2016-1954 (privilege escalation): Security researcher Nicolas Golubovic reported that a malicious page can overwrite files on the user's machine using Content Security Policy (CSP) violation reports. The file contents are restricted to the JSON format of the report. In many cases overwriting a local file may simply be destructive, breaking the functionality of that file. The CSP error reports can include HTML fragments which could be rendered by browsers. If a user has disabled add-on signing and has installed an "unpacked" add-on, a malicious page could overwrite one of the add-on resources. Depending on how this resource is used, this could lead to privilege escalation. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1957 (resource consumption): Security researchers Jose Martinez and Romina Santillan reported a memory leak in the libstagefright library when array destruction occurs during MPEG4 video file processing. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1960 (arbitrary code execution): Security researcher ca0nguyen, working with HP's Zero Day Initiative, reported a use-after-free issue in the HTML5 string parser when parsing a particular set of table-related tags in a foreign fragment context such as SVG. This results in a potentially exploitable crash. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1961 (arbitrary code execution): Security researcher lokihardt, working with HP's Zero Day Initiative, reported a use-after-free issue in the SetBody function of HTMLDocument. This results in a potentially exploitable crash. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1964 (arbitrary code execution): Security researcher Nicolas Grégoire used the Address Sanitizer to find a use-after-free during XML transformation operations. This results in a potentially exploitable crash triggerable by web content. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1966 (remote code execution): The Communications Electronics Security Group (UK) of the GCHQ reported a dangling pointer dereference within the Netscape Plugin Application Programming Interface (NPAPI) that could lead to the NPAPI subsystem crashing. This issue requires a maliciously crafted NPAPI plugin in concert with scripted web content, resulting in a potentially exploitable crash when triggered. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1974 (denial of service): Security researcher Ronald Crane reported an out-of-bounds read following a failed allocation in the HTML parser while working with unicode strings. This can also affect the parsing of XML and SVG format data. This leads to a potentially exploitable crash. In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1977 CVE-2016-2790 CVE-2016-2791 CVE-2016-2792 CVE-2016-2793 CVE-2016-2794 CVE-2016-2795 CVE-2016-2796 CVE-2016-2797 CVE-2016-2798 CVE-2016-2799 CVE-2016-2800 CVE-2016-2801 CVE-2016-2802 (buffer overflow): Security researcher Holger Fuhrmannek and Mozilla security engineer Tyson Smith reported a number of security vulnerabilities in the Graphite 2 library affecting version 1.3.5. The issue reported by Holger Fuhrmannek is a mechanism to induce stack corruption with a malicious graphite font. This leads to a potentially exploitable crash when the font is loaded. Tyson Smith used the Address Sanitizer tool in concert with a custom software fuzzer to find a series of uninitialized memory, out-of-bounds read, and out-of-bounds write errors when working with fuzzed graphite fonts. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://www.mozilla.org/en-US/security/advisories/mfsa2016-16/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-17/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-20/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-23/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-24/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-27/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-31/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-34/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-37/ https://access.redhat.com/security/cve/CVE-2016-1952 https://access.redhat.com/security/cve/CVE-2016-1953 https://access.redhat.com/security/cve/CVE-2016-1954 https://access.redhat.com/security/cve/CVE-2016-1957 https://access.redhat.com/security/cve/CVE-2016-1960 https://access.redhat.com/security/cve/CVE-2016-1961 https://access.redhat.com/security/cve/CVE-2016-1964 https://access.redhat.com/security/cve/CVE-2016-1966 https://access.redhat.com/security/cve/CVE-2016-1974 https://access.redhat.com/security/cve/CVE-2016-1977 https://access.redhat.com/security/cve/CVE-2016-2790 https://access.redhat.com/security/cve/CVE-2016-2791 https://access.redhat.com/security/cve/CVE-2016-2792 https://access.redhat.com/security/cve/CVE-2016-2793 https://access.redhat.com/security/cve/CVE-2016-2794 https://access.redhat.com/security/cve/CVE-2016-2795 https://access.redhat.com/security/cve/CVE-2016-2796 https://access.redhat.com/security/cve/CVE-2016-2797 https://access.redhat.com/security/cve/CVE-2016-2798 https://access.redhat.com/security/cve/CVE-2016-2799 https://access.redhat.com/security/cve/CVE-2016-2800 https://access.redhat.com/security/cve/CVE-2016-2801 https://access.redhat.com/security/cve/CVE-2016-2802

1 0

[arch-security] [ASA-201603-20] git: remote code execution
by Remi Gacogne 20 Mar '16

20 Mar '16

Arch Linux Security Advisory ASA-201603-20 ========================================== Severity: Critical Date : 2016-03-20 CVE-ID : CVE-2016-2324 Package : git Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package git before version 2.7.4-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 2.7.4-1. # pacman -Syu "git>=2.7.4-1" The problem has been fixed upstream in versions 2.4.11, 2.5.5, 2.6.6 and 2.7.4. Workaround ========== None. Description =========== Laël Cellier discovered an integer overflow vulnerability in the path_name() function of git. Impact ====== A remote attacker can execute arbitrary code by crafting a malicious repository and either directly cloning it or getting a local user to clone it. References ========== http://seclists.org/oss-sec/2016/q1/653 https://access.redhat.com/security/cve/CVE-2016-2324

1 0

[arch-security] [ASA-201603-19] dropbear: command injection
by Levente Polyak 14 Mar '16

14 Mar '16

Arch Linux Security Advisory ASA-201603-19 ========================================== Severity: Medium Date : 2016-03-14 CVE-ID : CVE-2016-3116 Package : dropbear Type : command injection Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package dropbear before version 2016.72-1 is vulnerable to command injection leading to information disclosure, directory traversal and possibly other impact. Resolution ========== Upgrade to 2016.72-1. # pacman -Syu "dropbear>=2016.72-1" The problem has been fixed upstream in version 2016.72. Workaround ========== Set X11Forwarding=no in sshd_config. This is the default. For authorized_keys that specify a "command" restriction, also set the "restrict" or "no-x11-forwarding" restrictions. Description =========== A vulnerability was found in a way dropbear processed X11 forwarding input. By using a specially crafted request, an attacker could bypass the authorized_keys command restrictions. xauth is run under the user's privilege, so this vulnerability offers no additional access to unrestricted accounts, but could circumvent key or account restrictions such as sshd_config ForceCommand, authorized_keys command="..." or restricted shells. Impact ====== A remote authenticated user who is able to request X11 forwarding can inject commands leading to information disclosure, directory traversal and possibly other impact. References ========== https://matt.ucc.asn.au/dropbear/CHANGES https://access.redhat.com/security/cve/CVE-2016-3116

1 0

[arch-security] [ASA-201603-18] pcre: arbitrary code execution
by Levente Polyak 13 Mar '16

13 Mar '16

Arch Linux Security Advisory ASA-201603-18 ========================================== Severity: High Date : 2016-03-13 CVE-ID : CVE-2016-1283 Package : pcre Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pcre before version 8.38-3 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.38-3. # pacman -Syu "pcre>=8.38-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== PCRE library is prone to a vulnerability which leads to Heap Overflow. During the compilation of a malformed regular expression, more data is written on the malloced block than the expected size output by compile_regex. Exploits with advanced Heap Fengshui techniques may allow an attacker to execute arbitrary code in the context of the user running the affected application. Impact ====== A remote attacker is able to execute arbitrary code by crafting a special regular expression that triggers a heap buffer overflow. References ========== https://access.redhat.com/security/cve/CVE-2016-1283 https://bugs.exim.org/show_bug.cgi?id=1767 https://bugs.archlinux.org/48484

1 0

[arch-security] [ASA-201603-17] wireshark-gtk: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-17 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-gtk Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-gtk before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-gtk>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-16] wireshark-qt: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-16 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-qt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-qt before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-qt>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-15] wireshark-cli: denial of service
by Remi Gacogne 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-15 ========================================== Severity: Medium Date : 2016-03-12 CVE-ID : CVE-2016-2522 CVE-2016-2523 CVE-2016-2524 CVE-2016-2525 CVE-2016-2526 CVE-2016-2527 CVE-2016-2528 CVE-2016-2529 CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wireshark-cli before version 2.0.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.2-1. # pacman -Syu "wireshark-cli>=2.0.2-1" The problem has been fixed upstream in version 2.0.2. Workaround ========== None. Description =========== - CVE-2016-2522: The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2523: The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. - CVE-2016-2524: epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. - CVE-2016-2525: epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. - CVE-2016-2526: epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet. - CVE-2016-2527: wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file. - CVE-2016-2528: The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet. - CVE-2016-2529: The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file. - CVE-2016-2530: The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531. - CVe-2016-2531: Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530. - CVE-2016-2532: The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet. Impact ====== A remote attacker can crash Wireshark by injecting a malformed packet onto the wire or by convincing a vulnerable user to read a malformed packet trace file. References ========== https://bugs.archlinux.org/task/48536 https://www.wireshark.org/security/wnpa-sec-2016-02.html https://www.wireshark.org/security/wnpa-sec-2016-03.html https://www.wireshark.org/security/wnpa-sec-2016-04.html https://www.wireshark.org/security/wnpa-sec-2016-05.html https://www.wireshark.org/security/wnpa-sec-2016-06.html https://www.wireshark.org/security/wnpa-sec-2016-07.html https://www.wireshark.org/security/wnpa-sec-2016-08.html https://www.wireshark.org/security/wnpa-sec-2016-09.html https://www.wireshark.org/security/wnpa-sec-2016-10.html https://www.wireshark.org/security/wnpa-sec-2016-11.html https://www.wireshark.org/security/wnpa-sec-2016-12.html https://www.wireshark.org/security/wnpa-sec-2016-13.html https://www.wireshark.org/security/wnpa-sec-2016-14.html https://www.wireshark.org/security/wnpa-sec-2016-15.html https://www.wireshark.org/security/wnpa-sec-2016-16.html https://www.wireshark.org/security/wnpa-sec-2016-17.html https://www.wireshark.org/security/wnpa-sec-2016-18.html https://access.redhat.com/security/cve/CVE-2016-2522 https://access.redhat.com/security/cve/CVE-2016-2523 https://access.redhat.com/security/cve/CVE-2016-2524 https://access.redhat.com/security/cve/CVE-2016-2525 https://access.redhat.com/security/cve/CVE-2016-2526 https://access.redhat.com/security/cve/CVE-2016-2527 https://access.redhat.com/security/cve/CVE-2016-2528 https://access.redhat.com/security/cve/CVE-2016-2529 https://access.redhat.com/security/cve/CVE-2016-2530 https://access.redhat.com/security/cve/CVE-2016-2531 https://access.redhat.com/security/cve/CVE-2016-2532

1 0

[arch-security] [ASA-201603-14] pidgin-otr: arbitrary code execution
by Levente Polyak 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-14 ========================================== Severity: High Date : 2016-03-12 CVE-ID : CVE-2015-8833 Package : pidgin-otr Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pidgin-otr before version 4.0.2-1 is vulnerable to use-after-free leading to denial of service or possible arbitrary code execution. Resolution ========== Upgrade to 4.0.2-1. # pacman -Syu "pidgin-otr>=4.0.2-1" The problem has been fixed upstream in version 4.0.2. Workaround ========== None. Description =========== The pidgin-otr plugin fixes a heap use after free error. The bug is triggered when a user tries to authenticate a buddy and happens in the function create_smp_dialog. This issue is leading to denial of service or possibly remote code execution. Impact ====== A remote attacker is able to trigger a user-after-free during otr authentication and possibly execute arbitrary code References ========== https://access.redhat.com/security/cve/CVE-2015-8833 http://seclists.org/oss-sec/2016/q1/572 https://bugs.otr.im/issues/88 https://bugs.archlinux.org/task/48537

1 0

[arch-security] [ASA-201603-13] bind: denial of service
by Christian Rebischke 12 Mar '16

12 Mar '16

Arch Linux Security Advisory ASA-201603-13 ========================================== Severity: Low Date : 2016-03-12 CVE-ID : CVE-2016-2088 CVE-2016-1286 CVE-2016-1285 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.3.P4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.3.P4-1 . # pacman -Syu "bind>=9.10.3.P4-1" The problem has been fixed upstream in version 9.10.3-P4. Workaround ========== None. Description =========== - CVE-2016-2088 (denial of service) Allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a malformed packet with more than one cookie option. - CVE-2016-1286 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c. - CVE-2016-1285 (denial of service) Allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c Impact ====== A remote attacker is able to crash the application. References ========== https://access.redhat.com/security/cve/CVE-2016-2088 https://access.redhat.com/security/cve/CVE-2016-1286 https://access.redhat.com/security/cve/CVE-2016-1285 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-2088 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1286 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1285

1 0