- Arch-security - lists.archlinux.org

[arch-security] [ASA-201602-16] thunderbird: multiple issues
by Remi Gacogne 21 Feb '16

21 Feb '16

Arch Linux Security Advisory ASA-201602-16 ========================================== Severity: Critical Date : 2016-02-21 CVE-ID : CVE-2015-7575 CVE-2016-1523 CVE-2016-1930 CVE-2016-1931 CVE-2016-1935 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 38.6.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 38.6.0-1. # pacman -Syu "thunderbird>=38.6.0-1" The problem has been fixed upstream in version 38.6.0. Workaround ========== None. Description =========== - CVE-2015-7575 (man-in-the-middle): Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services (NSS) where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the accepting MD5 as a hash algorithm in signatures since 2011. This issues exposes NSS based clients such as Firefox to theoretical collision-based forgery attacks. This issue was fixed in NSS version 3.20.2. - CVE-2016-1523 (remote code execution): Security researcher Holger Fuhrmannek reported that a malicious Graphite "smart font" could circumvent the validation of internal instruction parameters in the Graphite 2 library using special CNTXT_ITEM instructions. This could result in arbitrary code execution. In general this flaw cannot be exploited through email in the Thunderbird product, but is potentially a risk in browser or browser-like contexts. - CVE-2016-1930 (remote code execution): Bob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman, Carsten Book, and Randell Jesup reported memory safety problems and crashes. In general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled, but are potentially a risk in browser or browser-like contexts. - CVE-2016-1931 (remote code execution): Bob Clary, Carsten Book, Christian Holler, Nicolas Pierron, Eric Rescorla, Tyson Smith, Gabor Krizsanits, and Randell Jesup reported memory safety problems and crashes. In general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled, but are potentially a risk in browser or browser-like contexts. - CVE-2016-1935 (remote code execution): Security researcher Aki Helin used the Address Sanitizer tool to find a buffer overflow write when rendering some WebGL content. This leads to a potentially exploitable crash. In general this flaw cannot be exploited through email in the Thunderbird product, but is potentially a risk in browser or browser-like contexts. Impact ====== A remote attacker might be able to access sensitive information by performing a man-in-the-middle attack, or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://www.mozilla.org/en-US/security/advisories/mfsa2015-150/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-03/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-14/ https://access.redhat.com/security/cve/CVE-2015-7575 https://access.redhat.com/security/cve/CVE-2016-1523 https://access.redhat.com/security/cve/CVE-2016-1930 https://access.redhat.com/security/cve/CVE-2016-1931 https://access.redhat.com/security/cve/CVE-2016-1935

1 0

[arch-security] [Announcement] Discussion about restricting arch-security for public participation
by Levente Polyak 18 Feb '16

18 Feb '16

Dear arch-security subscribers, Dear arch-general subscribers, the policy of the arch-security mailinglist is currently changed to a restricted advisory announcements only list due to certain reason roughly explained on the arch-devops [0] and arch-dev-public [1] lists. As there was no announcement and discussion about this change yet, we want to invite you to discuss the restriction of the arch-security mailinglist on the CC-ed arch-general list. After making sure you are subscribed to arch-general [2], you can simply reply to this announcement by posting directly to the arch-general mailinglist. Our main goal behind this change is to separate relevant official announcements and advisories from possibly long and frequent discussions. The security teams idea is that each announcement to the arch-security list should be considered as an urgent alert and reviewed as soon as possible, without the need to filter them from general conversations and exchange of "unverified" information. sincerely, Levente (anthraxx) [0] https://lists.archlinux.org/pipermail/arch-devops/2016-January/000007.html [1] https://lists.archlinux.org/pipermail/arch-dev-public/2015-December/027581.… [2] https://lists.archlinux.org/listinfo/arch-general

1 1

[arch-security] [ASA-201602-15] lib32-glibc: multiple issues
by Levente Polyak 17 Feb '16

17 Feb '16

Arch Linux Security Advisory ASA-201602-15 ========================================== Severity: Critical Date : 2016-02-17 CVE-ID : CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Package : lib32-glibc Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-glibc before version 2.22-4 is vulnerable to multiple issues including but not limited to arbitrary code execution, information disclosure and denial of service. It is advised to restart all services that may perform DNS lookups. Resolution ========== Upgrade to 2.22-4. # pacman -Syu "lib32-glibc>=2.22-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-7547 (arbitrary code execution) A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the library. Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module. - CVE-2015-8776 (information disclosure) It was found that out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information. - CVE-2015-8777 (restriction bypass) LD_POINTER_GUARD was an environment variable which controls security-related behavior, but was not ignored for privileged binaries (in AT_SECURE mode). This might allow local attackers (who can supply the environment variable) to bypass intended security restrictions. - CVE-2015-8778 (arbitrary code execution) An integer overflow in hcreate and hcreate_r which can result in an out-of-bound memory access. This could lead to application crashes or, potentially, arbitrary code execution. - CVE-2015-8779 (arbitrary code execution) A stack overflow (unbounded alloca) in the catopen function can cause applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. Impact ====== A remote attacker is able to execute arbitrary code, potentially disclosure sensitive information or perform a denial of service attack via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-7547 https://access.redhat.com/security/cve/CVE-2015-8776 https://access.redhat.com/security/cve/CVE-2015-8777 https://access.redhat.com/security/cve/CVE-2015-8778 https://access.redhat.com/security/cve/CVE-2015-8779 http://seclists.org/oss-sec/2016/q1/153

1 0

[arch-security] [ASA-201602-14] glibc: multiple issues
by Levente Polyak 17 Feb '16

17 Feb '16

Arch Linux Security Advisory ASA-201602-14 ========================================== Severity: Critical Date : 2016-02-17 CVE-ID : CVE-2015-7547 CVE-2015-8776 CVE-2015-8777 CVE-2015-8778 CVE-2015-8779 Package : glibc Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package glibc before version 2.22-4 is vulnerable to multiple issues including but not limited to arbitrary code execution, information disclosure and denial of service. It is advised to restart all services that may perform DNS lookups. Resolution ========== Upgrade to 2.22-4. # pacman -Syu "glibc>=2.22-4" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-7547 (arbitrary code execution) A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the library. Note: this issue is only exposed when libresolv is called from the nss_dns NSS service module. - CVE-2015-8776 (information disclosure) It was found that out-of-range time values passed to the strftime function may cause it to crash, leading to a denial of service, or potentially disclosure information. - CVE-2015-8777 (restriction bypass) LD_POINTER_GUARD was an environment variable which controls security-related behavior, but was not ignored for privileged binaries (in AT_SECURE mode). This might allow local attackers (who can supply the environment variable) to bypass intended security restrictions. - CVE-2015-8778 (arbitrary code execution) An integer overflow in hcreate and hcreate_r which can result in an out-of-bound memory access. This could lead to application crashes or, potentially, arbitrary code execution. - CVE-2015-8779 (arbitrary code execution) A stack overflow (unbounded alloca) in the catopen function can cause applications which pass long strings to the catopen function to crash or, potentially execute arbitrary code. Impact ====== A remote attacker is able to execute arbitrary code, potentially disclosure sensitive information or perform a denial of service attack via multiple vectors. References ========== https://access.redhat.com/security/cve/CVE-2015-7547 https://access.redhat.com/security/cve/CVE-2015-8776 https://access.redhat.com/security/cve/CVE-2015-8777 https://access.redhat.com/security/cve/CVE-2015-8778 https://access.redhat.com/security/cve/CVE-2015-8779 http://seclists.org/oss-sec/2016/q1/153

1 0

[arch-security] [ASA-201602-13] nghttp2: denial of service
by Remi Gacogne 13 Feb '16

13 Feb '16

Arch Linux Security Advisory ASA-201602-13 ========================================== Severity: Low Date : 2016-02-13 CVE-ID : CVE-2016-1544 Package : nghttp2 Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nghttp2 before version 1.7.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.7.1-1. # pacman -Syu "nghttp2>=1.7.1-1" The problem has been fixed upstream in version 1.7.1. Workaround ========== None. Description =========== HTTP/2 uses HPACK to compress header fields. The basic idea is that HTTP header field is stored in the receiver with the numeric index number. The memory used by this storage is tightly constrained, and it is 4KiB by default. When sender sends the same header field, it just sends the corresponding numeric index number, which is usually 1 or 2 bytes. This means that after sender makes the receiver store the relatively large header field (e.g., 4KiB), and it can send specially crafted HEADERS/CONTINUATION frames which contain a lot of references to the stored header field, sender easily effectively send lots of big header fields to the receiver quite easily. nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage for received header fields, so if the peer performs the procedure described above, they will crash due to out of memory. Impact ====== A remote attacker can cause an application using nghttp2 to allocate a lot of memory by sending specially crafted HTTP/2 frames, causing a denial of service. References ========== https://nghttp2.org/blog/2016/02/11/nghttp2-v1-7-1/ http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1544

1 0

[arch-security] [ASA-201602-12] firefox: same-origin policy bypass
by Remi Gacogne 13 Feb '16

13 Feb '16

Arch Linux Security Advisory ASA-201602-12 ========================================== Severity: High Date : 2016-02-13 CVE-ID : CVE-2016-1949 Package : firefox Type : same-origin policy bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 44.0.2-1 is vulnerable to same-origin policy bypass. Resolution ========== Upgrade to 44.0.2-1. # pacman -Syu "firefox>=44.0.2-1" The problem has been fixed upstream in version 44.0.2. Workaround ========== None. Description =========== Jason Pang of OneSignal reported that service workers intercept responses to plugin network requests made through the browser. Plugins which make security decisions based on the content of network requests can have these decisions subverted if a service worker forges responses to those requests. For example, a forged crossdomain.xml could allow a malicious site to violate the same-origin policy using the Flash plugin. Impact ====== A remote attacker might be able to bypass the same-origin policy and gain access to sensitive information. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-13/ https://access.redhat.com/security/cve/CVE-2016-1949

1 0

[arch-security] [ASA-201602-11] botan: multiple issues
by Levente Polyak 10 Feb '16

10 Feb '16

Arch Linux Security Advisory ASA-201602-11 ========================================== Severity: Critical Date : 2016-02-10 CVE-ID : CVE-2016-2194 CVE-2016-2195 CVE-2016-2196 Package : botan Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package botan before version 1.11.28-1 is vulnerable to denial of service and arbitrary code execution. Resolution ========== Upgrade to 1.11.28-1. # pacman -Syu "botan>=1.11.28-1" The problems have been fixed upstream in version 1.11.28. Workaround ========== None. Description =========== - CVE-2016-2194 (denial of service) The ressol function implements the Tonelli-Shanks algorithm for finding square roots could be sent into a nearly infinite loop due to a misplaced conditional check. This could occur if a composite modulus is provided, as this algorithm is only defined for primes. This function is exposed to attacker controlled input via the OS2ECP function during ECC point decompression. - CVE-2016-2195 (arbitrary code execution) The PointGFp constructor did not check that the affine coordinate arguments were less than the prime, but then in curve multiplication assumed that both arguments if multiplied would fit into an integer twice the size of the prime. The bigint_mul and bigint_sqr functions received the size of the output buffer, but only used it to dispatch to a faster algorithm in cases where there was sufficient output space to call an unrolled multiplication function. The result is a heap overflow accessible via ECC point decoding, which accepted untrusted inputs. This is likely exploitable for remote code execution. On systems which use the mlock pool allocator, it would allow an attacker to overwrite memory held in secure_vector objects. After this point the write will hit the guard page at the end of the mmap’ed region so it probably could not be used for code execution directly, but would allow overwriting adjacent key material. - CVE-2016-2196 (arbitrary code execution) The P-521 reduction function would overwrite zero to one word following the allocated block. This could potentially result in remote code execution or a crash. Impact ====== A remote attacker is able to create specially crafted input that, when processed, is leading to arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2016-2194 https://access.redhat.com/security/cve/CVE-2016-2195 https://access.redhat.com/security/cve/CVE-2016-2196 https://botan.randombit.net/security.html#id1

1 0

[arch-security] [ASA-201602-10] kscreenlocker: access restriction bypass
by Levente Polyak 10 Feb '16

10 Feb '16

Arch Linux Security Advisory ASA-201602-10 ========================================== Severity: Medium Date : 2016-02-10 CVE-ID : CVE-2016-2312 Package : kscreenlocker Type : access restriction bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package kscreenlocker before version 5.5.4-2 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 5.5.4-2. # pacman -Syu "kscreenlocker>=5.5.4-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A vulnerability has been discovered in kscreenlocker that is leading to access restriction bypass. Turning all screens off while the lock screen is shown can result in the screen being unlocked when turning a screen on again. Impact ====== A local attacker with physical access to the hardware is able to gain unauthorized access to a locked system. References ========== https://www.kde.org/info/security/advisory-20160209-1.txt https://bugs.kde.org/show_bug.cgi?id=358125 https://bugzilla.opensuse.org/show_bug.cgi?id=964548

1 0

[arch-security] [ASA-201602-9] lib32-libsndfile: multiple issues
by Christian Rebischke 06 Feb '16

06 Feb '16

Arch Linux Security Advisory ASA-201602-8 ========================================= Severity: Medium Date : 2016-02-06 CVE-ID : CVE-2014-9496 CVE-2014-9756 CVE-2015-7805 Package : lib32-libsndfile Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-libsndfile before version 1.0.26-1 is vulnerable to multiple issues including denial of service and unspecified impact. Resolution ========== Upgrade to 1.0.26-1. # pacman -Syu "lib32-libsndfile>=1.0.26-1" The problems have been fixed upstream in version 1.0.26. Workaround ========== None. Description =========== - CVE-2014-9496 (unspecified impact) The sd2_parse_rsrc_fork function in sd2.c in lib32-libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read. - CVE-2014-9756 (denial of service) The psf_fwrite function in file_io.c in lib32-libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable. - CVE-2015-7805 (unspecified impact) Heap-based buffer overflow in lib32-libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file. Impact ====== A remote attacker could be able to have unspecified impact on the running application. Furthermore a local attacker is able to crash the running application by causing a divide-by-zero error. References ========== https://access.redhat.com/security/cve/CVE-2014-9496 https://access.redhat.com/security/cve/CVE-2014-9756 https://access.redhat.com/security/cve/CVE-2015-7805

1 0

[arch-security] [ASA-201602-8] libsndfile: multiple issues
by Christian Rebischke 06 Feb '16

06 Feb '16

Arch Linux Security Advisory ASA-201602-8 ========================================= Severity: Medium Date : 2016-02-06 CVE-ID : CVE-2014-9496 CVE-2014-9756 CVE-2015-7805 Package : libsndfile Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libsndfile before version 1.0.26-1 is vulnerable to multiple issues including denial of service and unspecified impact. Resolution ========== Upgrade to 1.0.26-1. # pacman -Syu "libsndfile>=1.0.26-1" The problems have been fixed upstream in version 1.0.26. Workaround ========== None. Description =========== - CVE-2014-9496 (unspecified impact) The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset or (2) rsrc marker, which triggers an out-of-bounds read. - CVE-2014-9756 (denial of service) The psf_fwrite function in file_io.c in libsndfile allows attackers to cause a denial of service (divide-by-zero error and application crash) via unspecified vectors related to the headindex variable. - CVE-2015-7805 (unspecified impact) Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file. Impact ====== A remote attacker could be able to have unspecified impact on the running application. Furthermore a local attacker is able to crash the running application by causing a divide-by-zero error. References ========== https://access.redhat.com/security/cve/CVE-2014-9496 https://access.redhat.com/security/cve/CVE-2014-9756 https://access.redhat.com/security/cve/CVE-2015-7805

1 0