- Arch-security - lists.archlinux.org

[arch-security] [ASA-201601-3] gajim: man-in-the-middle
by Levente Polyak 09 Jan '16

09 Jan '16

Arch Linux Security Advisory ASA-201601-3 ========================================= Severity: Medium Date : 2016-01-09 CVE-ID : CVE-2015-8688 Package : gajim Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package gajim before version 0.16.5-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 0.16.5-1. # pacman -Syu "gajim>=0.16.5-1" The problem has been fixed upstream in version 0.16.5. Workaround ========== None. Description =========== It was found that gajim doesn't verify the origin of roster pushes thus allowing third parties to modify the roster. This vulnerability allows to intercept messages resulting in man-in-the-middle. Impact ====== A remote attacker is able to intercept messages due to unverified origin of roster resulting in man-in-the-middle. References ========== https://access.redhat.com/security/cve/CVE-2015-8688 http://gultsch.de/gajim_roster_push_and_message_interception.html https://bugs.archlinux.org/task/47647

1 0

[arch-security] [ASA-201601-2] wordpress: cross-side scripting
by Levente Polyak 09 Jan '16

09 Jan '16

Arch Linux Security Advisory ASA-201601-2 ========================================= Severity: Medium Date : 2016-01-09 CVE-ID : CVE-2016-1564 Package : wordpress Type : cross-side scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wordpress before version 4.4.1-1 is vulnerable to cross-side scripting. Resolution ========== Upgrade to 4.4.1-1. # pacman -Syu "wordpress>=4.4.1-1" The problem has been fixed upstream in version 4.4.1. Workaround ========== None. Description =========== A cross-site scripting vulnerability has been discovered that could allow a site to be compromised. Impact ====== A remote attacker is able to inject unescaped HTML and javascript leading to cross-side scripting that could result in a site to be compromised. References ========== https://access.redhat.com/security/cve/CVE-2016-1564 https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance… https://core.trac.wordpress.org/changeset/36185

1 0

[arch-security] [ASA-201601-1] rtmpdump: multiple issues
by Jelle van der Waa 02 Jan '16

02 Jan '16

Arch Linux Security Advisory ASA-201601-1 ========================================= Severity: High Date : 2016-01-02 CVE-ID : Pending Package : rtmpdump Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package rtmpdump before version 1:2.4.r96.fa8646d-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:2.4.r96.fa8646d-1. # pacman -Syu "rtmpdump>=1:2.4.r96.fa8646d-1" The problem has been fixed upstream but no updated version has been released. Workaround ========== None. Description =========== Several issues have been found in the part of rtmpdump handling RTMP streams by LMX of Qihoo 360 Codesafe Team. These issues include memory leak, integer overflow, type confusion when dealing with AMF strings and objects, and several other parsing issues. Impact ====== A remote attacker is able to craft a special rtmp stream that, when processed, can cause arbitrary code execution. References ========== http://article.gmane.org/gmane.comp.security.oss.general/18466 https://bugs.archlinux.org/task/47564

1 0

[arch-security] [ASA-201512-19] openvpn: out-of-bound read
by Remi Gacogne 28 Dec '15

28 Dec '15

Arch Linux Security Advisory ASA-201512-19 ========================================== Severity: Low Date : 2015-12-28 CVE-ID : N/A Package : openvpn Type : out-of-bound error Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openvpn before version 2.3.9-1 is vulnerable to an out-of-bound read. Resolution ========== Upgrade to 2.3.9-1. # pacman -Syu "openvpn>=2.3.9-1" The problem has been fixed upstream in version 2.3.9. Workaround ========== None. Description =========== The code always tried to copy-out a "struct sockaddr_in6" even for IPv4 results, which reads more bytes than getaddrinfo() is guaranteed to allocate. Impact ====== A remote attacker might be able to cause a denial of service (application crash) or access sensitive data. References ========== https://bugs.archlinux.org/task/47498 http://seclists.org/oss-sec/2015/q4/535 https://blog.fuzzing-project.org/32-Out-of-bounds-read-in-OpenVPN.html http://permalink.gmane.org/gmane.network.openvpn.devel/10479

1 0

[arch-security] [ASA-201512-18] libpng: buffer overflow
by Remi Gacogne 28 Dec '15

28 Dec '15

Arch Linux Security Advisory ASA-201512-18 ========================================== Severity: High Date : 2015-12-28 CVE-ID : CVE-2015-8472 Package : libpng Type : buffer overflow Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libpng before version 1.6.20-1 is vulnerable to a buffer overflow vulnerability, incompletely fixed in version 1.6.19. Resolution ========== Upgrade to 1.6.20-1. # pacman -Syu "libpng>=1.6.20-1" The problem has been fixed upstream in version 1.6.20. Workaround ========== None. Description =========== It was discovered that the png_get_PLTE() and png_set_PLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library. This issue is the result of an incomplete fix for CVE-2015-8126 in libpng 1.6.19. Impact ====== A remote attacker might be able to execute arbitrary code on the affected by submitting a crafted PNG file to an application calling directly the png_set_PLTE() with invalid palette sizes. References ========== https://access.redhat.com/security/cve/CVE-2015-8472 http://seclists.org/oss-sec/2015/q4/439

1 0

[arch-security] [ASA-201512-17] flashplugin, lib32-flashplugin: multiple issues
by Remi Gacogne 28 Dec '15

28 Dec '15

Arch Linux Security Advisory ASA-201512-17 ========================================== Severity: Critical Date : 2015-12-28 CVE-ID : CVE-2015-8459 CVE-2015-8460 CVE-2015-8634 CVE-2015-8635 CVE-2015-8636 CVE-2015-8638 CVE-2015-8639 CVE-2015-8640 CVE-2015-8641 CVE-2015-8642 CVE-2015-8643 CVE-2015-8644 CVE-2015-8645 CVE-2015-8646 CVE-2015-8647 CVE-2015-8648 CVE-2015-8649 CVE-2015-8650 CVE-2015-8651 Package : flashplugin, lib32-flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages flashplugin and lib32-flashplugin before version 11.2.202.559-1 are vulnerable to multiple issues, including remote code execution. At least one of these vulnerabilities, CVE-2015-8651, has been reported in use for targeted attacks. Resolution ========== Upgrade to 11.2.202.559-1. # pacman -Syu "flashplugin>=11.2.202.559-1" # pacman -Syu "lib32-flashplugin>=11.2.202.559-1" The problem has been fixed upstream in version 11.2.202.559. Workaround ========== None. Description =========== - CVE-2015-8459: Memory corruption vulnerabilities that could lead to code execution. Credited to Kai Kang of Tencent's Xuanwu LAB. - CVE-2015-8460: Memory corruption vulnerabilities that could lead to code execution. Credited to Jie Zeng of Qihoo 360. - CVE-2015-8634, CVE-2015-8635: Use-after-free vulnerabilities that could lead to code execution. Credited to Ben Hawkes, Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2015-8636: Memory corruption vulnerabilities that could lead to code execution. Credited to Ben Hawkes, Mateusz Jurczyk and Natalie Silvanovich of Google Project Zero. - CVE-2015-8638, CVE-2015-8639: Use-after-free vulnerabilities that could lead to code execution. Credited to Anonymous working with HP's Zero Day Initiative. - CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646: Use-after-free vulnerabilities that could lead to code execution. Credited to Yuki Chen of Qihoo 360 Vulcan Team. - CVE-2015-8644: Type confusion vulnerability that could lead to code execution. Credited to Natalie Silvanovich of Google Project Zero. - CVE-2015-8645: Memory corruption vulnerabilities that could lead to code execution. Credited to Jaehun Jeong (@n3sk) of WINS, WSEC Analysis Team working with Chromium Vulnerability Reward Program. - CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650: Use-after-free vulnerabilities that could lead to code execution. Credited to Anonymous working with HP's Zero Day Initiative. - CVE-2015-8651: Integer overflow vulnerability that could lead to code execution. Credited to Kai Wang and Hunter Gao of Huawei's IT Infrastructure & Security Dept, BPIT&QM. Adobe is aware of a report that an exploit for CVE-2015-8651 is being used in limited, targeted attacks. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb16-01.html https://access.redhat.com/security/cve/CVE-2015-8459 https://access.redhat.com/security/cve/CVE-2015-8460 https://access.redhat.com/security/cve/CVE-2015-8634 https://access.redhat.com/security/cve/CVE-2015-8635 https://access.redhat.com/security/cve/CVE-2015-8636 https://access.redhat.com/security/cve/CVE-2015-8638 https://access.redhat.com/security/cve/CVE-2015-8639 https://access.redhat.com/security/cve/CVE-2015-8640 https://access.redhat.com/security/cve/CVE-2015-8641 https://access.redhat.com/security/cve/CVE-2015-8642 https://access.redhat.com/security/cve/CVE-2015-8643 https://access.redhat.com/security/cve/CVE-2015-8644 https://access.redhat.com/security/cve/CVE-2015-8645 https://access.redhat.com/security/cve/CVE-2015-8646 https://access.redhat.com/security/cve/CVE-2015-8647 https://access.redhat.com/security/cve/CVE-2015-8648 https://access.redhat.com/security/cve/CVE-2015-8649 https://access.redhat.com/security/cve/CVE-2015-8650 https://access.redhat.com/security/cve/CVE-2015-8651

1 0

[arch-security] [ASA-201512-16] nghttp2: use-after-free
by Remi Gacogne 25 Dec '15

25 Dec '15

Arch Linux Security Advisory ASA-201512-16 ========================================== Severity: High Date : 2015-12-25 CVE-ID : CVE-2015-8659 Package : nghttp2 Type : use-after-free Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nghttp2 before version 1.6.0-1 is vulnerable to a heap-based use-after-free, leading to denial of service or possibly arbitrary code execution. Resolution ========== Upgrade to 1.6.0-1. # pacman -Syu "nghttp2>=1.6.0-1" The problem has been fixed upstream in version 1.6.0. Workaround ========== None. Description =========== nghttp2 1.6.0 fixes a heap-based use-after-free bug in idle stream handling code, where an idle/closed stream could possibly be destroyed while it was still referenced. Impact ====== A remote attacker could exploit this bug in a HTTP/2 client or server, leading to denial of service or even arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2015-8659 http://seclists.org/oss-sec/2015/q4/576 https://nghttp2.org/blog/2015/12/23/nghttp2-v1-6-0/ https://github.com/tatsuhiro-t/nghttp2/commit/92a56d034f201cbb609606184822c…

1 0

[arch-security] [ASA-201512-15] mediawiki: multiple issues
by Remi Gacogne 25 Dec '15

25 Dec '15

Arch Linux Security Advisory ASA-201512-15 ========================================== Severity: Medium Date : 2015-12-25 CVE-ID : CVE-2015-8622 CVE-2015-8624 CVE-2015-8625 CVE-2015-8626 CVE-2015-8627 CVE-2015-8628 Package : mediawiki Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mediawiki before version 1.26.2-1 is vulnerable to multiple issues including XSS, timing attack, sensitive information leak, password-policy bypass and IP-blocking bypass. Resolution ========== Upgrade to 1.26.2-1. # pacman -Syu "mediawiki>=1.26.2-1" The problem has been fixed upstream in version 1.26.1. Workaround ========== None. Description =========== - CVE-2015-8622: (T117899) XSS from wikitext when $wgArticlePath='$1'. Internal review discovered an XSS vector when MediaWiki is configured with a non-standard configuration. - CVE-2015-8624: (T119309) User::matchEditToken should use constant-time string comparison. Internal review discovered that tokens were being compared as strings, which could allow a timing attack. - CVE-2015-8625: (T118032) Error thrown by VirtualRESTService when POST variable starts with '@'. Internal review discovered that MediaWiki was not sanitizing parameters passed to the curl library, which could cause curl to upload files from the webserver to an attacker. - CVE-2015-8626: (T115522) Passwords generated by User::randomPassword() may be shorter than $wgMinimalPasswordLength. MediaWiki user Frank R. Farmer reported that the password reset token could be shorter than the minimum required password length. - CVE-2015-8627: (T97897) Incorrect parsing of IPs for global block. Wikimedia steward Vituzzu reported that blocking IP addresses with zero-padded octets resulted in a failure to block the IP address. - CVE-2015-8628: (T109724) A combination of Special:MyPage redirects and pagecounts allows an external site to know the wikipedia login of an user. Wikimedia user Xavier Combelle reported a way to identify user, when detailed page view data is also released. Impact ====== A remote attacker might be able to access sensitive information by tricking the server into uploading file content or by a timing attack. A remote attacker might be able to bypass password policy and IP blocking measures. References ========== http://seclists.org/oss-sec/2015/q4/573 https://phabricator.wikimedia.org/T97897 https://phabricator.wikimedia.org/T109724 https://phabricator.wikimedia.org/T115522 https://phabricator.wikimedia.org/T117899 https://phabricator.wikimedia.org/T118032 https://phabricator.wikimedia.org/T119309 https://access.redhat.com/security/cve/CVE-2015-8622 https://access.redhat.com/security/cve/CVE-2015-8624 https://access.redhat.com/security/cve/CVE-2015-8625 https://access.redhat.com/security/cve/CVE-2015-8626 https://access.redhat.com/security/cve/CVE-2015-8627 https://access.redhat.com/security/cve/CVE-2015-8628

1 0

[arch-security] [ASA-201512-14] thunderbird: multiple issues
by Remi Gacogne 25 Dec '15

25 Dec '15

Arch Linux Security Advisory ASA-201512-14 ========================================== Severity: Critical Date : 2015-12-25 CVE-ID : CVE-2015-7201 CVE-2015-7205 CVE-2015-7212 CVE-2015-7213 CVE-2015-7214 Package : thunderbird Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 38.5.0-1 is vulnerable to multiple issues. Resolution ========== Upgrade to 38.5.0-1. # pacman -Syu "thunderbird>=38.5.0-1" The problem has been fixed upstream in version 38.5.0. Workaround ========== None. Description =========== - CVE-2015-7201 (cross-origin restriction bypass using data: and view-source: uri scheme): Security researcher Tsubasa Iinuma reported a mechanism to violate same-origin policy to content using data: and view-source: URIs to confuse protections and bypass restrictions. This resulted in the ability to read data from cross-site URLs and local files. - CVE-2015-7205 (overflow in MPEG4Extractor::readMetaData causes memory-safety bug): Security researcher Ronald Crane reported a vulnerability found through code inspection. This issue is an integer overflow while processing an MP4 format video file when an a erroneously-small buffer is allocated and then overrun, resulting in a potentially exploitable crash. - CVE-2015-7212 (underflow in RTPReceiverVideo::ParseRtpPacket causes memory-safety bug and information leak): Security researcher Ronald Crane reported an underflow found through code inspection. This does not all have a clear mechanism to be exploited through web content but could be vulnerable if a means can be found to trigger it. - CVE-2015-7213 (integer overflow allocating extremely large textures): Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover an integer overflow when when allocating textures of extremely larges sizes during graphics operations. This results in a potentially exploitable crash when triggered. - CVE-2015-7214 (miscellaneous memory safety hazards): Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. Andrei Vaida, Jesse Ruderman, and Bob Clary reported memory safety problems and crashes that affect Firefox ESR 38.4 and Firefox 42. Impact ====== A remote attacker might be able to bypass the same-origin policy to access sensitive data, or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://access.redhat.com/security/cve/CVE-2015-7201 https://access.redhat.com/security/cve/CVE-2015-7205 https://access.redhat.com/security/cve/CVE-2015-7212 https://access.redhat.com/security/cve/CVE-2015-7213 https://access.redhat.com/security/cve/CVE-2015-7214

1 0

[arch-security] [ASA-201512-13] claws-mail: buffer overflow
by Remi Gacogne 22 Dec '15

22 Dec '15

Arch Linux Security Advisory ASA-201512-13 ========================================== Severity: High Date : 2015-12-22 CVE-ID : CVE-2015-8614 Package : claws-mail Type : buffer overflow Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package claws-mail before version 3.13.1-1 is vulnerable to a remotely triggerable buffer overflow. Resolution ========== Upgrade to 3.13.1-1. # pacman -Syu "claws-mail>=3.13.1-1" The problem has been fixed upstream in version 3.13.1. Workaround ========== None. Description =========== A remotely triggerable buffer overflow has been found in the code of claws-mail handling character conversion, in functions conv_jistoeuc(), conv_euctojis() and conv_sjistoeuc(), in codeconv.c. There was no bounds checking on buffers passed to these functions, some stack-based but other potentially heap-based. This issue has been located in the wild and might currently be exploited. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host by sending a crafted e-mail to a clasw-mail user. References ========== https://access.redhat.com/security/cve/CVE-2015-8614 http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557 http://git.claws-mail.org/?p=claws.git;a=blobdiff;f=src/codeconv.c;h=39e259…

1 0