- Arch-security - lists.archlinux.org

[arch-security] wordpress 4.3.1
by G. Schlisio 18 Sep '15

18 Sep '15

hi security concerned archers, the security update for wordpress 4.3.1 [0] is not in the repos yet, but building from abs with a simple version bumb works well. i just wanted to notify about this, in case somebody didnt notice. regards [0] https://wordpress.org/news/2015/09/wordpress-4-3-1/

1 0

[arch-security] [ASA-201509-6] icedtea-web: multiple issues
by Levente Polyak 13 Sep '15

13 Sep '15

Arch Linux Security Advisory ASA-201509-6 ========================================= Severity: Medium Date : 2015-09-14 CVE-ID : CVE-2015-5234 CVE-2015-5235 Package : icedtea-web Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package icedtea-web before version 1.6.1-1 is vulnerable to multiple authorization bypass vulnerabilities. Resolution ========== Upgrade to 1.6.1-1. # pacman -Syu "icedtea-web>=1.6.1-1" The problem has been fixed upstream in version 1.6.1. Workaround ========== None. Description =========== - CVE-2015-5234 (unexpected permanent authorization of unsigned applets) It was discovered that IcedTea-Web did not properly sanitize applet URLs when storing applet trust settings. A malicious web page could use this flaw to inject trust-settings configuration, and cause applets to be executed without user approval. - CVE-2015-5235 (applet origin spoofing) It was discovered that IcedTea-Web did not properly determine an applet's origin when asking the user if the applet should be run. A malicious page could use this flaw to cause IcedTea-Web to execute the applet without user approval, or confuse the user into approving applet execution based on an incorrectly indicated applet origin. Impact ====== A remote attacker is able to execute a malicious applet without user approval via multiple vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-September/033546… https://access.redhat.com/security/cve/CVE-2015-5234 https://access.redhat.com/security/cve/CVE-2015-5235

1 0

[arch-security] [ASA-201509-5] libvdpau lib32vdpau: multiple issues
by chris.rebischke＠gmail.com 12 Sep '15

12 Sep '15

Arch Linux Security Advisory ASA-201509-5 ========================================= Severity: Medium Date : 2015-09-12 CVE-ID : CVE-2015-5198 CVE-2015-5199 CVE-2015-5200 Package : libvdpau lib32-libvdpau Type : multiple issues Remote : no Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages libvdpau and lib32-libvdpau before version 1.1.1-1 are vulnerable to multiple issues. Resolution ========== Upgrade to 1.1.1-1 # pacman -Syu "libvdpau>=1.1.1-1" if you need lib32-libvdpau: # pacman -Syu "libvdpau>=1.1.1-1" "lib32-libvdpau>=1.1.1-1" Workaround ========== None. Description =========== - CVE-2015-5198 (Local Privilege Escalation) When used in a setuid or setgid application, libvdpau/lib32-libvdpau allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable. - CVE-2015-5199 (Directory Traversal) Directory traversal vulnerability in dlopen in libvdpau/lib32/libvdpau allows local users to gain privileges via the VDPAU_DRIVER environment variable. - CVE-2015-5200 (Directory Traversal) The trace functionality in libvdpau/lib32-libvdpau, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors. Impact ====== An attacker can gain root-access or write to arbitrary files without permission. References ========== http://lists.x.org/archives/xorg-announce/2015-August/002630.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5198 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5199 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5200 http://cgit.freedesktop.org/~aplattner/libvdpau/commit/?id=d1f9c16b1a818711…

1 0

[arch-security] [ASA-201509-4] openldap: denial of service
by Levente Polyak 12 Sep '15

12 Sep '15

Arch Linux Security Advisory ASA-201509-4 ========================================= Severity: High Date : 2015-09-12 CVE-ID : CVE-2015-6908 Package : openldap Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openldap before version 2.4.42-2 is vulnerable to a remote denial of service. Resolution ========== Upgrade to 2.4.42-2. # pacman -Syu "openldap>=2.4.42-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== By sending a crafted packet, an attacker can cause the OpenLDAP daemon to crash with a SIGABRT. This is due to an assert() call within the ber_get_next method (io.c line 682) that is hit when decoding tampered BER data. The following proof of concept exploit can be used to trigger the condition: # echo "/4SEhISEd4MKYj5ZMgAAAC8=" | base64 -d | nc -v 127.0.0.1 389 The above causes slapd to abort as follows when running with '-d3', however it should be noted that this will crash the server even when running in daemon mode. Impact ====== A remote attacker is able to send specially crafted packets that cause the OpenLDAP server to crash, leading to denial of service. References ========== http://www.openldap.org/its/index.cgi/Software%20Bugs?id=8240 http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=6fe5… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6908 https://bugs.archlinux.org/task/46265

1 0

[arch-security] [ASA-201509-3] powerdns: denial of service
by Remi Gacogne 07 Sep '15

07 Sep '15

Arch Linux Security Advisory ASA-201509-3 ========================================= Severity: High Date : 2015-09-07 CVE-ID : CVE-2015-5230 Package : powerdns Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package powerdns before version 3.4.6-1 is vulnerable to a remote denial of service. Resolution ========== Upgrade to 3.4.6-1. # pacman -Syu "powerdns>=3.4.6-1" The problem has been fixed upstream in version 3.4.6. Workaround ========== A complete denial of service may be prevented by running the server inside a supervisor and setting distributor-threads to 1. The service may still be degraded though. Description =========== A bug was found in the PowerDNS Authoritative Server DNS packet parsing/generation code, which, when exploited, can cause individual threads (disabling service) or whole processes (allowing a supervisor to restart them) to crash with just one or a few query packets. Impact ====== A remote attacker can cause a denial of service by sending specially crafted DNS queries. References ========== https://doc.powerdns.com/md/security/powerdns-advisory-2015-02/ https://access.redhat.com/security/cve/CVE-2015-5230

1 0

[arch-security] [ASA-201509-2] bind: denial of service
by Remi Gacogne 03 Sep '15

03 Sep '15

Arch Linux Security Advisory ASA-201509-2 ========================================= Severity: High Date : 2015-09-03 CVE-ID : CVE-2015-5722 CVE-2015-5986 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.2.P4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.2.P4-1. # pacman -Syu "bind>=9.10.2.P4-1" The problem has been fixed upstream in versions 9.9.7-P3 and 9.10.2-P4. Workaround ========== CVE-2015-5722 might be mitigated by disabling DNSSEC validation. However this is not recommended by ISC as it would increase the risk of other types of DNS attacks. Description =========== - CVE-2015-5722 (Parsing malformed keys may cause BIND to exit due to a failed assertion in buffer.c): Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example by using a query which requires a response from a zone containing a deliberately malformed key. - CVE-2015-5986 (An incorrect boundary check can trigger a REQUIRE assertion failure in openpgpkey_61.c): An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query. Impact ====== A remote attacker can crash a recursive server by causing a query to be sent for a specially crafted DNS zone she controls, causing denial of service. A remote attacker might be able to crash an authoritative server if she controls a zone the server must query against to perform its zone service, causing denial of service. References ========== https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bi… https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-tri… https://access.redhat.com/security/cve/CVE-2015-5722 https://access.redhat.com/security/cve/CVE-2015-5986

1 0

[arch-security] [ASA-201509-1] chromium: multiple issues
by Remi Gacogne 02 Sep '15

02 Sep '15

Arch Linux Security Advisory ASA-201509-1 ========================================= Severity: High Date : 2015-09-02 CVE-ID : CVE-2015-1291 CVE-2015-1292 CVE-2015-1293 CVE-2015-1294 CVE-2015-1295 CVE-2015-1296 CVE-2015-1297 CVE-2015-1298 CVE-2015-1299 CVE-2015-1300 CVE-2015-1301 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 45.0.2454.85-1 is vulnerable to multiple issues including cross-origin bypass, use-after-free, character spoofing and information leak. Resolution ========== Upgrade to 45.0.2454.85-1. # pacman -Syu "chromium>=45.0.2454.85-1" The problem has been fixed upstream in version 45.0.2454.85. Workaround ========== None. Description =========== - CVE-2015-1291, CVE-2015-1293: Cross-origin bypass in DOM. - CVE-2015-1292: Cross-origin bypass in ServiceWorker. - CVE-2015-1294: Use-after-free in Skia. - CVE-2015-1295: Use-after-free in Printing. - CVE-2015-1296: Character spoofing in omnibox. - CVE-2015-1297: Permission scoping error in WebRequest. - CVE-2015-1298: URL validation error in extensions. - CVE-2015-1299: Use-after-free in Blink. - CVE-2015-1300: Information leak in Blink. - CVE-2015-1301: Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass the Same-Origin Policy of a website, spoof character in omnibox to trick the user, leak information, cause a denial of service or have other unspecified impact. References ========== http://googlechromereleases.blogspot.fr/2015/09/stable-channel-update.html https://access.redhat.com/security/cve/CVE-2015-1291 https://access.redhat.com/security/cve/CVE-2015-1292 https://access.redhat.com/security/cve/CVE-2015-1293 https://access.redhat.com/security/cve/CVE-2015-1294 https://access.redhat.com/security/cve/CVE-2015-1295 https://access.redhat.com/security/cve/CVE-2015-1296 https://access.redhat.com/security/cve/CVE-2015-1297 https://access.redhat.com/security/cve/CVE-2015-1298 https://access.redhat.com/security/cve/CVE-2015-1299 https://access.redhat.com/security/cve/CVE-2015-1300 https://access.redhat.com/security/cve/CVE-2015-1301

1 0

[arch-security] [ASA-201508-12] firefox: multiple issues
by Remi Gacogne 28 Aug '15

28 Aug '15

Arch Linux Security Advisory ASA-201508-12 ========================================== Severity: Critical Date : 2015-08-28 CVE-ID : CVE-2015-4497 CVE-2015-4498 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 40.0.3-1 is vulnerable to arbitrary code execution and add-on dialog bypass/spoof. Resolution ========== Upgrade to 40.0.3-1. # pacman -Syu "firefox>=40.0.3-1" The problem has been fixed upstream in version 40.0.3. Workaround ========== None. Description =========== - CVE-2015-4497 (use-after-free when resizing canvas element during restyling): Mozilla community member Jean-Max Reymond discovered a use-after-free vulnerability with a <canvas> element on a page. This occurs when a resize event is triggered in concert with style changes but the canvas references have been recreated in the meantime, destroying the originally referenced context. This results in an exploitable crash. Ucha Gobejishvili, working with HP's Zero Day Initiative, subsequently reported this same issue. - CVE-2015-4498 (add-on bypass dialog and spoof): Security researcher Bas Venis reported a mechanism where add-ons could be installed from a different source than user expectations. Normally, when a user enters the URL to an add-on directly in the addressbar, warning prompts are bypassed because it is the result of direct user action. He discovered that a data: URL could be manipulated on a loaded page to simulate this direct user input of the add-on's URL, which would result in a bypassing of the install permission prompt. He also reported that in the absence of the permission prompt, it is possible to cause the actual installation prompt to appear above another site's location by causing a page navigation immediately after triggering add-on installation. This could manipulate a user into falsely believing a trusted site (such as addons.mozilla.org) has initiated the installation. This could lead to users installing an add-on from a malicious source. Impact ====== A remote attacker can execute arbitrary code on the affected host if the user can be led to visit a crafted website. A remote attacker can also trick a user into installing an add-on from a malicious source. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2015-94/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-95/ https://access.redhat.com/security/cve/CVE-2015-4497 https://access.redhat.com/security/cve/CVE-2015-4498

1 0

[arch-security] [ASA-201508-11] pcre: arbitrary code execution
by Levente Polyak 25 Aug '15

25 Aug '15

Arch Linux Security Advisory ASA-201508-11 ========================================== Severity: Critical Date : 2015-08-26 CVE-ID : None Package : pcre Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pcre before version 8.37-3 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.37-3. # pacman -Syu "pcre>=8.37-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A heap overflow has been discovered when compiling certain regular expressions with named references. This issue may lead to arbitrary code execution. Impact ====== A remote attacker able to compile a special regular expression with named references may be able to execute arbitrary code. References ========== http://seclists.org/oss-sec/2015/q3/295 https://bugs.exim.org/show_bug.cgi?id=1667

1 0

[arch-security] [ASA-201508-10] jasper: denial of service
by Levente Polyak 25 Aug '15

25 Aug '15

Arch Linux Security Advisory ASA-201508-10 ========================================== Severity: Medium Date : 2015-08-26 CVE-ID : CVE-2015-5203 Package : jasper Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The packages jasper before version 1.900.1-14 is vulnerable to denial of service. Resolution ========== Upgrade to 1.900.1-14. # pacman -Syu "jasper>=1.900.1-14" The problem has not been fixed upstream yet. Workaround ========== None. Description =========== A double free issue has been discovered in the function jasper_image_stop_load. This vulnerability can be triggered by loading a specially crafted image through jasper. Impact ====== A remote attacker is able to send a specially crafted image that triggers a double free leading to denial of service. References ========== http://seclists.org/oss-sec/2015/q3/366 https://access.redhat.com/security/cve/CVE-2015-5203

1 0