- Arch-security - lists.archlinux.org

[arch-security] [ASA-201507-2] firefox: multiple issues
by Remi Gacogne 03 Jul '15

03 Jul '15

Arch Linux Security Advisory ASA-201507-2 ========================================= Severity: Critical Date : 2015-07-03 CVE-ID : CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2727 CVE-2015-2728 CVE-2015-2729 CVE-2015-2731 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2739 CVE-2015-2740 CVE-2015-2741 CVE-2015-2743 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 39.0-1 is vulnerable to multiple issues, including remote code execution. Resolution ========== Upgrade to 39.0-1. # pacman -Syu "firefox>=39.0-1" The problem has been fixed upstream in version 39.0. Workaround ========== None. Description =========== - CVE-2015-2722, CVE-2015-2733 (Use-after-free in workers while using XMLHttpRequest): Security researcher Looben Yan used the Address Sanitizer tool to discover two related use-after-free vulnerabilities that occur when using XMLHttpRequest in concert with either shared or dedicated workers. These errors occur when the XMLHttpRequest object is attached to a worker but that object is incorrectly deleted while still in use. This results in exploitable crashes. - CVE-2015-2724, CVE-2015-2725, CVE-2015-2726 (Miscellaneous memory safety hazards): Mozilla developers and community identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. - CVE-2015-2727 (Local files or privileged URLs in pages can be opened into new tabs): Security researcher Jann Horn reported that when Mozilla Foundation Security Advisory 2015-25 was fixed in Firefox 37, an error was made that caused the fix to not be applied to Firefox 38, effectively causing the bug to be unfixed in Firefox 38 (and Firefox ESR38) once it shipped. As Armin Razmdjou reported for that issue, opening hyperlinks on a page with the mouse and specific keyboard key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. This could allow for local files or resources from a known location to be opened with local privileges, bypassing security protections. - CVE-2015-2728 (Type confusion in Indexed Database Manager): Security researcher Paul Bandha reported a type confusion error where part of IDBDatabase is read by the Indexed Database Manager and incorrectly used as a pointer when it shouldn't be used as such. This leads to memory corruption and the possibility of an exploitable crash. - CVE-2015-2729 (Out-of-bound read while computing an oscillator rendering range in Web Audio): Security researcher Holger Fuhrmannek used the Address Sanitizer tool to discover an out-of-bound read while computing an oscillator rendering range in Web Audio. This could allow an attacker to infer the contents of four bytes of memory. - CVE-2015-2731 (Use-after-free in Content Policy due to microtask execution error): Security researcher Herre reported a use-after-free vulnerability when a Content Policy modifies the Document Object Model to remove a DOM object, which is then used afterwards due to an error in microtask implementation. This leads to an exploitable crash. - CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740 (Vulnerabilities found through code inspection): Security researcher Ronald Crane reported seven vulnerabilities affecting released code that he found through code inspection. These included three uses of uninitialized memory, one poor validation leading to an exploitable crash, one read of unowned memory in zip files, and two buffer overflows. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them. - CVE-2015-2741 (Key pinning is ignored when overridable errors are encountered): Mozilla security engineer David Keeler reported that when an overridable error is encountered, such as those for expired certificates or a host name does not match a certificate, pinning checks can be be skipped. This would allow for a user to override a pinned certificate when they should not be able to do so. This issue does not allow for third parties to cause a certificate to be overridden and the user would still have to manually do so. - CVE-2015-2743 (Privilege escalation in PDF.js): Mozilla community member Jonas Jenwald reported broken behavior in Mozilla's PDF.js PDF file viewer which led to the discovery that internal Workers were incorrectly executed with high privilege. If this flaw were combined with a separate vulnerability allowing for same-origin policy violation, it could be used to run arbitrary code. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://www.mozilla.org/en-US/security/advisories/mfsa2015-59/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-60/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-61/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-62/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-63/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-65/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-66/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-67/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-69/ https://access.redhat.com/security/cve/CVE-2015-2722 https://access.redhat.com/security/cve/CVE-2015-2724 https://access.redhat.com/security/cve/CVE-2015-2725 https://access.redhat.com/security/cve/CVE-2015-2726 https://access.redhat.com/security/cve/CVE-2015-2727 https://access.redhat.com/security/cve/CVE-2015-2728 https://access.redhat.com/security/cve/CVE-2015-2729 https://access.redhat.com/security/cve/CVE-2015-2731 https://access.redhat.com/security/cve/CVE-2015-2733 https://access.redhat.com/security/cve/CVE-2015-2734 https://access.redhat.com/security/cve/CVE-2015-2735 https://access.redhat.com/security/cve/CVE-2015-2736 https://access.redhat.com/security/cve/CVE-2015-2737 https://access.redhat.com/security/cve/CVE-2015-2738 https://access.redhat.com/security/cve/CVE-2015-2739 https://access.redhat.com/security/cve/CVE-2015-2740 https://access.redhat.com/security/cve/CVE-2015-2741 https://access.redhat.com/security/cve/CVE-2015-2743

1 0

[arch-security] [ASA-201507-1] wesnoth: information leakage
by Remi Gacogne 03 Jul '15

03 Jul '15

Arch Linux Security Advisory ASA-201507-1 ========================================= Severity: Low Date : 2015-07-03 CVE-ID : CVE-2015-5069 CVE-2015-5070 Package : wesnoth Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wesnoth before version 1.12.4-1 is vulnerable to information leakage. Resolution ========== Upgrade to 1.12.4-1. # pacman -Syu "wesnoth>=1.12.4-1" The problem has been fixed upstream in version 1.12.4 (an incomplete fix existed in version 1.12.3). Workaround ========== None. Description =========== Wesnoth implements a text preprocessing language that is used in conjunction with its own game scripting language. It also has a built-in Lua interpreter and API. Both the Lua API and the preprocessor make use of the same function (filesystem::get_wml_location()) to resolve file paths so that only content from the user's data directory can be read. However, the function did not explicitly disallow files with the .pbl extension. The contents of these files could thus be stored in saved game files or even transmitted directly to other users in a networked game. Among the information that's compromised is a user-defined passphrase used to authenticate uploads to the game's content server. CVE-2015-5069 and CVE-2015-5070 have been assigned to this vulnerability. Version 1.12.3 included a fix for CVE-2015-5069 only, remaining vulnerable to CVE-2015-5070. Versions 1.12.4 and 1.13.1 contain a more complete fix that addresses both. Impact ====== A remote attacker might be able to get access to sensitive information, including but not limited to a user-defined passphrase used to authenticate uploads to the game's content server. References ========== https://access.redhat.com/security/cve/CVE-2015-5069 https://access.redhat.com/security/cve/CVE-2015-5070 http://forums.wesnoth.org/viewtopic.php?t=42775 http://seclists.org/oss-sec/2015/q2/793

1 0

[arch-security] Are you getting this?
by Allan McRae 29 Jun '15

29 Jun '15

I may have set it up correctly...

6 7

[arch-security] [ASA-201506-5] flashplugin: remote code execution
by Remi Gacogne 24 Jun '15

24 Jun '15

Arch Linux Security Advisory ASA-201506-5 ========================================= Severity: Critical Date : 2015-06-24 CVE-ID : CVE-2015-3113 Package : flashplugin Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.468-1 is vulnerable to remote code execution. Resolution ========== Upgrade to 11.2.202.468-1. # pacman -Syu "flashplugin>=11.2.202.468-1" The problem has been fixed upstream in version 11.2.202.468. Workaround ========== This issue can be mitigated by disabling the flash plugin. Description =========== A heap-based buffer overflow has been found in the FLV handling of Adobe Flash Player, leading to code execution. Impact ====== A remote attacker may be able to execute arbitrary code on a vulnerable host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb15-14.html https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-… https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3113

1 0

[arch-security] [ASA-201506-4] curl: information leakage
by Remi Gacogne 22 Jun '15

22 Jun '15

Arch Linux Security Advisory ASA-201506-4 ========================================= Severity: Medium Date : 2015-06-22 CVE-ID : CVE-2015-3236 CVE-2015-3237 Package : curl Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.43.0-1 is vulnerable to information leakage. Resolution ========== Upgrade to 7.43.0-1. # pacman -Syu "curl>=7.43.0-1" The problem has been fixed upstream in version 7.43.0. Workaround ========== None. Description =========== - CVE-2015-3236 (lingering HTTP credentials in connection re-use): libcurl can wrongly send HTTP credentials when re-using connections. libcurl allows applications to set credentials for the upcoming transfer with HTTP Basic authentication, like with CURLOPT_USERPWD for example. Name and password. Just like all other libcurl options the credentials are sticky and are kept associated with the "handle" until something is made to change the situation. Further, libcurl offers a curl_easy_reset() function that resets a handle back to its pristine state in terms of all settable options. A reset is of course also supposed to clear the credentials. A reset is typically used to clear up the handle and prepare it for a new, possibly unrelated, transfer. Within such a handle, libcurl can also store a set of previous connections in case a second transfer is requested to a host name for which an existing connection is already kept alive. With this flaw present, using the handle even after a reset would make libcurl accidentally use those credentials in a subsequent request if done to the same host name and connection as was previously accessed. An example case would be first requesting a password protected resource from one section of a web site, and then do a second request of a public resource from a completely different part of the site without authentication. This flaw would then inadvertently leak the credentials in the second request. - CVE-2015-3237 (SMB send off unrelated memory contents): libcurl can get tricked by a malicious SMB server to send off data it did not intend to. In libcurl's state machine function handling the SMB protocol (smb_request_state()), two length and offset values are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back. The values are used and trusted without boundary checks and are just assumed to be valid. This allows carefully handcrafted packages to trick libcurl into responding and sending off data that was not intended. Or just crash if the values cause libcurl to access invalid memory. Impact ====== A passive remote adversary or a malicious HTTP server may be able to gather sensitive HTTP credentials. A malicious SMB server may be able to extract arbitrary memory content from a vulnerable SMB client using libcurl. References ========== http://curl.haxx.se/docs/adv_20150617A.html http://curl.haxx.se/docs/adv_20150617B.html https://access.redhat.com/security/cve/CVE-2015-3236 https://access.redhat.com/security/cve/CVE-2015-3237

1 0

[arch-security] [ASA-201506-3] openssl: multiple issues
by Levente Polyak 12 Jun '15

12 Jun '15

Arch Linux Security Advisory ASA-201506-3 ========================================= Severity: High Date : 2015-06-12 CVE-ID : CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-4000 Package : openssl Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package openssl before version 1.0.2.b-1 is vulnerable to multiple issues including but not limited to man-in-the-middle via cipher downgrade, double free and denial of service. Resolution ========== Upgrade to 1.0.2.b-1. # pacman -Syu "openssl>=1.0.2.b-1" The problems have been fixed upstream in version 1.0.2.b. Workaround ========== None. Description =========== - CVE-2015-1788 (denial of service) When processing an ECParameters structure OpenSSL enters an infinite loop if the curve specified is over a specially malformed binary polynomial field. This can be used to perform denial of service against any system which processes public keys, certificate requests or certificates. This includes TLS clients and TLS servers with client authentication enabled. - CVE-2015-1789 (out-of-bounds read) X509_cmp_time does not properly check the length of the ASN1_TIME string and can read a few bytes out of bounds. In addition, X509_cmp_time accepts an arbitrary number of fractional seconds in the time string. An attacker can use this to craft malformed certificates and CRLs of various sizes and potentially cause a segmentation fault, resulting in a DoS on applications that verify certificates or CRLs. TLS clients that verify CRLs are affected. TLS clients and servers with client authentication enabled may be affected if they use custom verification callbacks. - CVE-2015-1790 (denial of service) The PKCS#7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected. - CVE-2015-1791 (double free) If a NewSessionTicket is received by a multi-threaded client when attempting to reuse a previous ticket then a race condition can occur potentially leading to a double free of the ticket data. - CVE-2015-1792 (denial of service) When verifying a signedData message the CMS code can enter an infinite loop if presented with an unknown hash function OID. This can be used to perform denial of service against any system which verifies signedData messages using the CMS code. - CVE-2015-4000 (cipher downgrade) A vulnerability in the TLS protocol allows a man-in-the-middle attacker to downgrade vulnerable TLS connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. This vulnerability is known as Logjam. OpenSSL has added protection for TLS clients by rejecting handshakes with DH parameters shorter than 768 bits. This limit will be increased to 1024 bits in a future release. Impact ====== A remote attacker is able to perform man-in-the-middle via cipher downgrade, denial of service or possibly have other unspecified impact via various vectors. References ========== https://www.openssl.org/news/secadv_20150611.txt https://access.redhat.com/security/cve/CVE-2015-1788 https://access.redhat.com/security/cve/CVE-2015-1789 https://access.redhat.com/security/cve/CVE-2015-1790 https://access.redhat.com/security/cve/CVE-2015-1791 https://access.redhat.com/security/cve/CVE-2015-1792 https://access.redhat.com/security/cve/CVE-2015-4000

1 0

[arch-security] [ASA-201506-2] cups: multiple issues
by Levente Polyak 10 Jun '15

10 Jun '15

Arch Linux Security Advisory ASA-201506-2 ========================================= Severity: Critical Date : 2015-06-10 CVE-ID : CVE-2015-1158 CVE-2015-1159 Package : cups Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package cups before version 2.0.3-1 is vulnerable to multiple issues including arbitrary code execution, privilege escalation and cross-side scripting. Resolution ========== Upgrade to 2.0.3-1. # pacman -Syu "cups>=2.0.3-1" The problems have been fixed upstream in version 2.0.3. Workaround ========== None. Description =========== - CVE-2015-1158 (arbitrary code execution, privilege escalation) An issue with how localized strings are handled in cupsd allows a reference counter to over-decrement when handling certain print job request errors. As a result, an attacker can prematurely free an arbitrary string of global scope, creating a dangling pointer to a repurposed block of memory on the heap. The dangling pointer causes ACL verification to fail when parsing 'admin/conf' and 'admin' ACLs. The ACL handling failure results in unrestricted access to privileged operations, allowing an unauthenticated remote user to upload a replacement CUPS configuration file and mount further attacks. - CVE-2015-1159 (cross-side scripting) A cross-site scripting bug in the CUPS templating engine allows this bug to be exploited when a user browses the web. In certain cases, the CGI template can echo user input to file rather than escaping the text first. This may be used to set up a reflected XSS attack in the QUERY parameter of the web interface help page. By default, many linux distributions run with the web interface activated. Impact ====== A remote attacker is able to use a cross-side scripting flaw in order to send a malicious print request that is leading to arbitrary code execution and privilege escalation. References ========== https://www.cups.org/str.php?L4609 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1158 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1159 https://bugs.archlinux.org/task/45279

1 0

[arch-security] [ASA-201506-1] pcre: buffer overflow
by Remi Gacogne 05 Jun '15

05 Jun '15

Arch Linux Security Advisory ASA-201506-1 ========================================= Severity: High Date : 2015-06-05 CVE-ID : CVE-2015-3210 Package : pcre Type : buffer overflow Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pcre before version 8.37-2 is vulnerable to multiple buffer overflows leading to code execution. Resolution ========== Upgrade to 8.37-2. # pacman -Syu "pcre>=8.37-2" The problem has been fixed upstream in the trunk, but no fixed version has been released yet. Workaround ========== None. Description =========== Several buffer overflows have been found in pcre <= 8.37. By compiling a crafted regular expression, it is possible to write more than the expected size into various buffers, allowing arbitrary code execution. Impact ====== An attacker with the ability to submit an arbitrary regular expression for compilation can execute arbitrary code. References ========== https://access.redhat.com/security/cve/CVE-2015-3210 https://bugs.archlinux.org/task/45207 https://bugs.exim.org/show_bug.cgi?id=1636 http://www.securitytracker.com/id/1032453

1 0

[arch-security] [ASA-201505-20] curl: information leakage
by Remi Gacogne 28 May '15

28 May '15

Arch Linux Security Advisory ASA-201505-20 ========================================== Severity: Low Date : 2015-05-28 CVE-ID : CVE-2015-3153 Package : curl Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package curl before version 7.42.1-1 is vulnerable to information leakage. Resolution ========== Upgrade to 7.42.1-1. # pacman -Syu "curl>=7.42.1-1" The problem has been fixed upstream in version 7.42.1. Workaround ========== This issue can be mitigated when using curl >= 7.37.0: - in libcurl, by setting CURLOPT_HEADEROPT to CURLHEADER_SEPARATE ; - in command-line, by using --proxy-header. Description =========== libcurl provides applications a way to set custom HTTP headers to be sent to the server by using CURLOPT_HTTPHEADER. A similar option is available for the curl command-line tool with the '--header' option. When the connection passes through an HTTP proxy the same set of headers is sent to the proxy as well by default. While this is by design, it has not necessarily been clear nor understood by application programmers. Such tunneling over a proxy is done for example when using the HTTPS protocol - or when explicitly asked for. In this case, the initial connection to the proxy is made in clear including any custom headers using the HTTP CONNECT method. While libcurl provides the CURLOPT_HEADEROPT option to allow applications to tell libcurl if the headers should be sent to host and the proxy or use separate lists to the different destinations, it has still defaulted to sending the same headers to both parties for the sake of compatibility. If the application sets a custom HTTP header with sensitive content (e.g., authentication cookies) without changing the default, the proxy, and anyone who listens to the traffic between the application and the proxy, might get access to those values. Note: this problem doesn't exist when using the CURLOPT_COOKIE option (or the '--cookie' option) or the HTTP auth options, which are always sent only to the destination server. Impact ====== An adversary controlling the HTTP proxy used by client using curl (or libcurl), or listening to the traffic between the application and the proxy, can access to potentially sensitive information contained in HTTP headers. References ========== http://curl.haxx.se/docs/adv_20150429.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3153

1 0

[arch-security] [ASA-201505-19] webkitgtk2: man-in-the-middle
by Levente Polyak 26 May '15

26 May '15

Arch Linux Security Advisory ASA-201505-19 ========================================== Severity: Medium Date : 2015-05-26 CVE-ID : CVE-2015-2330 Package : webkitgtk2 Type : man-in-the-middle Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package webkitgtk2 before version 2.4.9-1 is vulnerable to man-in-the-middle. Resolution ========== Upgrade to 2.4.9-1. # pacman -Syu "webkitgtk2>=2.4.9-1" The problem has been fixed upstream in version 2.4.9. Workaround ========== None. Description =========== It was found that WebKitGTK+ version performed TLS certificate verification too late, after sending an HTTP request rather than before. This issue allows a man-in-the-middle attack to possibly gain sensitive information. Impact ====== A remote attacker is able to perform a man-in-the-middle attack via a crafted TLS certificate to obtain sensitive information. References ========== http://www.openwall.com/lists/oss-security/2015/03/18/4 https://access.redhat.com/security/cve/CVE-2015-2330 https://bugs.archlinux.org/task/44237

1 0