- Arch-security - lists.archlinux.org

[arch-security] [ASA-201505-9] qemu: arbitrary code execution
by Levente Polyak 14 May '15

14 May '15

Arch Linux Security Advisory ASA-201505-9 ========================================= Severity: Critical Date : 2015-05-14 CVE-ID : CVE-2015-3456 Package : qemu Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qemu before version 2.2.1-5 is vulnerable to arbitrary code execution in the context of the host’s hypervisor process. Resolution ========== Upgrade to 2.2.1-5. # pacman -Syu "qemu>=2.2.1-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The guest operating system communicates with the FDC by sending commands such as seek, read, write, format, etc. to the FDC’s input/output port. QEMU’s virtual FDC uses a fixed-size buffer for storing these commands and their associated data parameters. The FDC keeps track of how much data to expect for each command and, after all expected data for a given command is received from the guest system, the FDC executes the command and clears the buffer for the next command. This buffer reset is performed immediately at the completion of processing for all FDC commands, except for two of the defined commands. An attacker can send these commands and specially crafted parameter data from the guest system to the FDC to overflow the data buffer and execute arbitrary code in the context of the host’s hypervisor process. Impact ====== A remote attacker is able to send FDC commands and specially crafted parameter data from the guest system to overflow the data buffer and execute arbitrary code in the context of the host’s hypervisor process. References ========== https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3456 https://github.com/qemu/qemu/commit/e90774626 https://bugs.archlinux.org/task/44954

1 0

[arch-security] QEMU venom vulnerability
by Mark Lee 14 May '15

14 May '15

To All, After the disclosure of the venom vulnerability in QEMU today; I'm wondering if the Arch version of qemu is vulnerable. The disclosure indicated that distros have been notified since 4/30/2015. Regards, Mark

3 5

[arch-security] [ASA-201505-8] tomcat6: denial of service
by Remi Gacogne 13 May '15

13 May '15

Arch Linux Security Advisory ASA-201505-8 ========================================= Severity: Low Date : 2015-05-13 CVE-ID : CVE-2014-0230 Package : tomcat6 Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package tomcat6 before version 6.0.44-1 is vulnerable to remote denial of service. Resolution ========== Upgrade to 6.0.44-1. # pacman -Syu "tomcat6>=6.0.44-1" The problem has been fixed upstream in version 6.0.44. Workaround ========== None. Description =========== When a response for a request with a request body is returned to the user agent before the request body is fully read, by default Tomcat swallows the remaining request body so that the next request on the connection may be processed. There was no limit to the size of request body that Tomcat would swallow. This permitted a limited Denial of Service as Tomcat would never close the connection and a processing thread would remain allocated to the connection. Impact ====== A remote attacker can cause a denial of service by preventing a large number of connections from being closed. References ========== https://access.redhat.com/security/cve/CVE-2014-0230 https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.44

1 0

[arch-security] [ASA-201505-7] firefox: multiple issues
by Remi Gacogne 13 May '15

13 May '15

Arch Linux Security Advisory ASA-201505-7 ========================================= Severity: Critical Date : 2015-05-13 CVE-ID : CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2711 CVE-2015-2712 CVE-2015-2713 CVE-2015-2715 CVE-2015-2716 CVE-2015-2717 CVE-2015-2718 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 38.0-1 is vulnerable to multiple issues including remote code execution. Resolution ========== Upgrade to 38.0-1. # pacman -Syu "firefox>=38.0-1" The problem has been fixed upstream in version 38.0. Workaround ========== None. Description =========== - CVE-2015-2708 (Memory safety bugs fixed in Firefox ESR 31.7 and Firefox 38): Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported memory safety problems and crashes that affect Firefox ESR 31.6 and Firefox 37. - CVE-2015-2709 (Memory safety bugs fixed in Firefox 38): Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety problems and crashes that affect Firefox 37. - CVE-2015-2710 (Buffer overflow with SVG content and CSS): Using the Address Sanitizer tool, security researcher Atte Kettunen found a buffer overflow during the rendering of SVG format graphics when combined with specific CSS properties on a page. This results in a potentially exploitable crash. - CVE-2015-2711 (Referrer policy ignored when links opened by middle-click and context menu): Security researcher Alex Verstak reported that <meta name="referrer"> is ignored when a link is opened through the context menu or a middle-click by mouse. This means that, in some situations, the referrer policy is ignored when opening links in new tabs and may cause some pages to open without an HTTP Referer header being set according to the author's intended policy. - CVE-2015-2712 (Out-of-bounds read and write in asm.js validation): Security researcher Dougall Johnson reported an out-of-bounds read and write in asm.js during JavaScript validation due to an error in how heap lengths are defined. This results in a potentially exploitable crash and could allow for the reading of random memory which may contain sensitive data. - CVE-2015-2713 (Use-after-free during text processing with vertical text enabled): Security researcher Scott Bell used the Address Sanitizer tool to discover a use-after-free error during the processing of text when vertical text is enabled. This leads to a potentially exploitable crash. - CVE-2015-2715 (Use-after-free due to Media Decoder Thread creation during shutdown): Security researchers Tyson Smith and Jesse Schwartzentruber reported a use-after-free during the shutdown process. This was caused by a race condition when media decoder threads are created during the shutdown process in some circumstances. This leads to a potentially exploitable crash when triggered. - CVE-2015-2716 (Buffer overflow when parsing compressed XML): Security researcher Ucha Gobejishvili used the Address Sanitizer tool to find a buffer overflow while parsing compressed XML content. This was due to an error in how buffer space is created and modified when handling large amounts of XML data. This results in a potentially exploitable crash. - CVE-2015-2717 (Buffer overflow and out-of-bounds read while parsing MP4 video metadata): Security researcher laf.intel reported a buffer overflow and out-of-bounds read in the libstagefright library while parsing invalid metadata in MP4 video files. This can lead to a potentially exploitable crash. - CVE-2015-2718 (Untrusted site hosting trusted page can intercept webchannel responses): Mozilla developer Mark Hammond reported a flaw in how WebChannel.jsm handles message traffic. He found that when a trusted page is hosted within an <iframe> on an untrusted third-party untrusted framing page, the untrusted page could intercept webchannel responses meant for the trusted page, bypassing origin restrictions. Impact ====== A remote attacker can execute arbitrary code with the permission of the current firefox user by tricking him into visiting a website. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://access.redhat.com/security/cve/CVE-2015-2708 https://access.redhat.com/security/cve/CVE-2015-2709 https://access.redhat.com/security/cve/CVE-2015-2710 https://access.redhat.com/security/cve/CVE-2015-2711 https://access.redhat.com/security/cve/CVE-2015-2712 https://access.redhat.com/security/cve/CVE-2015-2713 https://access.redhat.com/security/cve/CVE-2015-2715 https://access.redhat.com/security/cve/CVE-2015-2716 https://access.redhat.com/security/cve/CVE-2015-2717 https://access.redhat.com/security/cve/CVE-2015-2718

1 0

[arch-security] [ASA-201505-6] docker: multiple issues
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-6 ========================================= Severity: High Date : 2015-05-08 CVE-ID : CVE-2015-3627 CVE-2015-3629 CVE-2015-3630 CVE-2015-3631 Package : docker Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package docker before version 1:1.6.1-1 is vulnerable to multiple issues including but not limited to privilege escalation, symlink traversal, unauthorized configuration modification, information disclosure and policy profile escalation. Resolution ========== Upgrade to 1:1.6.1-1. # pacman -Syu "docker>=1:1.6.1-1" The problems have been fixed upstream in version 1.6.1. Workaround ========== None. Description =========== - CVE-2015-3627 (privilege escalation) The file-descriptor passed by libcontainer to the pid-1 process of a container has been found to be opened prior to performing the chroot, allowing insecure open and symlink traversal. This allows malicious container images to trigger a local privilege escalation. - CVE-2015-3629 (privilege escalation) Symlink traversal on container respawn allows local privilege escalation. Libcontainer version 1.6.0 introduced changes which facilitated a mount namespace breakout upon respawn of a container. This allowed malicious images to write files to the host system and escape containerization. - CVE-2015-3630 (unauthorized modification) Several paths underneath /proc were writable from containers, allowing global system manipulation and configuration. These paths included /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. By allowing writes to /proc/fs, it has been noted that CIFS volumes could be forced into a protocol downgrade attack by a root user operating inside of a container. Machines having loaded the timer_stats module were vulnerable to having this mechanism enabled and consumed by a container. - CVE-2015-3631 (policy profile escalation) By allowing volumes to override files of /proc within a mount namespace, a user could specify arbitrary policies for Linux Security Modules, including setting an unconfined policy underneath AppArmor, or a docker_t policy for processes managed by SELinux. In all versions of Docker up until 1.6.1, it is possible for malicious images to configure volume mounts such that files of proc may be overridden. Impact ====== A remote attacker is able to escalate privileges via unsafe symlink traversal, modify the configuration of the host system or disclose information via specific writable descriptors in /proc or escalate the LSM policy profiles by overriding files of /proc. References ========== http://seclists.org/oss-sec/2015/q2/389 https://access.redhat.com/security/cve/CVE-2015-3627 https://access.redhat.com/security/cve/CVE-2015-3629 https://access.redhat.com/security/cve/CVE-2015-3630 https://access.redhat.com/security/cve/CVE-2015-3631

1 0

[arch-security] [ASA-201505-5] libtasn1: arbitrary code execution
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-5 ========================================= Severity: Critical Date : 2015-05-08 CVE-ID : CVE-2015-3622 Package : libtasn1 Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libtasn1 before version 4.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.5-1. # pacman -Syu "libtasn1>=4.5-1" The problem has been fixed upstream in version 4.5. Workaround ========== None. Description =========== A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded input. A specially crafted, DER-encoded input could cause an application using libtasn1 to perform an invalid read, causing the application to crash or, possibly, execute arbitrary code. The heap overflow happens in the function _asn1_extract_der_octet() that is called during decoding of DER-encoded input. Impact ====== A remote attacker is able to use a specially crafted certificate that is leading to arbitrary code execution during decoding. References ========== http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=f979435 https://access.redhat.com/security/cve/CVE-2015-3622

1 0

[arch-security] [ASA-201505-4] mariadb-clients: denial of service
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-4 ========================================= Severity: Medium Date : 2015-05-08 CVE-ID : CVE-2014-8964 Package : mariadb-clients Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mariadb-clients before version 10.0.18-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.0.18-1. # pacman -Syu "mariadb-clients>=10.0.18-1" The problems have been fixed upstream in version 10.0.18. Workaround ========== None. Description =========== A heap-based buffer overflow was found in the way PCRE handled certain malformed regular expressions. This issue could cause a crash while parsing malicious regular expressions related to an assertion that allows zero repeats. Impact ====== A remote attacker is able to cause an application crash leading to denial of service via malicious regular expressions. References ========== https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8964

1 0

[arch-security] [ASA-201505-3] mariadb: denial of service
by Levente Polyak 08 May '15

08 May '15

Arch Linux Security Advisory ASA-201505-3 ========================================= Severity: Medium Date : 2015-05-08 CVE-ID : CVE-2014-8964 CVE-2015-0499 CVE-2015-0501 CVE-2015-0505 CVE-2015-2571 Package : mariadb Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mariadb before version 10.0.18-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.0.18-1. # pacman -Syu "mariadb>=10.0.18-1" The problems have been fixed upstream in version 10.0.18. Workaround ========== None. Description =========== - CVE-2014-8964 (denial of service) A heap-based buffer overflow was found in the way PCRE handled certain malformed regular expressions. This issue could cause a crash while parsing malicious regular expressions related to an assertion that allows zero repeats. - CVE-2015-0499 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : Federated. - CVE-2015-0501 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling. - CVE-2015-0505 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : DDL. - CVE-2015-2571 (denial of service) Unspecified vulnerability allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. Impact ====== A remote authenticated attacker is able to cause a server crash leading to denial of service via malicious regular expressions and various unspecified vectors. References ========== https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/ https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8964 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0499 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0501 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0505 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2571

1 0

[arch-security] [ASA-201505-2] clamav: multiple issues
by Levente Polyak 03 May '15

03 May '15

Arch Linux Security Advisory ASA-201505-2 ========================================= Severity: Medium Date : 2015-05-03 CVE-ID : CVE-2015-2170 CVE-2015-2221 CVE-2015-2222 CVE-2015-2305 CVE-2015-2668 Package : clamav Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package clamav before version 0.98.7-1 is vulnerable to denial of service and under certain circumstances on 32-bit platforms possibly arbitrary code execution. Resolution ========== Upgrade to 0.98.7-1. # pacman -Syu "clamav>=0.98.7-1" The problems have been fixed upstream in version 0.98.7. Workaround ========== None. Description =========== - CVE-2015-2170 (denial of service) A flaw has been found in the UPX decoder with crafted files. During unpacking there are two range checks which are implemented "manually". Those checks lack the detection of overflows which are considered by the CLI_ISCONTAINED() macro. - CVE-2015-2221 (denial of service) Y0da cryptor / protector is a PE file encryptor - the executable file is decrypted on start up. Clamav is able to decrypt such files in order to scan them. As part of the decryptor there is an op code emulator. A special crafted file may contain a jump op code to a position that already has been interpreted - which leads to an endless loop. This leads to an endless loop in clamav itself. - CVE-2015-2222 (denial of service) Petite is a tool for compressing PE files on windows. Clamav is a virus scanning tool which is able to unpack such files during scanning. Once the file has been identified as "petite" compressed before the decompressing process is started it is possible that a specially crafted file tells clamav to read more data than it allocated memory. On glibc it leads to SIGABRT on free() since glibc's malloc() recognizes this. - CVE-2015-2305 (arbitrary code execution) An upstream patch for possible heap overflow in Henry Spencer's regex library has been applied. The flaw is within an integer overflow in the regcomp implementation in the Henry Spencer regex library on 32-bit platforms, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow. - CVE-2015-2668 (denial of service) A flaw has been discovered that is leading to an infinite loop condition on a crafted "xz" archive file. Impact ====== A remote attacker is able to use specially crafted files that are leading to denial of service when scanned by Clamav. Additionally it may be possible to execute arbitrary code on 32-bit platforms under certain circumstances. References ========== http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html https://access.redhat.com/security/cve/CVE-2015-2170 https://access.redhat.com/security/cve/CVE-2015-2221 https://access.redhat.com/security/cve/CVE-2015-2222 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2305 https://access.redhat.com/security/cve/CVE-2015-2668

1 0

[arch-security] [ASA-201505-1] squid: weak certificate validation
by Levente Polyak 01 May '15

01 May '15

Arch Linux Security Advisory ASA-201505-1 ========================================= Severity: High Date : 2015-05-01 CVE-ID : CVE-2015-3455 Package : squid Type : weak certificate validation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package squid before version 3.5.4-1 is vulnerable to weak certificate validation. Resolution ========== Upgrade to 3.5.4-1. # pacman -Syu "squid>=3.5.4-1" The problem has been fixed upstream in version 3.5.4. Workaround ========== Upgrade the squid.conf settings to use a "ssl_bump peek" operation before the "bump" operation. NOTE that this workaround does not resolve the vulnerability, but allow Squid to relay (or mimic) the invalid certificate to clients and depends on validation in the client. Alternatively remove from squid.conf (and include'd files) any ssl_bump directives. Description =========== The flaw allows remote servers to bypass client certificate validation. Some attackers may also be able to use valid certificates for one domain signed by a global Certificate Authority to abuse an unrelated domain. However, the bug is exploitable only if you have configured Squid to perform SSL Bumping with the "client-first" or "bump" mode of operation. Sites that do not use SSL-Bump are not vulnerable. Impact ====== A remote attacker is able to bypass client certificate validation, as a result malicious server responses can wrongly be presented through the proxy to clients as secure authenticated HTTPS responses. References ========== http://www.squid-cache.org/Advisories/SQUID-2015_1.txt http://www.openwall.com/lists/oss-security/2015/04/30/2 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3455

1 0