- Arch-security - lists.archlinux.org

[arch-security] Git client vulnerability
by Matthew Jack 21 Dec '14

21 Dec '14

Hello all, I haven't seen anything about this in the mailing list but I think it's interesting - and important for developers: https://github.com/blog/1938-git-client-vulnerability-announced Happy holidays!

2 1

[arch-security] [ASA-201412-23] php: use after free
by Levente Polyak 19 Dec '14

19 Dec '14

Arch Linux Security Advisory ASA-201412-23 ========================================== Severity: Moderate Date : 2014-12-19 CVE-ID : CVE-2014-8142 Package : php Type : use after free Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package php before version 5.6.4-1 is suffering from a use after free flaw leading to denial of service and possibly arbitrary code execution. Resolution ========== Upgrade to 5.6.4-1. # pacman -Syu "php>=5.6.4-1" The problem has been fixed in version 5.6.4. Workaround ========== None. Description =========== A use-after-free flaw was found in PHP unserialize(). An untrusted input could cause PHP interpreter to crash or, possibly, execute arbitrary code when processed using unserialize(). Impact ====== A remote attacker able to pass crafted data to the unserialize function is able to force a crash or possibly execute arbitrary code. References ========== https://access.redhat.com/security/cve/CVE-2014-8142 https://bugzilla.redhat.com/show_bug.cgi?id=1175718 https://bugs.php.net/bug.php?id=68545

1 0

[arch-security] [ASA-201412-22] jasper: arbitrary code execution
by Levente Polyak 19 Dec '14

19 Dec '14

Arch Linux Security Advisory ASA-201412-22 ========================================== Severity: Critical Date : 2014-12-19 CVE-ID : jasper Package : CVE-2014-8137 CVE-2014-9029 CVE-2011-4516 CVE-2011-4517 Type : arbitrary code execution, denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package jasper before version 1.900.1-12 is vulnerable to arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.900.1-12. # pacman -Syu "jasper>=1.900.1-12" The problems have not been fixed upstream but patches were added. Workaround ========== None. Description =========== - CVE-2014-8137 (arbitrary code execution) A double free flaw was found in the way JasPer parsed ICC color profiles in JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. - CVE-2014-9029 (arbitrary code execution) Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow. - CVE-2011-4516 (arbitrary code execution) Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file. - CVE-2011-4517 (arbitrary code execution) The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file. Impact ====== An attacker is able to execute arbitrary code or perform a denial of service attack via various vulnerabilities. References ========== https://marc.info/?l=oss-security&m=141770163916268&w=2 https://marc.info/?l=oss-security&m=141891163026757&w=2 https://access.redhat.com/security/cve/CVE-2014-8137 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9029 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4516 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4517 https://bugs.archlinux.org/task/43044 https://bugs.archlinux.org/task/43155

1 0

[arch-security] [ASA-201412-21] glibc: arbitrary code execution
by Levente Polyak 19 Dec '14

19 Dec '14

Arch Linux Security Advisory ASA-201412-21 ========================================== Severity: High Date : 2014-12-18 CVE-ID : CVE-2012-3406 CVE-2014-9402 Package : glibc lib32-glibc Type : arbitrary code execution, denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The packages glibc and lib32-glibc before version 2.20-5 are vulnerable to arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.20-5. # pacman -Syu "glibc>=2.20-5" # pacman -Syu "lib32-glibc>=2.20-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2012-3406 (arbitrary code execution) The vfprintf function in stdio-common/vfprintf.c in GNU C Library does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers. - CVE-2014-9402 (denial of service) The nss_dns getnetbyname function will enter an infinite loop if the DNS backend is activated in the system Name Service Switch configuration and the DNS resolver receives a positive answer while processing the network name. Impact ====== An attacker is able to perform a denial of service attack or execute arbitrary code via crafted format strings. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3406 https://access.redhat.com/security/cve/CVE-2014-9402 https://sourceware.org/bugzilla/show_bug.cgi?id=17630 http://www.openwall.com/lists/oss-security/2014/12/18/1

1 0

[arch-security] Privelege escalation via Wheel + PolKit
by Mark Lee 17 Dec '14

17 Dec '14

To all, This was just posted on oss-security; I figure it's a good read. https://www.alertlogic.com/blog/dont-let-grinch-steal-christmas/ Regards, Mark

1 1

[arch-security] [ASA-201412-20] unrtf: arbitrary code execution
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-20 ========================================== Severity: High Date : 2014-12-16 CVE-ID : CVE-2014-9274 CVE-2014-9275 Package : unrtf Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package unrtf before version 0.21.7-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.21.7-1. # pacman -Syu "unrtf>=0.21.7-1" The problems have been fixed upstream in version 0.21.7. Workaround ========== None. Description =========== - CVE-2014-9274 (arbitrary code execution) A flaw allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code as demonstrated by a file containing the string "{\cb-999999999". - CVE-2014-9275 (arbitrary code execution) A flaw allows remote attackers to cause a denial of service (out-of-bounds memory access and crash) and possibly execute arbitrary code via a crafted RTF file. Impact ====== An attacker able to craft a RTF file could use those issues to cause a crash or execute arbitrary code while accessing a pointer that may be under the attacker's control. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9274 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9275 https://bugzilla.redhat.com/show_bug.cgi?id=1170233 http://seclists.org/oss-sec/2014/q4/904 https://bugs.archlinux.org/task/43131

1 0

[arch-security] [ASA-201412-19] dokuwiki: cross-site scripting
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-19 ========================================== Severity: Medium Date : 2014-12-16 CVE-ID : CVE-2014-9253 Package : dokuwiki Type : cross-site scripting Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package dokuwiki before version 20140929_b-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 20140929_b-1. # pacman -Syu "dokuwiki>=20140929_b-1" The problem has been fixed upstream in version 20140929_b. Workaround ========== None. Description =========== It was discovered that dokuwiki did not sufficiently filter uploaded files. A remote attacker with upload access is able to use this flaw in order to upload SWF files leading to possible cross-site scripting. Impact ====== A remote attacker with upload access is able to craft a SWF file to perform a cross-site scripting attack. References ========== https://access.redhat.com/security/cve/CVE-2014-9253 http://seclists.org/oss-sec/2014/q4/1050 https://www.dokuwiki.org/changes#release_2014-09-29b_hrun https://github.com/splitbrain/dokuwiki/commit/778ddf

1 0

[arch-security] [ASA-201412-18] nss: signature forgery
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-18 ========================================== Severity: High Date : 2014-12-16 CVE-ID : CVE-2014-1569 Package : nss Type : signature forgery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package nss before version 3.17.3-1 is vulnerable to signature forgery. Resolution ========== Upgrade to 3.17.3-1. # pacman -Syu "nss>=3.17.3-1" The problem has been fixed upstream in version 3.17.3. Workaround ========== None. Description =========== The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00. This update also adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails. This can prevent a forceful downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566, also known as POODLE. SSL 3.0 support has also been disabled by default in this Firefox and Thunderbird update, further mitigating POODLE. Impact ====== A remote attacker is able to smuggle arbitrary data into an ASN.1 object in order to forge certificates that are considered trusted. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1569 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_re… https://hg.mozilla.org/projects/nss/rev/e9a7991380db https://bugzilla.mozilla.org/show_bug.cgi?id=1064670 https://bugs.archlinux.org/task/42760

1 0

[arch-security] [ASA-201412-17] subversion: denial of service
by Levente Polyak 16 Dec '14

16 Dec '14

Arch Linux Security Advisory ASA-201412-17 ========================================== Severity: Medium Date : 2014-12-16 CVE-ID : CVE-2014-3580 CVE-2014-8108 Package : subversion Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package subversion before version 1.8.11-1 is vulnerable to denial of service in mod_dav_svn through multiple remotely triggerable crashes. Resolution ========== Upgrade to 1.8.11-1. # pacman -Syu "subversion>=1.8.11-1" The problems have been fixed upstream in version 1.8.11. Workaround ========== None. Description =========== - CVE-2014-3580 (denial of service) A NULL pointer dereference flaw was found in the way mod_dav_svn handled REPORT requests. A remote, unauthenticated attacker could use a crafted REPORT request to crash mod_dav_svn. - CVE-2014-8108 (denial of service) A NULL pointer dereference flaw was found in the way mod_dav_svn handled URIs for virtual transaction names. A remote, unauthenticated attacker could send a request for a virtual transaction name that does not exist, causing mod_dav_svn to crash. Impact ====== A remote attacker is able to send specially crafted requests causing mod_dav_svn to crash leading to denial of service. References ========== https://subversion.apache.org/security/CVE-2014-3580-advisory.txt https://subversion.apache.org/security/CVE-2014-8108-advisory.txt https://access.redhat.com/security/cve/CVE-2014-3580 https://access.redhat.com/security/cve/CVE-2014-8108

1 0

[arch-security] [ASA-201412-16] docker: multiple issues
by Levente Polyak 15 Dec '14

15 Dec '14

Arch Linux Security Advisory ASA-201412-16 ========================================== Severity: Medium Date : 2014-12-15 CVE-ID : CVE-2014-9356 CVE-2014-9357 CVE-2014-9358 Package : docker Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package docker before version 1:1.4.0-1 is vulnerable to multiple issues including but not limited to privilege escalation and path traversal. Resolution ========== Upgrade to 1:1.4.0-1. # pacman -Syu "docker>=1:1.4.0-1" The problems have been fixed upstream in version 1.4.0. Workaround ========== None. Description =========== - CVE-2014-9356 (path traversal) Path traversal attacks are possible in the processing of absolute symlinks. In checking symlinks for traversals, only relative links were considered. This allowed path traversals to exist where they should have otherwise been prevented. This was exploitable via both archive extraction and through volume mounts. This vulnerability allowed malicious images or builds from malicious Dockerfiles to write files to the host system and escape containerization, leading to privilege escalation. - CVE-2014-9357 (privilege escalation) It has been discovered that the introduction of chroot for archive extraction in Docker 1.3.2 had introduced a privilege escalation vulnerability. Malicious images or builds from malicious Dockerfiles could escalate privileges and execute arbitrary code as a privileged root user on the Docker host by providing a malicious ‘xz’ binary. - CVE-2014-9358 (path traversal) It has been discovered that Docker does not sufficiently validate Image IDs as provided either via 'docker load' or through registry communications. This allows for path traversal attacks, causing graph corruption and manipulation by malicious images, as well as repository spoofing attacks. Impact ====== A local attacker is able to create malicious Dockerfiles or image IDs in order to perform privilege escalation or path traversal. References ========== http://www.securityfocus.com/archive/1/534215 https://access.redhat.com/security/cve/CVE-2014-9356 https://access.redhat.com/security/cve/CVE-2014-9357 https://access.redhat.com/security/cve/CVE-2014-9358

1 0