- Arch-security - lists.archlinux.org

[arch-security] [Arch Linux Security Advisory ASA-201411-28] dbus: denial of service
by Levente Polyak 23 Nov '14

23 Nov '14

Arch Linux Security Advisory ASA-201411-28 ========================================== Severity: Medium Date : 2014-11-23 CVE-ID : CVE-2014-7824 Package : dbus Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package dbus before version 1.8.10-1 is vulnerable to denial of service via file descriptor exhaustion. Resolution ========== Upgrade to 1.8.10-1. # pacman -Syu "dbus>=1.8.10-1" The problem has been fixed upstream in version 1.8.10. Workaround ========== None. Description =========== The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on incorrect reasoning and does not fully prevent the attack described in the impact section below. Preventing that attack requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a higher value. Impact ====== A local attacker is able to queue up the maximum allowed number of file descriptors to reach the system dbus-daemon's RLIMIT_NOFILE resulting in a denial of service in two ways: - new clients would be unable to connect to the dbus-daemon - when receiving a subsequent message from a non-malicious client that contained a fd, dbus-daemon would receive the MSG_CTRUNC flag, indicating that the list of fds was truncated; kernel fd-passing APIs do not provide any way to recover from that, so dbus-daemon responds to MSG_CTRUNC by disconnecting the sender, causing denial of service to that sender References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7824 http://www.openwall.com/lists/oss-security/2014/11/10/2 https://bugs.freedesktop.org/show_bug.cgi?id=85105

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-27] glibc: command execution
by Remi Gacogne 21 Nov '14

21 Nov '14

Arch Linux Security Advisory ASA-201411-27 ========================================== Severity: Medium Date : 2014-11-21 CVE-ID : CVE-2014-7817 Package : glibc Type : command execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package glibc before version 2.20-3 is vulnerable to command execution. Resolution ========== Upgrade to 2.20-3. # pacman -Syu "glibc>=2.20-3" The problem has been fixed upstream but there has been no new release yet. Workaround ========== None. Description =========== The wordexp function could ignore the WRDE_NOCMD flag under certain input conditions resulting in the execution of a shell for command substitution when the application did not request it. The implementation now checks WRDE_NOCMD immediately before executing the shell and returns the error WRDE_CMDSUB as expected. Impact ====== An attacker may be able to force arbitrary commands to be executed by an application using the wordexp function. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7817 https://sourceware.org/bugzilla/show_bug.cgi?id=17625 http://seclists.org/oss-sec/2014/q4/730

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-26] chromium: multiple issues
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-26 ========================================== Severity: High Date : 2014-11-20 CVE-ID : CVE-2014-7899 CVE-2014-7900 CVE-2014-7901 CVE-2014-7902 CVE-2014-7903 CVE-2014-7904 CVE-2014-7906 CVE-2014-7907 CVE-2014-7908 CVE-2014-7909 CVE-2014-7910 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package chromium before version 39.0.2171.65-1 is vulnerable to multiple issues including but not limited to address bar spoofing and denial of service. Resolution ========== Upgrade to 39.0.2171.65-1. # pacman -Syu "chromium>=39.0.2171.65-1" The problems have been fixed upstream in version 39.0.2171.65. Workaround ========== None. Description =========== - CVE-2014-7899 (address bar spoofing) A flaw allows remote attackers to spoof the address bar by placing a blob: substring at the beginning of the URL, followed by the original URI scheme and a long username string. - CVE-2014-7900 (use-after-free) Use-after-free vulnerability in the CPDF_Parser::IsLinearizedFile function in fpdfapi/fpdf_parser/fpdf_parser_parser.cpp in PDFium allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document. - CVE-2014-7901 (integer overflow) Integer overflow in the opj_t2_read_packet_data function in fxcodec/fx_libopenjpeg/libopenjpeg20/t2.c in OpenJPEG in PDFium allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long segment in a JPEG image. - CVE-2014-7902 (use-after-free) Use-after-free vulnerability in PDFium allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document. - CVE-2014-7903 (buffer overflow) Buffer overflow in OpenJPEG before r2911 in PDFium allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG image. - CVE-2014-7904 (buffer overflow) Buffer overflow in Skia allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. - CVE-2014-7906 (use-after-free) Use-after-free vulnerability in the Pepper plugins allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Flash content that triggers an attempted PepperMediaDeviceManager access outside of the object's lifetime. - CVE-2014-7907 (use-after-free) Multiple use-after-free vulnerabilities in modules/screen_orientation/ScreenOrientationController.cpp in Blink allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger improper handling of a detached frame, related to the (1) lock and (2) unlock methods. - CVE-2014-7908 (integer overflow) Multiple integer overflows in the CheckMov function in media/base/container_names.cc allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in (1) MPEG-4 or (2) QuickTime .mov data. - CVE-2014-7909 (uninitialized memory read) A flaw in effects/SkDashPathEffect.cpp in Skia computes a hash key using uninitialized integer values, which might allow remote attackers to cause a denial of service by rendering crafted data. - CVE-2014-7910 (various issues) Various issues from internal audits, fuzzing and other initiatives that allow attackers to cause a denial of service or possibly have other impact. Impact ====== A remote attacker is be able to spoof the address bar, cause a denial of service or possibly have unspecified other impacts. References ========== [0] http://googlechromereleases.blogspot.in/2014/11/stable-channel-update_18.ht… http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7899 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7900 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7901 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7902 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7903 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7904 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7906 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7907 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7908 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7909 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7910

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-25] drupal: session hijacking and denial of service
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-25 ========================================== Severity: Medium Date : 2014-11-20 CVE-ID : CVE-2014-9015 CVE-2014-9016 Package : drupal Type : session hijacking, denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package drupal before version 7.34-1 is vulnerable to multiple issues leading to session hijacking or denial of service. Resolution ========== Upgrade to 7.34-1. # pacman -Syu "drupal>=7.34-1" The problems have been fixed upstream in version 7.34. Workaround ========== None. Description =========== Custom configured session.inc and password.inc need to be audited as well to verify if they are prone to the following vulnerabilities. More information can be found in the upstream advisory [0]. - CVE-2014-9015 (session hijacking) Aaron Averill discovered that a specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session. - CVE-2014-9016 (denial of service) Michael Cullum, Javier Nieto and Andres Rojas Guerrero discovered that the password hashing API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive. Impact ====== A remote attacker is able to send specially crafted requests to hijack random sessions or exhaust the CPU and memory leading to denial of service. References ========== [0] https://www.drupal.org/SA-CORE-2014-006 https://access.redhat.com/security/cve/CVE-2014-9015 https://access.redhat.com/security/cve/CVE-2014-9016 http://seclists.org/oss-sec/2014/q4/697

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-24] wireshark-qt: denial of service
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-24 ========================================== Severity: Medium Date : 2014-11-20 CVE-ID : CVE-2014-8710 CVE-2014-8711 CVE-2014-8712 CVE-2014-8713 CVE-2014-8714 Package : wireshark-qt Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package wireshark-qt before version 1.12.2-1 is vulnerable to multiple issues leading to denial of service. Resolution ========== Upgrade to 1.12.2-1. # pacman -Syu "wireshark-qt>=1.12.2-1" The problems have been fixed upstream in version 1.12.2. Workaround ========== None. Description =========== - CVE-2014-8710 (out-of-bounds read) Out-of-bounds read flaw in the SigComp dissector (sigcomp-udvm) leads to denial of service while processing malformed packets. - CVE-2014-8711 (out-of-bounds read) The AMQP dissector is seeing a large value in the capture file for what it thinks should be a field specifying the number of elements in an array, resulting in undetected overflow (wrapping). - CVE-2014-8712 (stack buffer overflow) An issue in the NCP dissector while constructing strings may lead to incorrect data length, resulting in stack buffer overflow and denial of service. - CVE-2014-8713 (denial of service) An issue in the NCP dissector may lead to denial of service while accessing an uninitialized buffer. - CVE-2014-8714 (denial of service) A missing exit when the offset is not incremented in the tn5250 dissector is leading to an endless loop, resulting in denial of service. Impact ====== It may be possible to make wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://www.wireshark.org/lists/wireshark-users/201411/msg00004.html https://www.wireshark.org/security/wnpa-sec-2014-20.html https://www.wireshark.org/security/wnpa-sec-2014-21.html https://www.wireshark.org/security/wnpa-sec-2014-22.html https://www.wireshark.org/security/wnpa-sec-2014-23.html https://access.redhat.com/security/cve/CVE-2014-8710 https://access.redhat.com/security/cve/CVE-2014-8711 https://access.redhat.com/security/cve/CVE-2014-8712 https://access.redhat.com/security/cve/CVE-2014-8713 https://access.redhat.com/security/cve/CVE-2014-8714 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10662 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10582 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10552 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10628 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10596

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-23] wireshark-gtk: denial of service
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-23 ========================================== Severity: Medium Date : 2014-11-20 CVE-ID : CVE-2014-8710 CVE-2014-8711 CVE-2014-8712 CVE-2014-8713 CVE-2014-8714 Package : wireshark-gtk Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package wireshark-gtk before version 1.12.2-1 is vulnerable to multiple issues leading to denial of service. Resolution ========== Upgrade to 1.12.2-1. # pacman -Syu "wireshark-gtk>=1.12.2-1" The problems have been fixed upstream in version 1.12.2. Workaround ========== None. Description =========== - CVE-2014-8710 (out-of-bounds read) Out-of-bounds read flaw in the SigComp dissector (sigcomp-udvm) leads to denial of service while processing malformed packets. - CVE-2014-8711 (out-of-bounds read) The AMQP dissector is seeing a large value in the capture file for what it thinks should be a field specifying the number of elements in an array, resulting in undetected overflow (wrapping). - CVE-2014-8712 (stack buffer overflow) An issue in the NCP dissector while constructing strings may lead to incorrect data length, resulting in stack buffer overflow and denial of service. - CVE-2014-8713 (denial of service) An issue in the NCP dissector may lead to denial of service while accessing an uninitialized buffer. - CVE-2014-8714 (denial of service) A missing exit when the offset is not incremented in the tn5250 dissector is leading to an endless loop, resulting in denial of service. Impact ====== It may be possible to make wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://www.wireshark.org/lists/wireshark-users/201411/msg00004.html https://www.wireshark.org/security/wnpa-sec-2014-20.html https://www.wireshark.org/security/wnpa-sec-2014-21.html https://www.wireshark.org/security/wnpa-sec-2014-22.html https://www.wireshark.org/security/wnpa-sec-2014-23.html https://access.redhat.com/security/cve/CVE-2014-8710 https://access.redhat.com/security/cve/CVE-2014-8711 https://access.redhat.com/security/cve/CVE-2014-8712 https://access.redhat.com/security/cve/CVE-2014-8713 https://access.redhat.com/security/cve/CVE-2014-8714 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10662 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10582 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10552 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10628 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10596

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-22] wireshark-cli: denial of service
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-22 ========================================== Severity: Medium Date : 2014-11-20 CVE-ID : CVE-2014-8710 CVE-2014-8711 CVE-2014-8712 CVE-2014-8713 CVE-2014-8714 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package wireshark-cli before version 1.12.2-1 is vulnerable to multiple issues leading to denial of service. Resolution ========== Upgrade to 1.12.2-1. # pacman -Syu "wireshark-cli>=1.12.2-1" The problems have been fixed upstream in version 1.12.2. Workaround ========== None. Description =========== - CVE-2014-8710 (out-of-bounds read) Out-of-bounds read flaw in the SigComp dissector (sigcomp-udvm) leads to denial of service while processing malformed packets. - CVE-2014-8711 (out-of-bounds read) The AMQP dissector is seeing a large value in the capture file for what it thinks should be a field specifying the number of elements in an array, resulting in undetected overflow (wrapping). - CVE-2014-8712 (stack buffer overflow) An issue in the NCP dissector while constructing strings may lead to incorrect data length, resulting in stack buffer overflow and denial of service. - CVE-2014-8713 (denial of service) An issue in the NCP dissector may lead to denial of service while accessing an uninitialized buffer. - CVE-2014-8714 (denial of service) A missing exit when the offset is not incremented in the tn5250 dissector is leading to an endless loop, resulting in denial of service. Impact ====== It may be possible to make wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. References ========== https://www.wireshark.org/lists/wireshark-users/201411/msg00004.html https://www.wireshark.org/security/wnpa-sec-2014-20.html https://www.wireshark.org/security/wnpa-sec-2014-21.html https://www.wireshark.org/security/wnpa-sec-2014-22.html https://www.wireshark.org/security/wnpa-sec-2014-23.html https://access.redhat.com/security/cve/CVE-2014-8710 https://access.redhat.com/security/cve/CVE-2014-8711 https://access.redhat.com/security/cve/CVE-2014-8712 https://access.redhat.com/security/cve/CVE-2014-8713 https://access.redhat.com/security/cve/CVE-2014-8714 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10662 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10582 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10552 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10628 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10596

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-21] clamav: denial of service
by Levente Polyak 20 Nov '14

20 Nov '14

Arch Linux Security Advisory ASA-201411-21 ========================================== Severity: Low Date : 2014-11-20 CVE-ID : CVE-2013-6497 Package : clamav Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package clamav before version 0.98.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.98.5-1. # pacman -Syu "clamav>=0.98.5-1" The problem has been fixed upstream in version 0.98.5. Workaround ========== None. Description =========== It was discovered that clamav crashes on certain files when using 'clamscan -a' or while scanning maliciously crafted files. Impact ====== Certain JavaScript or specially crafted files processed by "clamscan" may lead to a segmentation fault resulting in denial of service. References ========== https://access.redhat.com/security/cve/CVE-2013-6497 https://bugzilla.clamav.net/show_bug.cgi?id=11088 http://seclists.org/oss-sec/2014/q4/673

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-20] avr-binutils: multiple issues
by Levente Polyak 19 Nov '14

19 Nov '14

Arch Linux Security Advisory ASA-201411-20 ========================================== Severity: Medium Date : 2014-11-19 CVE-ID : CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738 Package : avr-binutils Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package avr-binutils before version 2.24-3 is vulnerable to multiple issues including but not limited to denial of service, directory traversal, heap and stack overflow leading to possible code execution. Resolution ========== Upgrade to 2.24-3. # pacman -Syu "avr-binutils>=2.24-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-8484 (invalid read) Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 (out-of-bounds write) Lack of range checking leading to controlled write in _bfd_elf_setup_sections() which results in denial of service or possible code execution in programs using libbfd. - CVE-2014-8501 (out-of-bounds write) Out-of-bounds write when parsing specially crafted PE executable leads to denial of service in "strings", "nm" and "objdump". - CVE-2014-8502 (heap overflow) Heap buffer overflow when parsing specially crafted PE executable leads to denial of service in "objdump". - CVE-2014-8503 (stack overflow) Stack overflow in "objdump" when parsing specially crafted ihex files leads to denial of service or code execution. - CVE-2014-8504 (stack overflow) Stack overflow in the SREC parser leads to denial of service or code execution when parsing specially crafted files. - CVE-2014-8737 (directory traversal) Directory traversal vulnerability allowing arbitrary file deletion and creation. - CVE-2014-8738 (out-of-bounds write) Out-of-bounds memory write while processing a crafted "ar" archive leads to denial of service in "objdump". Impact ====== An attacker with specially crafted files can perform denial of service, directory traversal, heap and stack overflow leading to possible code execution. Programs using libbfd may also be remotely exploitable. References ========== https://access.redhat.com/security/cve/CVE-2014-8484 https://access.redhat.com/security/cve/CVE-2014-8485 https://access.redhat.com/security/cve/CVE-2014-8501 https://access.redhat.com/security/cve/CVE-2014-8502 https://access.redhat.com/security/cve/CVE-2014-8503 https://access.redhat.com/security/cve/CVE-2014-8504 https://access.redhat.com/security/cve/CVE-2014-8737 https://access.redhat.com/security/cve/CVE-2014-8738 http://seclists.org/oss-sec/2014/q4/424 http://seclists.org/oss-sec/2014/q4/599 https://bugs.archlinux.org/task/42773

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-19] mingw-w64-binutils: multiple issues
by Levente Polyak 19 Nov '14

19 Nov '14

Arch Linux Security Advisory ASA-201411-19 ========================================== Severity: Medium Date : 2014-11-19 CVE-ID : CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738 Package : mingw-w64-binutils Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package mingw-w64-binutils before version 2.24-2 is vulnerable to multiple issues including but not limited to denial of service, directory traversal, heap and stack overflow leading to possible code execution. Resolution ========== Upgrade to 2.24-2. # pacman -Syu "mingw-w64-binutils>=2.24-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-8484 (invalid read) Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 (out-of-bounds write) Lack of range checking leading to controlled write in _bfd_elf_setup_sections() which results in denial of service or possible code execution in programs using libbfd. - CVE-2014-8501 (out-of-bounds write) Out-of-bounds write when parsing specially crafted PE executable leads to denial of service in "strings", "nm" and "objdump". - CVE-2014-8502 (heap overflow) Heap buffer overflow when parsing specially crafted PE executable leads to denial of service in "objdump". - CVE-2014-8503 (stack overflow) Stack overflow in "objdump" when parsing specially crafted ihex files leads to denial of service or code execution. - CVE-2014-8504 (stack overflow) Stack overflow in the SREC parser leads to denial of service or code execution when parsing specially crafted files. - CVE-2014-8737 (directory traversal) Directory traversal vulnerability allowing arbitrary file deletion and creation. - CVE-2014-8738 (out-of-bounds write) Out-of-bounds memory write while processing a crafted "ar" archive leads to denial of service in "objdump". Impact ====== An attacker with specially crafted files can perform denial of service, directory traversal, heap and stack overflow leading to possible code execution. Programs using libbfd may also be remotely exploitable. References ========== https://access.redhat.com/security/cve/CVE-2014-8484 https://access.redhat.com/security/cve/CVE-2014-8485 https://access.redhat.com/security/cve/CVE-2014-8501 https://access.redhat.com/security/cve/CVE-2014-8502 https://access.redhat.com/security/cve/CVE-2014-8503 https://access.redhat.com/security/cve/CVE-2014-8504 https://access.redhat.com/security/cve/CVE-2014-8737 https://access.redhat.com/security/cve/CVE-2014-8738 http://seclists.org/oss-sec/2014/q4/424 http://seclists.org/oss-sec/2014/q4/599 https://bugs.archlinux.org/task/42773

1 0