- Arch-security - lists.archlinux.org

[arch-security] [Arch Linux Security Advisory ASA-201411-18] arm-none-eabi-binutils: multiple issues
by Levente Polyak 19 Nov '14

19 Nov '14

Arch Linux Security Advisory ASA-201411-18 ========================================== Severity: Medium Date : 2014-11-19 CVE-ID : CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738 Package : arm-none-eabi-binutils Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package arm-none-eabi-binutils before version 2.24-3 is vulnerable to multiple issues including but not limited to denial of service, directory traversal, heap and stack overflow leading to possible code execution. Resolution ========== Upgrade to 2.24-3. # pacman -Syu "arm-none-eabi-binutils>=2.24-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-8484 (invalid read) Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 (out-of-bounds write) Lack of range checking leading to controlled write in _bfd_elf_setup_sections() which results in denial of service or possible code execution in programs using libbfd. - CVE-2014-8501 (out-of-bounds write) Out-of-bounds write when parsing specially crafted PE executable leads to denial of service in "strings", "nm" and "objdump". - CVE-2014-8502 (heap overflow) Heap buffer overflow when parsing specially crafted PE executable leads to denial of service in "objdump". - CVE-2014-8503 (stack overflow) Stack overflow in "objdump" when parsing specially crafted ihex files leads to denial of service or code execution. - CVE-2014-8504 (stack overflow) Stack overflow in the SREC parser leads to denial of service or code execution when parsing specially crafted files. - CVE-2014-8737 (directory traversal) Directory traversal vulnerability allowing arbitrary file deletion and creation. - CVE-2014-8738 (out-of-bounds write) Out-of-bounds memory write while processing a crafted "ar" archive leads to denial of service in "objdump". Impact ====== An attacker with specially crafted files can perform denial of service, directory traversal, heap and stack overflow leading to possible code execution. Programs using libbfd may also be remotely exploitable. References ========== https://access.redhat.com/security/cve/CVE-2014-8484 https://access.redhat.com/security/cve/CVE-2014-8485 https://access.redhat.com/security/cve/CVE-2014-8501 https://access.redhat.com/security/cve/CVE-2014-8502 https://access.redhat.com/security/cve/CVE-2014-8503 https://access.redhat.com/security/cve/CVE-2014-8504 https://access.redhat.com/security/cve/CVE-2014-8737 https://access.redhat.com/security/cve/CVE-2014-8738 http://seclists.org/oss-sec/2014/q4/424 http://seclists.org/oss-sec/2014/q4/599 https://bugs.archlinux.org/task/42773

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-17] binutils: multiple issues
by Levente Polyak 19 Nov '14

19 Nov '14

Arch Linux Security Advisory ASA-201411-17 ========================================== Severity: Medium Date : 2014-11-19 CVE-ID : CVE-2014-8484 CVE-2014-8485 CVE-2014-8501 CVE-2014-8502 CVE-2014-8503 CVE-2014-8504 CVE-2014-8737 CVE-2014-8738 Package : binutils Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package binutils before version 2.24-8 is vulnerable to multiple issues including but not limited to denial of service, directory traversal, heap and stack overflow leading to possible code execution. Resolution ========== Upgrade to 2.24-8. # pacman -Syu "binutils>=2.24-8" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-8484 (invalid read) Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 (out-of-bounds write) Lack of range checking leading to controlled write in _bfd_elf_setup_sections() which results in denial of service or possible code execution in programs using libbfd. - CVE-2014-8501 (out-of-bounds write) Out-of-bounds write when parsing specially crafted PE executable leads to denial of service in "strings", "nm" and "objdump". - CVE-2014-8502 (heap overflow) Heap buffer overflow when parsing specially crafted PE executable leads to denial of service in "objdump". - CVE-2014-8503 (stack overflow) Stack overflow in "objdump" when parsing specially crafted ihex files leads to denial of service or code execution. - CVE-2014-8504 (stack overflow) Stack overflow in the SREC parser leads to denial of service or code execution when parsing specially crafted files. - CVE-2014-8737 (directory traversal) Directory traversal vulnerability allowing arbitrary file deletion and creation. - CVE-2014-8738 (out-of-bounds write) Out-of-bounds memory write while processing a crafted "ar" archive leads to denial of service in "objdump". Impact ====== An attacker with specially crafted files can perform denial of service, directory traversal, heap and stack overflow leading to possible code execution. Programs using libbfd may also be remotely exploitable. References ========== https://access.redhat.com/security/cve/CVE-2014-8484 https://access.redhat.com/security/cve/CVE-2014-8485 https://access.redhat.com/security/cve/CVE-2014-8501 https://access.redhat.com/security/cve/CVE-2014-8502 https://access.redhat.com/security/cve/CVE-2014-8503 https://access.redhat.com/security/cve/CVE-2014-8504 https://access.redhat.com/security/cve/CVE-2014-8737 https://access.redhat.com/security/cve/CVE-2014-8738 http://seclists.org/oss-sec/2014/q4/424 http://seclists.org/oss-sec/2014/q4/599 https://bugs.archlinux.org/task/42773

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-16] ruby: denial of service
by Levente Polyak 17 Nov '14

17 Nov '14

Arch Linux Security Advisory ASA-201411-16 ========================================== Severity: Medium Date : 2014-11-17 CVE-ID : CVE-2014-8090 Package : ruby Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package ruby before version 2.1.5-1 is vulnerable to denial service through unrestricted XML entity expansion. Resolution ========== Upgrade to 2.1.5-1. # pacman -Syu "ruby>=2.1.5-1" The problem has been fixed upstream in version 2.1.5. Workaround ========== If you cannot upgrade Ruby, use this monkey patch as a workaround: class REXML::Document def document self end end Description =========== CPU exhaustion can occur as a result of recursive expansion with an empty string. When reading text nodes from an XML document, the REXML parser can be coerced into allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service. Impact ====== A remote attacker using an specially crafted XML document is able to perform denial of service through CPU and/or memory exhaustion. References ========== https://www.ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090/ https://access.redhat.com/security/cve/CVE-2014-8090

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-15] linux-lts: local denial of service, privilege escalation
by Remi Gacogne 17 Nov '14

17 Nov '14

Arch Linux Security Advisory ASA-201411-15 ========================================== Severity: Medium Date : 2014-11-17 CVE-ID : CVE-2014-3610, CVE-2014-3611, CVE-2014-3646, CVE-2014-3647, CVE-2014-7825, CVE-2014-7826, CVE-2014-8369 Package : linux-lts Type : local denial of service, privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package linux-lts before version 3.14.24-1 is vulnerable to local denial service and privilege escalation via various issues. Resolution ========== Upgrade to 3.14.24-1. # pacman -Syu "linux-lts>=3.14.24-1" The problem has been fixed upstream in version 3.14.24. Workaround ========== None. Description =========== CVE-2014-3610: The WRMSR processing functionality in the KVM subsystem in the Linux kernel does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. CVE-2014-3611: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation. CVE-2014-3646: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-7825: kernel/trace/trace_syscalls.c in the Linux kernel does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application. CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2014-8369: The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601. Impact ====== A local OS user may be able to cause a kernel crash in various ways, or escalate privileges. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3610 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3611 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3646 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3647 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7825 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7826 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8369 http://permalink.gmane.org/gmane.comp.security.oss.general/14526

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-14] linux: local denial of service, privilege escalation
by Remi Gacogne 17 Nov '14

17 Nov '14

Arch Linux Security Advisory ASA-201411-14 ========================================== Severity: Medium Date : 2014-11-17 CVE-ID : CVE-2014-3610, CVE-2014-3611, CVE-2014-3646, CVE-2014-3647, CVE-2014-7825, CVE-2014-7826, CVE-2014-8369, CVE-2014-8480, CVE-2014-8481 Package : linux Type : local denial of service, privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package linux before version 3.17.3-1 is vulnerable to local denial service and privilege escalation via various issues. Resolution ========== Upgrade to 3.17.3-1. # pacman -Syu "linux>=3.17.3-1" The problem has been fixed upstream in version 3.17.3. Workaround ========== None. Description =========== CVE-2014-3610: The WRMSR processing functionality in the KVM subsystem in the Linux kernel does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. CVE-2014-3611: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation. CVE-2014-3646: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. CVE-2014-7825: kernel/trace/trace_syscalls.c in the Linux kernel does not properly handle private syscall numbers during use of the perf subsystem, which allows local users to cause a denial of service (out-of-bounds read and OOPS) or bypass the ASLR protection mechanism via a crafted application. CVE-2014-7826: kernel/trace/trace_syscalls.c in the Linux kernel through 3.17.2 does not properly handle private syscall numbers during use of the ftrace subsystem, which allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via a crafted application. CVE-2014-8369: The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601. CVE-2014-8480: The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel lacks intended decoder-table flags for certain RIP-relative instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application. CVE-2014-8481: The instruction decoder in arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel does not properly handle invalid instructions, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via a crafted application that triggers (1) an improperly fetched instruction or (2) an instruction that occupies too many bytes. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8480. Impact ====== A local OS user may be able to cause a kernel crash in various ways, or escalate privileges. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3610 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3611 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3646 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3647 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7825 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7826 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8369 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8480 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8481 http://permalink.gmane.org/gmane.comp.security.oss.general/14526

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-13] php: denial of service
by Levente Polyak 13 Nov '14

13 Nov '14

Arch Linux Security Advisory ASA-201411-13 ========================================== Severity: Medium Date : 2014-11-13 CVE-ID : CVE-2014-3710 Package : php Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package php before version 5.6.3-1 is vulnerable to denial of service through out-of-bounds read. Resolution ========== Upgrade to 5.6.3-1. # pacman -Syu "php>=5.6.3-1" The problem has been fixed upstream [0] in version 5.6.3. Workaround ========== None. Description =========== An out-of-bounds read flaw was found in the way the file information (fileinfo) extension parsed executable and linkable format (ELF) files. Impact ====== A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted ELF file. References ========== [0] http://git.php.net/?p=php-src.git;a=patch;h=180322 https://access.redhat.com/security/cve/CVE-2014-3710 https://bugzilla.redhat.com/show_bug.cgi?id=1155071 https://bugs.archlinux.org/task/42764 https://bugs.php.net/bug.php?id=68283

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-12] imagemagick: denial of service
by Remi Gacogne 13 Nov '14

13 Nov '14

Arch Linux Security Advisory ASA-201411-12 ========================================== Severity: Low Date : 2014-11-13 CVE-ID : CVE-2014-8716 Package : imagemagick Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package imagemagick before version 6.8.9.10-1 is vulnerable to denial of service. Resolution ========== Upgrade to 6.8.9.10-1. # pacman -Syu "imagemagick>=6.8.9.10-1" The problem has been fixed upstream in version 6.8.9.10. Workaround ========== None. Description =========== Converting some specially crafted jpeg with convert could lead to a dos. Impact ====== An attacker capable of submitting a specially crafted jpeg passed to the convert command would be able to cause a crash resulting from an out-of-bound read. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8716 http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26456 http://seclists.org/oss-sec/2014/q4/569

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-11] flashplugin: remote code execution
by Remi Gacogne 13 Nov '14

13 Nov '14

Arch Linux Security Advisory ASA-201411-11 ========================================== Severity: Critical Date : 2014-11-13 CVE-ID : CVE-2014-0573, CVE-2014-0574, CVE-2014-0576, CVE-2014-0577, CVE-2014-0581, CVE-2014-0582, CVE-2014-0583, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0588, CVE-2014-0589, CVE-2014-0590, CVE-2014-8437, CVE-2014-8438, CVE-2014-8440, CVE-2014-8441, CVE-2014-8442 Package : flashplugin Type : remote code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package flashplugin before version 11.2.202.418-1 is vulnerable to multiple flaws, allowing arbitrary remote code execution. Resolution ========== Upgrade to 11.2.202.418-1. # pacman -Syu "flashplugin>=11.2.202.418-1" The problem has been fixed upstream in version 11.2.202.418. Workaround ========== Disable or remove the flash plugin. Description =========== These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2014-0576, CVE-2014-0581, CVE-2014-8440, CVE-2014-8441). These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2014-0573, CVE-2014-0588, CVE-2014-8438). These updates resolve a double free vulnerability that could lead to code execution (CVE-2014-0574). These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2014-0577, CVE-2014-0584, CVE-2014-0585, CVE-2014-0586, CVE-2014-0590). These updates resolve heap buffer overflow vulnerabilities that could lead to code execution (CVE-2014-0582, CVE-2014-0589). These updates resolve an information disclosure vulnerability that could be exploited to disclose session tokens (CVE-2014-8437). These updates resolve a heap buffer overflow vulnerability that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-0583). These updates resolve a permission issue that could be exploited to perform privilege escalation from low to medium integrity level (CVE-2014-8442). Impact ====== A remote attacker in position of a man-in-the-middle or a malicious website can remotely execute arbitrary code with the privileges of the current user. References ========== https://helpx.adobe.com/security/products/flash-player/apsb14-24.html https://bugs.archlinux.org/task/42769 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0573 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0574 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0576 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0577 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0581 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0582 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0583 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0584 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0585 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0586 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0588 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0589 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0590 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8437 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8438 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8440 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8441 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8442

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-10] gnutls: out-of-bounds memory write
by Levente Polyak 12 Nov '14

12 Nov '14

Arch Linux Security Advisory ASA-201411-10 ========================================== Severity: Medium Date : 2014-11-12 CVE-ID : CVE-2014-8564 Package : gnutls Type : out-of-bounds memory write Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package gnutls before version 3.3.10-1 is vulnerable to out-of-bounds memory write resulting in denial of service or possibly code execution. Resolution ========== Upgrade to 3.3.10-1. # pacman -Syu "gnutls>=3.3.10-1" The problems have been fixed upstream [0] in version 3.3.10. Workaround ========== None. Description =========== An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR) resulting in heap corruption. Impact ====== A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application. References ========== [0] https://gitorious.org/gnutls/gnutls/commit/e821e19 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8564 http://www.gnutls.org/security.html#GNUTLS-SA-2014-5 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8564

1 0

[arch-security] [Arch Linux Security Advisory ASA-201411-9] file: denial of service through out-of-bounds read
by Levente Polyak 12 Nov '14

12 Nov '14

Arch Linux Security Advisory ASA-201411-9 ========================================= Severity: Medium Date : 2014-11-12 CVE-ID : CVE-2014-3710 Package : file Type : denial of service through out-of-bounds read Remote : No Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package file before version 5.20-2 is vulnerable to denial of service through out-of-bounds read. Resolution ========== Upgrade to 5.20-2. # pacman -Syu "file>=5.20-2" The problems have been fixed upstream [0] but no release version is available yet. Workaround ========== None. Description =========== An out-of-bounds read flaw was found in file's donote() function in the way the file utility determined the note headers of a elf file. This could possibly lead to file executable crash. Impact ====== A specially crafted elf file may lead to out-of-bounds read while parsing the note headers and lead to file executable crash. As readelf in file is widely used this could possibly lead to denial of service of middleware relying on it. References ========== [0] https://github.com/file/file/commit/39c7ac1106 https://access.redhat.com/security/cve/CVE-2014-3710 https://bugzilla.redhat.com/show_bug.cgi?id=1155071 https://bugs.archlinux.org/task/42759

1 0