- Arch-security - lists.archlinux.org

[ASA-201810-7] git: arbitrary code execution
by Remi Gacogne 09 Oct '18

09 Oct '18

Arch Linux Security Advisory ASA-201810-7 ========================================= Severity: High Date : 2018-10-09 CVE-ID : CVE-2018-17456 Package : git Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-776 Summary ======= The package git before version 2.19.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.19.1-1. # pacman -Syu "git>=2.19.1-1" The problem has been fixed upstream in version 2.19.1. Workaround ========== None. Description =========== A security issue has been found in git versions prior to 2.19.1, which allows an attacker to execute arbitrary code by crafting a malicious .gitmodules file in a project cloned with --recurse-submodules. When running "git clone --recurse-submodules", Git parses the supplied .gitmodules file for a URL field and blindly passes it as an argument to a "git clone" subprocess. If the URL field is set to a string that begins with a dash, this "git clone" subprocess interprets the URL as an option. This can lead to executing an arbitrary script shipped in the superproject as the user who ran "git clone". Impact ====== A remote attacker can execute arbitrary code on the affected host by convincing a local user to clone a specially crafted git repository and its sub-modules. References ========== https://marc.info/?l=git&m=153875888916397&w=2 https://git.kernel.org/pub/scm/git/git.git/commit/?id=98afac7a7cefdca0d2c49… https://git.kernel.org/pub/scm/git/git.git/commit/?id=f6adec4e329ef0e25e14c… https://git.kernel.org/pub/scm/git/git.git/commit/?id=273c61496f88c6495b886… https://security.archlinux.org/CVE-2018-17456

1 0

[ASA-201810-6] firefox: multiple issues
by Remi Gacogne 04 Oct '18

04 Oct '18

Arch Linux Security Advisory ASA-201810-6 ========================================= Severity: Critical Date : 2018-10-04 CVE-ID : CVE-2018-12386 CVE-2018-12387 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-775 Summary ======= The package firefox before version 62.0.3-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 62.0.3-1. # pacman -Syu "firefox>=62.0.3-1" The problems have been fixed upstream in version 62.0.3. Workaround ========== None. Description =========== - CVE-2018-12386 (arbitrary code execution) A vulnerability has been found in Firefox before 62.0.3 in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. - CVE-2018-12387 (information disclosure) A vulnerability has been found in Firefox before 62.0.3 where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. Impact ====== A remote attacker can execute arbitrary code on the affected host via crafted Javascript code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1493900 https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/#CVE-2018-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1493903 https://security.archlinux.org/CVE-2018-12386 https://security.archlinux.org/CVE-2018-12387

1 0

[ASA-201810-5] python-django: information disclosure
by Jelle van der Waa 03 Oct '18

03 Oct '18

Arch Linux Security Advisory ASA-201810-5 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-16984 Package : python-django Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-773 Summary ======= The package python-django before version 2.1.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.1.2-1. # pacman -Syu "python-django>=2.1.2-1" The problem has been fixed upstream in version 2.1.2. Workaround ========== None. Description =========== If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view (but not change) permission to the user model were displayed the entire hash. While it's typically infeasible to reverse a strong password hash, if your site uses weaker password hashing algorithms such as MD5 or SHA1, it could be a problem. Impact ====== A remote authenticated administrator with change permissions is able to obtain the password hashes of users. References ========== https://www.djangoproject.com/weblog/2018/oct/01/security-release/ https://github.com/django/django/commit/c4bd5b597e0aa2432e4c867b86650f18af1… https://security.archlinux.org/CVE-2018-16984

1 0

[ASA-201810-4] lib32-libxml2: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-4 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : lib32-libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-673 Summary ======= The package lib32-libxml2 before version 2.9.8-4 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.8-4. # pacman -Syu "lib32-libxml2>=2.9.8-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in libxml2 <= 2.9.8 compiled with LZMA support enabled, in the xz_decomp function in xzlib.c. This flaw allows a remote attacker to cause a denial of service via an infinite loop, using a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR. Impact ====== A remote attacker is able to cause a denial of service by parsing a specially crafted XML payload. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=794914 https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e263… https://security.archlinux.org/CVE-2018-9251

1 0

[ASA-201810-3] libxml2: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-3 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-672 Summary ======= The package libxml2 before version 2.9.8-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.8-5. # pacman -Syu "libxml2>=2.9.8-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in libxml2 <= 2.9.8 compiled with LZMA support enabled, in the xz_decomp function in xzlib.c. This flaw allows a remote attacker to cause a denial of service via an infinite loop, using a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR. Impact ====== A remote attacker is able to cause a denial of service by parsing a specially crafted XML payload. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=794914 https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e263… https://security.archlinux.org/CVE-2018-9251

1 0

[ASA-201810-3] libxml2: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-3 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-672 Summary ======= The package libxml2 before version 2.9.8-5 is vulnerable to denial of service. Resolution ========== Upgrade to 2.9.8-5. # pacman -Syu "libxml2>=2.9.8-5" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A security issue has been found in libxml2 <= 2.9.8 compiled with LZMA support enabled, in the xz_decomp function in xzlib.c. This flaw allows a remote attacker to cause a denial of service via an infinite loop, using a crafted XML payload that triggers LZMA_MEMLIMIT_ERROR. Impact ====== A remote attacker is able to cause a denial of service by parsing a specially crafted XML payload. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=794914 https://gitlab.gnome.org/GNOME/libxml2/commit/2240fbf5912054af025fb6e01e263… https://security.archlinux.org/CVE-2018-9251

1 0

[ASA-201810-2] ntp: arbitrary code execution
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-2 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-12327 Package : ntp Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-723 Summary ======= The package ntp before version 4.2.8.p12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.2.8.p12-1. # pacman -Syu "ntp>=4.2.8.p12-1" The problem has been fixed upstream in version 4.2.8.p12. Workaround ========== None. Description =========== Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. Impact ====== A local attacker is able to execute arbitrary code via specially crafted command line options. References ========== https://gist.github.com/fakhrizulkifli/9b58ed8e0354e8deee50b0eebd1c011f http://bk.ntp.org/ntp-stable/?PAGE=patch&REV=5b3ba863G-42Ac2TFzCy-PZ8vqNfVA https://security.archlinux.org/CVE-2018-12327

1 0

[ASA-201810-1] mosquitto: denial of service
by Jelle van der Waa 01 Oct '18

01 Oct '18

Arch Linux Security Advisory ASA-201810-1 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-12543 Package : mosquitto Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-772 Summary ======= The package mosquitto before version 1.5.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.5.3-1. # pacman -Syu "mosquitto>=1.5.3-1" The problem has been fixed upstream in version 1.5.3. Workaround ========== None. Description =========== If a message is sent to Mosquitto before 1.5.3 with a topic that begins with $, but is not $SYS, then an assert that should be unreachable is triggered and Mosquitto will exit. Impact ====== A remote attacker is able to cause a denial of service by sending a specially crafted mqtt message. References ========== https://mosquitto.org/blog/2018/09/security-advisory-cve-2018-12543/ https://github.com/eclipse/mosquitto/commit/f7474d348225bf086f6b9c69b18d641… https://security.archlinux.org/CVE-2018-12543

1 0

[ASA-201809-5] mediawiki: multiple issues
by Jelle van der Waa 28 Sep '18

28 Sep '18

Arch Linux Security Advisory ASA-201809-5 ========================================= Severity: Medium Date : 2018-09-25 CVE-ID : CVE-2018-0503 CVE-2018-0505 CVE-2018-13258 Package : mediawiki Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-765 Summary ======= The package mediawiki before version 1.31.1-1 is vulnerable to multiple issues including access restriction bypass and information disclosure. Resolution ========== Upgrade to 1.31.1-1. # pacman -Syu "mediawiki>=1.31.1-1" The problems have been fixed upstream in version 1.31.1. Workaround ========== None. Description =========== - CVE-2018-0503 (access restriction bypass) A security issue has been found in the rate limiting feature of mediawiki < 1.31.1 where, contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'. - CVE-2018-0505 (access restriction bypass) A security issue has been found in mediawiki < 1.31.1 where BotPassword can bypass CentralAuth's account lock. - CVE-2018-13258 (information disclosure) A security issue has been found in mediawiki < 1.31.1 where the tarball is missing .htaccess files used to protect some directories that shouldn't be web accessible. Impact ====== A remote attacker is able to bypass access restrictions put in place by the site administrator and/or gain access to restricted content. References ========== https://www.mediawiki.org/wiki/Release_notes/1.31 https://phabricator.wikimedia.org/T169545 https://github.com/wikimedia/mediawiki/commit/befd48c5f7d3d073de96c87375d73… https://phabricator.wikimedia.org/T194605 https://github.com/wikimedia/mediawiki/commit/ff6b4cb35c1944870fcd3cc525884… https://phabricator.wikimedia.org/T199029 https://github.com/wikimedia/mediawiki/commit/b78d595feecf9de919258b659628c… https://security.archlinux.org/CVE-2018-0503 https://security.archlinux.org/CVE-2018-0505 https://security.archlinux.org/CVE-2018-13258

1 0

[ASA-201809-4] strongswan: authentication bypass
by Jelle van der Waa 25 Sep '18

25 Sep '18

Arch Linux Security Advisory ASA-201809-4 ========================================= Severity: High Date : 2018-09-24 CVE-ID : CVE-2018-16151 CVE-2018-16152 Package : strongswan Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-769 Summary ======= The package strongswan before version 5.7.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 5.7.0-1. # pacman -Syu "strongswan>=5.7.0-1" The problems have been fixed upstream in version 5.7.0. Workaround ========== If the gmp plugin is loaded, make sure that none of the employed keys and certificates (including those of CAs) use keys with e = 3. Strongswan's tool to generate keys (pki --gen) always used e = 65537 (0x10001), which is not vulnerable, so certificates and keys generated with this tool are fine for use even with an unpatched gmp plugin. Description =========== - CVE-2018-16151 (authentication bypass) The OID parser allows any number of random bytes after a valid OID for a PKCS#1.5 signature. The asn1_known_oid() function just parses until it finds a leaf in the tree of known OIDs, any further data that follows is simply ignored. And the function that parses ASN.1 algorithmIdentifier structures doesn't care if the full OID data was parsed as it usually doesn't really matter. A missing check to reject junk and random key parameters allows attackers to carry out a Bleichenbacher-style attack on low-exponent keys and create forged signatures. - CVE-2018-16152 (authentication bypass) The algorithmIdentifier structure on a PKCS#1.5 signature contains an optional parameters field. While none of the algorithms used with PKCS#1 use parameters, i.e. the field should always be encoded as ASN.1 NULL value, the strongswan decoder doesn't enforce this and simply skips over the parameters. This allows an attacker to fill the field with random data which allows to carry out a Bleichenbacher-style attack on low-exponent keys and forge signatures or create arbitrary CA certificates. Impact ====== An attacker is able to use non-validated fields on a maliciously- crafted file to forge a signature or a CA certificate. References ========== https://wiki.strongswan.org/versions/70 https://github.com/strongswan/strongswan/commit/5955db5b124a1ee5f44c0845b6e… https://security.archlinux.org/CVE-2018-16151 https://security.archlinux.org/CVE-2018-16152

1 0