- Arch-security - lists.archlinux.org

[ASA-201806-11] pass: arbitrary code execution
by Santiago Torres-Arias 19 Jun '18

19 Jun '18

Arch Linux Security Advisory ASA-201806-11 ========================================== Severity: High Date : 2018-06-19 CVE-ID : CVE-2018-12356 Package : pass Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-720 Summary ======= The package pass before version 1.7.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.7.2-1. # pacman -Syu "pass>=1.7.2-1" The problem has been fixed upstream in version 1.7.2. Workaround ========== You can make sure arbitrary code execution is not possible by disabling pass's extension facility: export PASSWORD_STORE_ENABLE_EXTENSIONS=false Description =========== An issue was discovered in password-store.sh in pass in Simple Password Store 1.7 through 1.7.1. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extensions scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution. Impact ====== A remote attacker is able to bypass signature verification and register arbitrary keys for an account or execute arbitrary code on the host by providing the application a crafted pgp signature packet. References ========== https://neopg.io/blog/pass-signature-spoof/ https://marc.info/?l=oss-security&m=152901317028506 https://github.com/zx2c4/password-store/commit/8683403b77f59c56fcb1f05c61ab… https://security.archlinux.org/CVE-2018-12356

1 0

[ASA-201806-10] libgcrypt: private key recovery
by Morten Linderud 18 Jun '18

18 Jun '18

Arch Linux Security Advisory ASA-201806-10 ========================================== Severity: High Date : 2018-06-16 CVE-ID : CVE-2018-0495 Package : libgcrypt Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-719 Summary ======= The package libgcrypt before version 1.8.3-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 1.8.3-1. # pacman -Syu "libgcrypt>=1.8.3-1" The problem has been fixed upstream in version 1.8.3. Workaround ========== None. Description =========== An implementation flaw has been discovered in multiple cryptographic libraries that allows a side-channel based attacker to recover ECDSA or DSA private keys. When these cryptographic libraries use the private key to create a signature, such as for a TLS or SSH connection, they inadvertently leak information through memory caches. An unprivileged attacker running on the same machine can collect the information from a few thousand signatures and recover the value of the private key. Impact ====== An unprivileged user might be able to retrieve private keys on the affected host. References ========== https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=901… https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the… https://security.archlinux.org/CVE-2018-0495

1 0

[ASA-201806-9] chromium: arbitrary code execution
by Remi Gacogne 14 Jun '18

14 Jun '18

Arch Linux Security Advisory ASA-201806-9 ========================================= Severity: High Date : 2018-06-13 CVE-ID : CVE-2018-6149 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-717 Summary ======= The package chromium before version 67.0.3396.87-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 67.0.3396.87-1. # pacman -Syu "chromium>=67.0.3396.87-1" The problem has been fixed upstream in version 67.0.3396.87. Workaround ========== None. Description =========== An out of bounds write has been found in the V8 component of the chromium browser before 67.0.3396.87. Impact ====== A remote attacker can execute arbitrary code on the affected host via a website containing specially crafted Javascript code. References ========== https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-des… https://crbug.com/848672 https://security.archlinux.org/CVE-2018-6149

1 0

[ASA-201806-8] gnupg: content spoofing
by Remi Gacogne 14 Jun '18

14 Jun '18

Arch Linux Security Advisory ASA-201806-8 ========================================= Severity: High Date : 2018-06-11 CVE-ID : CVE-2018-12020 Package : gnupg Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-713 Summary ======= The package gnupg before version 2.2.8-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 2.2.8-1. # pacman -Syu "gnupg>=2.2.8-1" The problem has been fixed upstream in version 2.2.8. Workaround ========== None. Description =========== A security issue has been found in gnupg before 2.2.8, leading to the possibility of faking verification status of signed content. The OpenPGP protocol allows to include the file name of the original input file into a signed or encrypted message. During decryption and verification the GPG tool can display a notice with that file name. The displayed file name is not sanitized and as such may include line feeds or other control characters. This can be used inject terminal control sequences into the out and, worse, to fake the so-called status messages. These status messages are parsed by programs to get information from gpg about the validity of a signature and an other parameters. Status messages are created with the option "--status-fd N" where N is a file descriptor. Now if N is 2 the status messages and the regular diagnostic messages share the stderr output channel. By using a made up file name in the message it is possible to fake status messages. Using this technique it is for example possible to fake the verification status of a signed mail. Impact ====== A remote attacker might be able to fake the verification status of a signed e-mail or file, via a crafted file name. References ========== https://bugs.archlinux.org/task/58931 https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html https://dev.gnupg.org/T4012 https://dev.gnupg.org/rG210e402acd3e284b32db1901e43bf1470e659e49 https://security.archlinux.org/CVE-2018-12020

1 0

[ASA-201806-7] flashplugin: multiple issues
by Remi Gacogne 10 Jun '18

10 Jun '18

Arch Linux Security Advisory ASA-201806-7 ========================================= Severity: Critical Date : 2018-06-09 CVE-ID : CVE-2018-4945 CVE-2018-5000 CVE-2018-5001 CVE-2018-5002 Package : flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-716 Summary ======= The package flashplugin before version 30.0.0.113-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 30.0.0.113-1. # pacman -Syu "flashplugin>=30.0.0.113-1" The problems have been fixed upstream in version 30.0.0.113. Workaround ========== None. Description =========== - CVE-2018-4945 (arbitrary code execution) A type confusion issue has been found in Adobe Flash Player before 30.0.0.113, leading to arbitrary code execution. - CVE-2018-5000 (information disclosure) An integer overflow issue has been found in Adobe Flash Player before 30.0.0.113, leading to information disclosure. - CVE-2018-5001 (information disclosure) An out-of-bounds read has been found in Adobe Flash Player before 30.0.0.113, leading to information disclosure. - CVE-2018-5002 (arbitrary code execution) A stack-based buffer overflow has been found in Adobe Flash Player before 30.0.0.113, leading to arbitrary code execution. Impact ====== A remote attacker can access sensitive information or execute arbitrary code via a crafted Flash file. References ========== https://helpx.adobe.com/security/products/flash-player/apsb18-19.html https://security.archlinux.org/CVE-2018-4945 https://security.archlinux.org/CVE-2018-5000 https://security.archlinux.org/CVE-2018-5001 https://security.archlinux.org/CVE-2018-5002

1 0

[ASA-201806-6] p7zip: arbitrary code execution
by Remi Gacogne 10 Jun '18

10 Jun '18

Arch Linux Security Advisory ASA-201806-6 ========================================= Severity: Critical Date : 2018-06-09 CVE-ID : CVE-2018-10115 Package : p7zip Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-714 Summary ======= The package p7zip before version 16.02-5 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 16.02-5. # pacman -Syu "p7zip>=16.02-5" The problem has been fixed upstream in version 18.05. Workaround ========== None. Description =========== An uninitialized memory security issue has been found in the RAR decoder component of 7-Zip before 18.05, resulting in arbitrary code execution. Impact ====== A remote attacker can execute arbitrary code via a crafted RAR file. References ========== https://bugs.archlinux.org/task/58907 https://landave.io/2018/05/7-zip-from-uninitialized-memory-to-remote-code-e… https://landave.io/files/patch_7zip_CVE-2018-10115.txt https://security.archlinux.org/CVE-2018-10115

1 0

[ASA-201806-5] firefox: arbitrary code execution
by Remi Gacogne 10 Jun '18

10 Jun '18

Arch Linux Security Advisory ASA-201806-5 ========================================= Severity: High Date : 2018-06-08 CVE-ID : CVE-2018-6126 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-715 Summary ======= The package firefox before version 60.0.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 60.0.2-1. # pacman -Syu "firefox>=60.0.2-1" The problem has been fixed upstream in version 60.0.2. Workaround ========== None. Description =========== A heap-based buffer overflow has been found in the Skia component of the Firefox browser before 60.0.2, when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. Impact ====== A remote attacker can execute arbitrary code via a crafted SVG file. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/ https://www.mozilla.org/en-US/security/advisories/mfsa2018-14/#CVE-2018-6126 https://bugzilla.mozilla.org/show_bug.cgi?id=1462682 https://security.archlinux.org/CVE-2018-6126

1 0

[ASA-201806-4] chromium: access restriction bypass
by Remi Gacogne 09 Jun '18

09 Jun '18

Arch Linux Security Advisory ASA-201806-4 ========================================= Severity: High Date : 2018-06-07 CVE-ID : CVE-2018-6148 Package : chromium Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-712 Summary ======= The package chromium before version 67.0.3396.79-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 67.0.3396.79-1. # pacman -Syu "chromium>=67.0.3396.79-1" The problem has been fixed upstream in version 67.0.3396.79. Workaround ========== None. Description =========== An incorrect handling of CSP header has been found in chromium before 67.0.3396.79. Impact ====== A remote attacker can bypass the content security policy. References ========== https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-des… https://crbug.com/845961 https://security.archlinux.org/CVE-2018-6148

1 0

[ASA-201806-3] krb5: insufficient validation
by Remi Gacogne 09 Jun '18

09 Jun '18

Arch Linux Security Advisory ASA-201806-3 ========================================= Severity: Medium Date : 2018-06-05 CVE-ID : CVE-2018-5729 CVE-2018-5730 Package : krb5 Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-586 Summary ======= The package krb5 before version 1.16.1-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.16.1-1. # pacman -Syu "krb5>=1.16.1-1" The problems have been fixed upstream in version 1.16.1. Workaround ========== None. Description =========== - CVE-2018-5729 (insufficient validation) A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can cause a null dereference in kadmind, or circumvent a DN container check, by supplying tagged data intended to be internal to the database module. - CVE-2018-5730 (insufficient validation) A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. Impact ====== An authenticated kadmin user can elevate privileges or crash the application via a crafted DN. References ========== https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/I… https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1 https://security.archlinux.org/CVE-2018-5729 https://security.archlinux.org/CVE-2018-5730

1 0

[ASA-201806-2] radare2: multiple issues
by Jelle van der Waa 07 Jun '18

07 Jun '18

Arch Linux Security Advisory ASA-201806-2 ========================================= Severity: High Date : 2018-06-05 CVE-ID : CVE-2018-11375 CVE-2018-11376 CVE-2018-11377 CVE-2018-11378 CVE-2018-11379 CVE-2018-11380 CVE-2018-11381 CVE-2018-11382 CVE-2018-11383 CVE-2018-11384 Package : radare2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-709 Summary ======= The package radare2 before version 2.6.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.6.0-1. # pacman -Syu "radare2>=2.6.0-1" The problems have been fixed upstream in version 2.6.0. Workaround ========== None. Description =========== - CVE-2018-11375 (denial of service) The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11376 (denial of service) The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file. - CVE-2018-11377 (denial of service) The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11378 (arbitrary code execution) The wasm_dis() function in libr/asm/arch/wasm/wasm.c has a stack-buffer overflow that may result in denial-of-service or possibly have unspecified other impact via a crafted WASM file. - CVE-2018-11379 (denial of service) The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted PE file. - CVE-2018-11380 (denial of service) The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted Mach-O file. - CVE-2018-11381 (denial of service) The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11382 (denial of service) The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11383 (denial of service) The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr.c. - CVE-2018-11384 (denial of service) The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file. Impact ====== A remote attacker is able to execute arbitrary code or crash the application via a specially crafted file. References ========== https://github.com/radare/radare2/commit/041e53cab7ca33481ae45ecd65ad596976… https://github.com/radare/radare2/issues/9928 https://github.com/radare/radare2/commit/1f37c04f2a762500222dda2459e6a04646… https://github.com/radare/radare2/issues/9904 https://github.com/radare/radare2/commit/25a3703ef2e015bbe1d1f16f6b2f63bb10… https://github.com/radare/radare2/commit/b35530fa0681b27eba084de5527037ebfb… https://github.com/radare/radare2/issues/9901 https://github.com/radare/radare2/commit/bd276ef2fd8ac3401e65be7c126a43175c… https://github.com/radare/radare2/issues/9969 https://github.com/radare/radare2/commit/4e1cf0d3e6f6fe2552a269def0af1cd240… https://github.com/radare/radare2/issues/9926 https://github.com/radare/radare2/commit/60208765887f5f008b3b9a883f3addc8bd… https://github.com/radare/radare2/issues/9970 https://github.com/radare/radare2/commit/3fcf41ed96ffa25b38029449520c8d0a19… https://github.com/radare/radare2/issues/9902 https://github.com/radare/radare2/commit/d04c78773f6959bcb427453f8e5b9824d5… https://github.com/radare/radare2/issues/10091 https://github.com/radare/radare2/commit/9d348bcc2c4bbd3805e7eec97b594be9fe… https://github.com/radare/radare2/issues/9943 https://github.com/radare/radare2/commit/77c47cf873dd55b396da60baa2ca83bbd3… https://github.com/radare/radare2/issues/9903 https://security.archlinux.org/CVE-2018-11375 https://security.archlinux.org/CVE-2018-11376 https://security.archlinux.org/CVE-2018-11377 https://security.archlinux.org/CVE-2018-11378 https://security.archlinux.org/CVE-2018-11379 https://security.archlinux.org/CVE-2018-11380 https://security.archlinux.org/CVE-2018-11381 https://security.archlinux.org/CVE-2018-11382 https://security.archlinux.org/CVE-2018-11383 https://security.archlinux.org/CVE-2018-11384

1 0