October 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201510-26] mariadb: denial of service
by Christian Rebischke 30 Oct '15

30 Oct '15

Arch Linux Security Advisory ASA-201510-26 ========================================= Severity: Low Date : 2015-10-30 CVE-ID : CVE-2015-4913 CVE-2015-4870 CVE-2015-4861 CVE-2015-4858 CVE-2015-4836 CVE-2015-4830 CVE-2015-4826 CVE-2015-4815 CVE-2015-4802 CVE-2015-4792 Package : mysql Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package mysql before version 10.0.22-1 is vulnerable against different denial of service vulnerabilities. Resolution ========== Upgrade to version 10.0.22-1. # pacman -Syu "mariadb>=10.0.22-1" The problems have been fixed upstream in version 10.0.22. Workaround ========== None. Description =========== - CVE-2015-4913 (denial of service) allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858. - CVE-2015-4870 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : Parser. - CVE-2015-4861 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. - CVE-2015-4858 (denial of service) allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913. - CVE-2015-4836 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : SP. - CVE-2015-4830 (denial of service) allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges. - CVE-2015-4826 (denial of service) allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types. - CVE-2015-4815 (denial of service) allows remote authenticated users to affect availability via vectors related to Server : DDL. - CVE-2015-4802 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792. - CVE-2015-4792 (denial of service) allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802. Impact ====== An authenticated remote attacker is able to affect the availability via different attack vectors. References ========== http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4913 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4870 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4861 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4858 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4836 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4830 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4826 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4815 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4802 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4792 https://mariadb.com/kb/en/mariadb/security/

1 0

[arch-security] [ASA-201510-25] lldpd: denial of service
by Levente Polyak 30 Oct '15

30 Oct '15

Arch Linux Security Advisory ASA-201510-25 ========================================== Severity: Medium Date : 2015-10-30 CVE-ID : CVE-2015-8011 CVE-2015-8012 Package : lldpd Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lldpd before version 0.7.19-1 is vulnerable denial of service. Resolution ========== Upgrade to 0.7.19-1. # pacman -Syu "lldpd>=0.7.19-1" The problems have been fixed upstream in version 0.7.19. Workaround ========== None. Description =========== - CVE-2015-5714 (denial of service) A buffer overflow has been discovered when handling management address TLV. When a remote device was advertising a too large management address while still respecting TLV boundaries, lldpd would crash due to a buffer overflow. - CVE-2015-5715 (denial of service) A vulnerability has been discovered that is triggering an application crash while using assert() if a malformed packet is handled. Impact ====== A remote attacker is able to crash the application leading to denial of service. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8011 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8012 http://seclists.org/oss-sec/2015/q4/198

1 0

[arch-security] [ASA-201510-24] wordpress: multiple issues
by Levente Polyak 30 Oct '15

30 Oct '15

Arch Linux Security Advisory ASA-201510-24 ========================================== Severity: Medium Date : 2015-10-30 CVE-ID : 2015-5714 2015-5715 CVE-2015-7989 Package : wordpress Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wordpress before version 4.3.1-1 is vulnerable to cross-side scripting and insufficient permission restriction. Resolution ========== Upgrade to 4.3.1-1. # pacman -Syu "wordpress>=4.3.1-1" The problems have been fixed upstream in version 4.3.1. Workaround ========== None. Description =========== - CVE-2015-5714 (cross-side scripting) A cross-site scripting vulnerability has been discovered when processing shortcode tags. - CVE-2015-5715 (insufficient permission restriction) A vulnerability has been discovered, allowing users without proper permissions to publish private posts and make them sticky. - CVE-2015-7989 (cross-side scripting) A cross-site scripting vulnerability has been discovered in the user list tables. Impact ====== A remote attacker is able do perform cross-side scripting attacks or publish private posts and make them sticky. References ========== https://access.redhat.com/security/cve/CVE-2015-5714 https://access.redhat.com/security/cve/CVE-2015-5715 https://access.redhat.com/security/cve/CVE-2015-7989 https://codex.wordpress.org/Version_4.3.1 http://seclists.org/oss-sec/2015/q4/178

1 0

[arch-security] [ASA-201510-23] phpmyadmin: content spoofing
by Levente Polyak 30 Oct '15

30 Oct '15

Arch Linux Security Advisory ASA-201510-23 ========================================== Severity: Low Date : 2015-10-30 CVE-ID : CVE-2015-7873 Package : phpmyadmin Type : content spoofing Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package phpmyadmin before version 4.5.1-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 4.5.1-1. # pacman -Syu "phpmyadmin>=4.5.1-1" The problem has been fixed upstream in version 4.5.1. Workaround ========== None. Description =========== This vulnerability allows an attacker to perform a content spoofing attack using the phpMyAdmin's redirection mechanism to external sites. This vulnerability is not considered to be critical since the spoofed content is escaped and no HTML injection is possible. Impact ====== A remote attacker is able do perform content spoofing using the redirection mechanism to external sites. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7873 https://www.phpmyadmin.net/security/PMASA-2015-5/

1 0

[arch-security] [ASA-201510-22] vorbis-tools: denial of service
by Levente Polyak 27 Oct '15

27 Oct '15

Arch Linux Security Advisory ASA-201510-22 ========================================== Severity: Low Date : 2015-10-27 CVE-ID : CVE-2015-6749 Package : vorbis-tools Type : denial of service Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package vorbis-tools before version 1.4.0-6 is vulnerable to denial of service. Resolution ========== Upgrade to 1.4.0-6. # pacman -Syu "vorbis-tools>=1.4.0-6" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Buffer overflow in the aiff_open function in oggenc/audio.c allows local attackers to cause a denial of service (crash) via a crafted AIFF file. Impact ====== A local attacker is able to craft a special AIFF file that crashes the application leading to denial of service. References ========== https://access.redhat.com/security/cve/CVE-2015-6749 https://trac.xiph.org/ticket/2212 https://bugs.archlinux.org/task/46269

1 0

[arch-security] [ASA-201510-21] drupal: open redirect
by Levente Polyak 24 Oct '15

24 Oct '15

Arch Linux Security Advisory ASA-201510-21 ========================================== Severity: Low Date : 2015-10-23 CVE-ID : CVE-2015-7943 Package : drupal Type : open redirect Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package drupal before version 7.41-1 is vulnerable to open redirect. Resolution ========== Upgrade to 7.41-1. # pacman -Syu "drupal>=7.41-1" The problems have been fixed upstream in version 7.41. Workaround ========== None. Description =========== The Overlay module in Drupal core displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability. This vulnerability is mitigated by the fact that it can only be used against site users who have the "Access the administrative overlay" permission, and that the Overlay module must be enabled. Impact ====== A remote attacker is able to make use of the insufficient URL validation to misuse it as an open redirect relay and display the content of arbitrary URLs. References ========== https://www.drupal.org/SA-CORE-2015-004 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7943

1 0

[arch-security] [ASA-201510-20] jre8-openjdk-headless: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-20 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 Package : jre8-openjdk-headless Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre8-openjdk-headless before version 8.u65-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 8.u65-1. # pacman -Syu "jre8-openjdk-headless>=8.u65-1" The problems have been fixed upstream in version 8.u65. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4868 (security policy bypass) A flaw was found in the way the Libraries component of OpenJDK handled certificate revocation lists (CRL). In certain cases, CRL checking code could fail to report that a certificate was revoked, causing the application to accept it as trusted. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4901 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4906 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors related to JavaFX. - CVE-2015-4908 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4916 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4868 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4901 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4906 https://access.redhat.com/security/cve/CVE-2015-4908 https://access.redhat.com/security/cve/CVE-2015-4911 https://access.redhat.com/security/cve/CVE-2015-4916

1 0

[arch-security] [ASA-201510-19] jre8-openjdk: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-19 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 Package : jre8-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jre8-openjdk before version 8.u65-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 8.u65-1. # pacman -Syu "jre8-openjdk>=8.u65-1" The problems have been fixed upstream in version 8.u65. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4868 (security policy bypass) A flaw was found in the way the Libraries component of OpenJDK handled certificate revocation lists (CRL). In certain cases, CRL checking code could fail to report that a certificate was revoked, causing the application to accept it as trusted. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4901 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4906 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors related to JavaFX. - CVE-2015-4908 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4916 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4868 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4901 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4906 https://access.redhat.com/security/cve/CVE-2015-4908 https://access.redhat.com/security/cve/CVE-2015-4911 https://access.redhat.com/security/cve/CVE-2015-4916

1 0

[arch-security] [ASA-201510-18] jdk8-openjdk: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-18 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4868 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4901 CVE-2015-4902 CVE-2015-4903 CVE-2015-4906 CVE-2015-4908 CVE-2015-4911 CVE-2015-4916 Package : jdk8-openjdk Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk8-openjdk before version 8.u65-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 8.u65-1. # pacman -Syu "jdk8-openjdk>=8.u65-1" The problems have been fixed upstream in version 8.u65. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4868 (security policy bypass) A flaw was found in the way the Libraries component of OpenJDK handled certificate revocation lists (CRL). In certain cases, CRL checking code could fail to report that a certificate was revoked, causing the application to accept it as trusted. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4901 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4906 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors related to JavaFX. - CVE-2015-4908 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4916 (unknown) A unspecified vulnerability allows remote attackers to affect confidentiality via unknown vectors. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4868 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4901 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4906 https://access.redhat.com/security/cve/CVE-2015-4908 https://access.redhat.com/security/cve/CVE-2015-4911 https://access.redhat.com/security/cve/CVE-2015-4916

1 0

[arch-security] [ASA-201510-17] jre7-openjdk-headless: multiple issues
by Levente Polyak 23 Oct '15

23 Oct '15

Arch Linux Security Advisory ASA-201510-17 ========================================== Severity: Critical Date : 2015-10-23 CVE-ID : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4881 CVE-2015-4882 CVE-2015-4883 CVE-2015-4893 CVE-2015-4902 CVE-2015-4903 CVE-2015-4911 Package : jre7-openjdk-headless Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jdk7-openjdk-headless before version 7.u91_2.6.2-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, sandbox bypass, information disclosure and denial of service. Resolution ========== Upgrade to 7.u91_2.6.2-1. # pacman -Syu "jre7-openjdk-headless>=7.u91_2.6.2-1" The problems have been fixed upstream in version 7.u91. Workaround ========== None. Description =========== - CVE-2015-4734 (information disclosure) It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about the Kerberos configuration on the host where they were executed, bypassing certain Java sandbox restrictions. - CVE-2015-4803 (denial of service) It was discovered that the JAXP component of OpenJDK did not use efficient data structures to store data from parsed XML documents. A specially-crafted XML input could cause a Java application using JAXP to use an excessive amount of CPU time by e.g. triggering hash collisions. - CVE-2015-4805 (arbitrary code execution) It was discovered that the ObjectStreamClass in the Serialization component of OpenJDK failed to ensure that the object is fully initialized before allowing calls of certain methods. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions to execute code. - CVE-2015-4806 (improper input validation) A vulnerability has been discovered leading to HttpURLConnection header restriction bypass, allowing remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4810 (arbitrary code execution) An unspecified vulnerability has been discovered that allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. - CVE-2015-4835 (arbitrary code execution) It was discovered that the StubGenerator class in the CORBA component of OpenJDK failed to generate code with all needed permission checks related to object (de-)serialization. An untursted Java application or applet could use this flaw to bypass Java sandbox restrictions and execute arbitrary code. - CVE-2015-4840 (information disclosure) It was discovered that the 2D component of OpenJDK could perform out of bounds access and possibly disclose portions of the Java Virtual Machine memory when processing specially crafted color profiles. The issue was caused by having bundled lcms2 code use fast floor() implementation. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. - CVE-2015-4842 (information disclosure) An information disclosure flaw was found in the JAXP component of OpenJDK. An untrusted Java application or applet could use this flaw to get information about user home directory location (the content of the "user.dir" system property), hence bypassing certain Java sandbox restrictions. - CVE-2015-4843 (arbitrary code execution) Multiple integer overflow issues were found in the implementation of Buffers in the java.nio (Non-blocking I/O) packages in the Libraries component of OpenJDK. These could lead to out of bounds buffer access and Java Virtual Machine memory corruption. An untursted Java application or applet could use these flaws to run arbitrary code with the Java Virtual Machine privileges or bypass Java sandbox restrictions. - CVE-2015-4844 (arbitrary code execution) It was discovered that ICU Layout Engine was missing multiple boundary and error return checks. These could lead to buffer overflows and memory corruption. A specially crafted font file could cause an application using ICU to parse untrusted fonts to crash and, possibly, execute arbitrary code. - CVE-2015-4860 (sandbox bypass) It was discovered that the DGCImpl (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when processing untrusted input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4871 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. - CVE-2015-4872 (security policy bypass) It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file. - CVE-2015-4881 (sandbox bypass) It was discovered that the IIOPInputStream class in the CORBA component of OpenJDK failed to properly check object and field types during object deserialization. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4882 (denial of service) A flaw was found in the way the IIOPInputStream class in the CORBA component of OpenJDK performed deserialization of String objects. An untrusted Java application or applet could use this flaw to crash the Java Virtual Machine. - CVE-2015-4883 (sandbox bypass) It was discovered that the DGCClient (for RMI distributed garbage-collection - DGC) class in the RMI component of OpenJDK failed to use restricted access control context when handling JRMP (Java Remote Method Protocol) messages. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions. - CVE-2015-4893 (denial of service) It was discovered that the JAXP component of OpenJDK did not enforce the maximum XML name limit (jdk.xml.MaxXMLNameLimit) when parsing XML files. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. - CVE-2015-4902 (unknown) An unspecified vulnerability has been discovered that allows remote attackers to affect integrity via unknown vectors related to Deployment. - CVE-2015-4903 (sandbox bypass) It was discovered that the RemoteObjectInvocationHandler class in the RMI component of OpenJDK did not check if object proxy is an instance of a proxy class and that it uses correct invocation handler. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions by gaining access to data that should by protected by the sandbox. - CVE-2015-4911 (denial of service) It was discovered that the StAX XML parser in the JAXP component of OpenJDK could do certain DTD processing even when DTD support was disabled via the javax.xml.stream.supportDTD system property. A specially crafted XML document could cause a Java application using JAXP to consume an excessive amount of memory and CPU time when parsed. Impact ====== A remote attacker is able to execute arbitrary code, gain access to sensitive information, bypass sandbox restrictions or perform a denial of service attack via multiple vectors. References ========== http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-October/033972.h… http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#A… https://access.redhat.com/security/cve/CVE-2015-4734 https://access.redhat.com/security/cve/CVE-2015-4803 https://access.redhat.com/security/cve/CVE-2015-4805 https://access.redhat.com/security/cve/CVE-2015-4806 https://access.redhat.com/security/cve/CVE-2015-4810 https://access.redhat.com/security/cve/CVE-2015-4835 https://access.redhat.com/security/cve/CVE-2015-4840 https://access.redhat.com/security/cve/CVE-2015-4842 https://access.redhat.com/security/cve/CVE-2015-4843 https://access.redhat.com/security/cve/CVE-2015-4844 https://access.redhat.com/security/cve/CVE-2015-4860 https://access.redhat.com/security/cve/CVE-2015-4871 https://access.redhat.com/security/cve/CVE-2015-4872 https://access.redhat.com/security/cve/CVE-2015-4881 https://access.redhat.com/security/cve/CVE-2015-4882 https://access.redhat.com/security/cve/CVE-2015-4883 https://access.redhat.com/security/cve/CVE-2015-4893 https://access.redhat.com/security/cve/CVE-2015-4902 https://access.redhat.com/security/cve/CVE-2015-4903 https://access.redhat.com/security/cve/CVE-2015-4911

1 0