June 2018 - Arch-security - lists.archlinux.org

[ASA-201806-4] chromium: access restriction bypass
by Remi Gacogne 09 Jun '18

09 Jun '18

Arch Linux Security Advisory ASA-201806-4 ========================================= Severity: High Date : 2018-06-07 CVE-ID : CVE-2018-6148 Package : chromium Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-712 Summary ======= The package chromium before version 67.0.3396.79-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 67.0.3396.79-1. # pacman -Syu "chromium>=67.0.3396.79-1" The problem has been fixed upstream in version 67.0.3396.79. Workaround ========== None. Description =========== An incorrect handling of CSP header has been found in chromium before 67.0.3396.79. Impact ====== A remote attacker can bypass the content security policy. References ========== https://chromereleases.googleblog.com/2018/06/stable-channel-update-for-des… https://crbug.com/845961 https://security.archlinux.org/CVE-2018-6148

1 0

[ASA-201806-3] krb5: insufficient validation
by Remi Gacogne 09 Jun '18

09 Jun '18

Arch Linux Security Advisory ASA-201806-3 ========================================= Severity: Medium Date : 2018-06-05 CVE-ID : CVE-2018-5729 CVE-2018-5730 Package : krb5 Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-586 Summary ======= The package krb5 before version 1.16.1-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.16.1-1. # pacman -Syu "krb5>=1.16.1-1" The problems have been fixed upstream in version 1.16.1. Workaround ========== None. Description =========== - CVE-2018-5729 (insufficient validation) A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can cause a null dereference in kadmind, or circumvent a DN container check, by supplying tagged data intended to be internal to the database module. - CVE-2018-5730 (insufficient validation) A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. Impact ====== An authenticated kadmin user can elevate privileges or crash the application via a crafted DN. References ========== https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/I… https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1 https://security.archlinux.org/CVE-2018-5729 https://security.archlinux.org/CVE-2018-5730

1 0

[ASA-201806-2] radare2: multiple issues
by Jelle van der Waa 07 Jun '18

07 Jun '18

Arch Linux Security Advisory ASA-201806-2 ========================================= Severity: High Date : 2018-06-05 CVE-ID : CVE-2018-11375 CVE-2018-11376 CVE-2018-11377 CVE-2018-11378 CVE-2018-11379 CVE-2018-11380 CVE-2018-11381 CVE-2018-11382 CVE-2018-11383 CVE-2018-11384 Package : radare2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-709 Summary ======= The package radare2 before version 2.6.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.6.0-1. # pacman -Syu "radare2>=2.6.0-1" The problems have been fixed upstream in version 2.6.0. Workaround ========== None. Description =========== - CVE-2018-11375 (denial of service) The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11376 (denial of service) The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file. - CVE-2018-11377 (denial of service) The avr_op_analyze() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11378 (arbitrary code execution) The wasm_dis() function in libr/asm/arch/wasm/wasm.c has a stack-buffer overflow that may result in denial-of-service or possibly have unspecified other impact via a crafted WASM file. - CVE-2018-11379 (denial of service) The get_debug_info() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted PE file. - CVE-2018-11380 (denial of service) The parse_import_ptr() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted Mach-O file. - CVE-2018-11381 (denial of service) The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11382 (denial of service) The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file. - CVE-2018-11383 (denial of service) The r_strbuf_fini() function in radare2 2.5.0 allows remote attackers to cause a denial of service (invalid free and application crash) via a crafted ELF file because of an uninitialized variable in the CPSE handler in libr/anal/p/anal_avr.c. - CVE-2018-11384 (denial of service) The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file. Impact ====== A remote attacker is able to execute arbitrary code or crash the application via a specially crafted file. References ========== https://github.com/radare/radare2/commit/041e53cab7ca33481ae45ecd65ad596976… https://github.com/radare/radare2/issues/9928 https://github.com/radare/radare2/commit/1f37c04f2a762500222dda2459e6a04646… https://github.com/radare/radare2/issues/9904 https://github.com/radare/radare2/commit/25a3703ef2e015bbe1d1f16f6b2f63bb10… https://github.com/radare/radare2/commit/b35530fa0681b27eba084de5527037ebfb… https://github.com/radare/radare2/issues/9901 https://github.com/radare/radare2/commit/bd276ef2fd8ac3401e65be7c126a43175c… https://github.com/radare/radare2/issues/9969 https://github.com/radare/radare2/commit/4e1cf0d3e6f6fe2552a269def0af1cd240… https://github.com/radare/radare2/issues/9926 https://github.com/radare/radare2/commit/60208765887f5f008b3b9a883f3addc8bd… https://github.com/radare/radare2/issues/9970 https://github.com/radare/radare2/commit/3fcf41ed96ffa25b38029449520c8d0a19… https://github.com/radare/radare2/issues/9902 https://github.com/radare/radare2/commit/d04c78773f6959bcb427453f8e5b9824d5… https://github.com/radare/radare2/issues/10091 https://github.com/radare/radare2/commit/9d348bcc2c4bbd3805e7eec97b594be9fe… https://github.com/radare/radare2/issues/9943 https://github.com/radare/radare2/commit/77c47cf873dd55b396da60baa2ca83bbd3… https://github.com/radare/radare2/issues/9903 https://security.archlinux.org/CVE-2018-11375 https://security.archlinux.org/CVE-2018-11376 https://security.archlinux.org/CVE-2018-11377 https://security.archlinux.org/CVE-2018-11378 https://security.archlinux.org/CVE-2018-11379 https://security.archlinux.org/CVE-2018-11380 https://security.archlinux.org/CVE-2018-11381 https://security.archlinux.org/CVE-2018-11382 https://security.archlinux.org/CVE-2018-11383 https://security.archlinux.org/CVE-2018-11384

1 0

[ASA-201806-1] git: multiple issues
by Jelle van der Waa 05 Jun '18

05 Jun '18

Arch Linux Security Advisory ASA-201806-1 ========================================= Severity: Critical Date : 2018-06-01 CVE-ID : CVE-2018-11233 CVE-2018-11235 Package : git Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-711 Summary ======= The package git before version 2.17.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2.17.1-1. # pacman -Syu "git>=2.17.1-1" The problems have been fixed upstream in version 2.17.1. Workaround ========== None. Description =========== - CVE-2018-11233 (information disclosure) A security issue has been found in git before 2.17.1, where the code that sanify-check paths in is_ntfs_dotgit() could have been tricked into reading random pieces of memory. - CVE-2018-11235 (arbitrary code execution) A security issue has been found in git before 2.17.1. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server. Impact ====== A remote attacker can execute arbitrary code on the affected host by placing a crafted .gitmodules file in a repository cloned by a local user, or access sensitive information via a crafted path in such a repository. References ========== https://lkml.org/lkml/2018/5/29/889 https://github.com/gitster/git/commit/11a9f4d807a0d71dc6eff51bb87baf4ca2ccc… https://security.archlinux.org/CVE-2018-11233 https://security.archlinux.org/CVE-2018-11235

1 0