Linux Advisory Watch: August 18th, 2017

Jeriko One discovered that newsbeuter, a text-mode RSS feed reader, did not properly escape the title and description of a news article when bookmarking it. This allowed a remote attacker to run an arbitrary shell command on the client machine.

It was discovered that libsmpack, a library used to handle Microsoft compression formats, did not properly validate its input. A remote attacker could craft malicious CAB or CHM files and use this flaw to cause a denial of service via application crash, or potentially

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.0.32. Please see the MariaDB 10.0 Release Notes for further details:

The update shipped in DSA 3928-1 failed to build on the mips, mipsel and powerpc architectures for the oldstable distribution (jessie). This has been fixed in 52.3.0esr-1~deb8u2.

Gajim, a GTK+-based XMPP/Jabber client, unconditionally implements the "XEP-0146: Remote Controlling Clients" extension, allowing a malicious XMPP server to trigger commands to leak private conversations from encrypted sessions. With this update XEP-0146 support has been disabled

Calum Hutton reported that the XML-RPC server in supervisor, a system for controlling process state, does not perform validation on requested XML-RPC methods, allowing an authenticated client to send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on

A read buffer overflow was discovered in the idtech3 (Quake III Arena) family of game engines. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet.

It was discovered that CVS, a centralised version control system, did not correctly handle maliciously constructed repository URLs, which allowed an attacker to run an arbitrary shell command.

Aleksandar Nikolic discovered that an error in the x509 parser of the Botan crypto library could result in an out-of-bounds memory read, resulting in denial of service or an information leak if processing a malformed certificate.

Matviy Kotoniy reported that the gdImageCreateFromGifCtx() function used to load images from GIF format files in libgd2, a library for programmatic graphics creation and manipulation, does not zero stack allocated color map buffers before their use, which may result in

Lilith Wyatt discovered two vulnerabilities in the Zabbix network monitoring system which may result in execution of arbitrary code or database writes by malicious proxies.

Several vulnerabilities have been found in the PostgreSQL database system: CVE-2017-7546

Several vulnerabilities have been found in the PostgreSQL database system: CVE-2017-7546

Two vulnerabilities were found in the PJSIP/PJProject communication library, which may result in denial of service. For the oldstable distribution (jessie), these problems have been fixed

Joern Schneeweisz discovered that git, a distributed revision control system, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command, for instance via git submodules.

Several problems were discovered in Subversion, a centralised version control system. CVE-2016-8734 (jessie only)

Guido Vranken discovered that FreeRADIUS, an open source implementation of RADIUS, the IETF protocol for AAA (Authorisation, Authentication, and Accounting), did not properly handle memory when processing packets. This would allow a remote attacker to cause a

Aleksandar Nikolic of Cisco Talos discovered a stack-based buffer overflow vulnerability in libsoup2.4, a HTTP library implementation in C. A remote attacker can take advantage of this flaw by sending a specially crafted HTTP request to cause an application using the

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service, bypass of the same-origin policy or

An update that fixes 5 vulnerabilities is now available. An update that fixes 5 vulnerabilities is now available. An update that fixes 5 vulnerabilities is now available.

It was discovered that there was a denial-of-service vulnerability in the Strongswan Virtual Private Network (VPN) software. Specific RSA signatures passed to the gmp plugin for verification could

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Some memory corruption bugs were discovered in libraw, a raw image decoder library, which could be triggered via maliciously crafted input files to cause denial of service or other unspecified impact.

It was discovered that there was a command injection vulnerability in the CVS revision control system. For Debian 7 "Wheezy", this issue has been fixed in cvs version

Matviy Kotoniy reported that the gdImageCreateFromGifCtx() function used to load images from GIF format files in libgd2, a library for programmatic graphics creation and manipulation, does not zero stack

It was discovered that there was a NULL pointer dereference in libgxps, a library to handle XML Paper Specification specifications. Specially-crafted input could lead to a remote denial of service attack.

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service, bypass of the same-origin policy or

It was discovered that there was a arbitrary code execution vulnerability in the subversion revision control system via malicious "svn+ssh" URLs in "svn:externals" and "svn:sync-from-url".

Several vulnerabilities have been found in the PostgreSQL database system: CVE-2017-7486

It was discovered that there was a directory traversal vulnerability in the xchat IRC client which allowed remote IRC servers to read or modify arbitrary files via a ".." in the server name.

The package subversion before version 1.9.7-1 is vulnerable to arbitrary command execution.

The package strongswan before version 5.5.3-4 is vulnerable to denial of service.

The package spice before version 0.12.8+8+ga957a90b-1 is vulnerable to arbitrary code execution.

The package xorg-server before version 1.19.3-3 is vulnerable to multiple issues including arbitrary code execution and information disclosure.

The package audiofile before version 0.3.6-4 is vulnerable to multiple issues including arbitrary code execution, arbitrary command execution and denial of service.

The package libytnef before version 1.9.2-2 is vulnerable to arbitrary code execution.

The package jdk7-openjdk before version 7.u151_2.6.11-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, authentication bypass, denial of service, privilege escalation, private key recovery and content spoofing.

The package git before version 2.14.1-1 is vulnerable to arbitrary command execution.

The package mercurial before version 4.2.3-1 is vulnerable to multiple issues including arbitrary command execution and arbitrary filesystem access.

The package libsoup before version 2.58.2-1 is vulnerable to arbitrary code execution.

The package varnish before version 5.1.3-1 is vulnerable to denial of service.

The package firefox before version 55.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, information disclosure, same-origin policy bypass, access restriction bypass, cross-site scripting, incorrect calculation, sandbox escape and denial of service.

The package flashplugin before version 26.0.0.151-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure.

The package lib32-flashplugin before version 26.0.0.151-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure.

Upstream details at : https://access.redhat.com/errata/RHSA-2017:2485

Upstream details at : https://access.redhat.com/errata/RHSA-2017:2478

Upstream details at : https://access.redhat.com/errata/RHSA-2017:2424

Upstream details at : https://access.redhat.com/errata/RHSA-2017:2456

A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Git. An attacker could use this flaw to execute shell commands with the privileges of the user running the Git client, for example, when performing a "clone" action on a malicious repository or a [More...]

It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd [More...]