[SECURITY] [DSA 4059-1] libxcursor security update

Debian Security Advisory DSA-4059-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso December 08, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libxcursor CVE ID : CVE-2017-16612 Debian Bug : 883792 It was discovered that libXcursor, a X cursor management library, is prone to several heap overflows when parsing malicious files. An attacker can take advantage of these flaws for arbitrary code execution, if a user is tricked into processing a specially crafted cursor file. For the oldstable distribution (jessie), these problems have been fixed in version 1:1.1.14-1+deb8u1. For the stable distribution (stretch), these problems have been fixed in version 1:1.1.14-1+deb9u1. We recommend that you upgrade your libxcursor packages. For the detailed security status of libxcursor please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libxcursor Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

FreeBSD Security Advisory FreeBSD-SA-17:12.openssl

============================================================================= FreeBSD-SA-17:12.openssl Security Advisory The FreeBSD Project Topic: OpenSSL multiple vulnerabilities Category: contrib Module: openssl Announced: 2017-12-09 Affects: All supported versions of FreeBSD. Corrected: 2017-12-07 18:04:48 UTC (stable/11, 11.1-STABLE) 2017-12-09 03:44:26 UTC (releng/11.1, 11.1-RELEASE-p6) 2017-12-09 03:41:31 UTC (stable/10, 10.4-STABLE) 2017-12-09 03:45:23 UTC (releng/10.4, 10.4-RELEASE-p5) 2017-12-09 03:45:23 UTC (releng/10.3, 10.3-RELEASE-p26) CVE Name: CVE-2017-3737, CVE-2017-3738 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured Open Source toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It is also a full-strength general purpose cryptography library. II. Problem Description Invoking SSL_read()/SSL_write() while in an error state causes data to be passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. [CVE-2017-3737] There is an overflow bug in the x86_64 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). [CVE-2017-3738] This bug only affects FreeBSD 11.x. III. Impact Applications with incorrect error handling may inappropriately pass unencrypted data. [CVE-2017-3737] Mishandling of carry propagation will produce incorrect output, and make it easier for a remote attacker to obtain sensitive private-key information. No EC algorithms are affected and analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. [CVE-2017-3738] IV. Workaround No workaround is available. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Restart all daemons that use the library, or reboot the system. 2) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install Restart all daemons that use the library, or reboot the system. 3) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 10.x] # fetch https://security.FreeBSD.org/patches/SA-17:12/openssl-10.patch # fetch https://security.FreeBSD.org/patches/SA-17:12/openssl-10.patch.asc # gpg --verify openssl-10.patch.asc [FreeBSD 11.x] # fetch https://security.FreeBSD.org/patches/SA-17:12/openssl-11.patch # fetch https://security.FreeBSD.org/patches/SA-17:12/openssl-11.patch.asc # gpg --verify openssl-11.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all daemons that use the library, or reboot the system. VI. Correction details The following list contains the correction revision numbers for each affected branch. Branch/path Revision - ------------------------------------------------------------------------- stable/10/ r326721 releng/10.3/ r326723 releng/10.4/ r326723 stable/11/ r326663 releng/11.1/ r326722 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The latest revision of this advisory is available at

[SECURITY] [DSA 4060-1] wireshark security update

- ------------------------------------------------------------------------- Debian Security Advisory DSA-4060-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff December 09, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : wireshark CVE ID : CVE-2017-11408 CVE-2017-13766 CVE-2017-17083 CVE-2017-17084 CVE-2017-17085 It was discovered that wireshark, a network protocol analyzer, contained several vulnerabilities in the dissectors for CIP Safety, IWARP_MPA, NetBIOS, Profinet I/O and AMQP, which result in denial of dervice or the execution of arbitrary code. For the oldstable distribution (jessie), these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u12. For the stable distribution (stretch), these problems have been fixed in version 2.2.6+g32dac6a-2+deb9u1. We recommend that you upgrade your wireshark packages. For the detailed security status of wireshark please refer to its security tracker page at: https://security-tracker.debian.org/tracker/wireshark Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

[SECURITY] [DSA 4061-1] thunderbird security update

- ------------------------------------------------------------------------- Debian Security Advisory DSA-4061-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff December 10, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : thunderbird CVE ID : CVE-2017-7826 CVE-2017-7828 CVE-2017-7830 Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service. For the oldstable distribution (jessie), these problems have been fixed in version 1:52.5.0-1~deb8u1. For the stable distribution (stretch), these problems have been fixed in version 1:52.5.0-1~deb9u1. We recommend that you upgrade your thunderbird packages. For the detailed security status of thunderbird please refer to its security tracker page at: https://security-tracker.debian.org/tracker/thunderbird Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

[SECURITY] [DSA 4062-1] firefox-esr security update

- ------------------------------------------------------------------------- Debian Security Advisory DSA-4062-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff December 10, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : firefox-esr CVE ID : CVE-2017-7843 It discovered that the Private Browsing mode in the Mozilla Firefox web browser allowed to fingerprint a user across multiple sessions via IndexedDB. For the oldstable distribution (jessie), this problem has been fixed in version 52.5.2esr-1~deb8u1. For the stable distribution (stretch), this problem has been fixed in version 52.5.2esr-1~deb9u1. We recommend that you upgrade your firefox-esr packages. For the detailed security status of firefox-esr please refer to its security tracker page at: https://security-tracker.debian.org/tracker/firefox-esr Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Advisory - Fisheye and Crucible - CVE-2017-14591

CVE ID: * CVE-2017-14591. Product: Fisheye and Crucible. Affected Fisheye and Crucible product versions: version < 4.4.3 4.5.0 <= version < 4.5.1 Fixed Fisheye and Crucible product versions: * for 4.4.x, Fisheye 4.4.3 has been released with a fix for this issue. * for 4.4.x, Crucible 4.4.3 has been released with a fix for this issue. * for 4.5.x, Fisheye 4.5.1 has been released with a fix for this issue. * for 4.5.x, Crucible 4.5.1 has been released with a fix for this issue. Summary: This advisory discloses a critical severity security vulnerability which affects Fisheye and Crucible. Versions of Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and from version 4.5.0 before 4.5.1 (the fixed version for 4.5.x) are affected by this vulnerability. Customers who have upgraded their Fisheye and Crucible installations to version 4.4.3 or 4.5.1 are not affected. Customers who have downloaded and installed Fisheye or Crucible less than 4.4.3 (the fixed version for 4.4.x) or who have downloaded and installed Fisheye or Crucible >= 4.5.0 but less than 4.5.1 (the fixed version for 4.5.x) please upgrade your Fisheye and Crucible installations immediately to fix this vulnerability. Argument injection in Mercurial repository handling (CVE-2017-8907) Severity: Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low. This is our assessment and you should evaluate its applicability to your own IT environment. Description: Fisheye and Crucible did not check that the name of a file in a Mercurial repository contained argument parameters. An attacker who has permission to add a repository or commit to a mercurial repository tracked by Fisheye or Crucible, can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible. All versions of Fisheye and Crucible before 4.4.3 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.1 (the fixed version for 4.5.x) are affected by this vulnerability. This issue can be tracked for Fisheye at: https://jira.atlassian.com/browse/FE-6955 . This issue can be tracked for Crucible at https://jira.atlassian.com/browse/CRUC-8121 . Fix: To address this issue, we've released the following versions containing a fix: * Fisheye version 4.4.3 * Crucible version 4.4.3 * Fisheye version 4.5.1 * Crucible version 4.5.1 Remediation: Upgrade Fisheye and Crucible to version 4.5.1 or higher. The vulnerabilities and fix versions are described above. If affected, you should upgrade to the latest version immediately. If you are running Fisheye or Crucible 4.4.x and cannot upgrade to 4.5.1, upgrade to version 4.4.3. For a full description of the latest version of Fisheye, see the release notes found at https://confluence.atlassian.com/display/FISHEYE/Fisheye+releases. You can download the latest version of Fisheye from the download centre found at https://www.atlassian.com/software/fisheye/download. For a full description of the latest version of Crucible, see the release notes found at https://confluence.atlassian.com/display/CRUCIBLE/Crucible+releases. You can download the latest version of Crucible from the download centre found at https://www.atlassian.com/software/crucible/download. Support: If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/.

[SECURITY] [DSA 4015-1] openjdk-8 security update

- ------------------------------------------------------------------------- Debian Security Advisory DSA-4015-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff November 02, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : openjdk-8 CVE ID : CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388 Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in impersonation of Kerberos services, denial of service, sandbox bypass or HTTP header injection. For the stable distribution (stretch), these problems have been fixed in version 8u151-b12-1~deb9u1. We recommend that you upgrade your openjdk-8 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/