The following updates has been released for Debian GNU/Linux:
Debian GNU/Linux 7 Extended LTS:
ELA-46-1 libxml2 security update
Debian GNU/Linux 8 LTS:
DLA 1518-1: polarssl security update
DLA 1519-1: python2.7 security update
DLA 1520-1: python3.4 security update
Debian GNU/Linux 7 Extended LTS:
ELA-46-1 libxml2 security update
Debian GNU/Linux 8 LTS:
DLA 1518-1: polarssl security update
DLA 1519-1: python2.7 security update
DLA 1520-1: python3.4 security update
ELA-46-1 libxml2 security update
Package: libxml2
Version: 2.8.0+dfsg1-7+wheezy13
Related CVE: CVE-2018-14404 CVE-2018-14567 CVE-2018-9251 CVE-2017-18258
CVE-2018-14404 Fix of a NULL pointer dereference which might result in a crash and thus in a denial of service.
CVE-2018-14567 and CVE-2018-9251 Approvement in LZMA error handling which prevents an infinite loop.
CVE-2017-18258 Limit available memory to 100MB to avoid exhaustive memory consumption by malicious files.
For Debian 7 Wheezy, these problems have been fixed in version 2.8.0+dfsg1-7+wheezy13.
We recommend that you upgrade your libxml2 packages.
Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/
DLA 1518-1: polarssl security update
Package : polarssl
Version : 1.3.9-2.1+deb8u4
CVE ID : CVE-2013-0169 CVE-2018-0497 CVE-2018-0498 CVE-2018-9988
CVE-2018-9989
Debian Bug :
Two vulnerabilities were discovered in polarssl, a lightweight crypto and
SSL/TLS library (nowadays continued under the name mbedtls) which could
result in plain text recovery via side-channel attacks.
Two other minor vulnerabilities were discovered in polarssl which could
result in arithmetic overflow errors.
CVE-2018-0497
As a protection against the Lucky Thirteen attack, the TLS code for
CBC decryption in encrypt-then-MAC mode performs extra MAC
calculations to compensate for variations in message size due to
padding. The amount of extra MAC calculation to perform was based on
the assumption that the bulk of the time is spent in processing
64-byte blocks, which is correct for most supported hashes but not for
SHA-384. Correct the amount of extra work for SHA-384 (and SHA-512
which is currently not used in TLS, and MD2 although no one should
care about that).
This is a regression fix for what CVE-2013-0169 had been fixed this.
CVE-2018-0498
The basis for the Lucky 13 family of attacks is for an attacker to be
able to distinguish between (long) valid TLS-CBC padding and invalid
TLS-CBC padding. Since our code sets padlen = 0 for invalid padding,
the length of the input to the HMAC function gives information about
that.
Information about this length (modulo the MD/SHA block size) can be
deduced from how much MD/SHA padding (this is distinct from TLS-CBC
padding) is used. If MD/SHA padding is read from a (static) buffer, a
local attacker could get information about how much is used via a
cache attack targeting that buffer.
Let's get rid of this buffer. Now the only buffer used is the
internal MD/SHA one, which is always read fully by the process()
function.
CVE-2018-9988
Prevent arithmetic overflow on bounds check and add bound check
before signature length read in ssl_parse_server_key_exchange().
CVE-2018-9989
Prevent arithmetic overflow on bounds check and add bound check
before length read in ssl_parse_server_psk_hint()
For Debian 8 "Jessie", these problems have been fixed in version
1.3.9-2.1+deb8u4.
We recommend that you upgrade your polarssl packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
DLA 1519-1: python2.7 security update
Package : python2.7
Version : 2.7.9-2+deb8u2
CVE ID : CVE-2017-1000158 CVE-2018-1060 CVE-2018-1061 CVE-2018-1000802
Multiple vulnerabilities were found in the CPython interpreter which
can cause denial of service, information gain, and arbitrary code
execution.
CVE-2017-1000158
CPython (aka Python) is vulnerable to an integer overflow in the
PyString_DecodeEscape function in stringobject.c, resulting in
heap-based buffer overflow (and possible arbitrary code execution)
CVE-2018-1060
python is vulnerable to catastrophic backtracking in pop3lib's
apop() method. An attacker could use this flaw to cause denial of
service.
CVE-2018-1061
python is vulnerable to catastrophic backtracking in the
difflib.IS_LINE_JUNK method. An attacker could use this flaw to
cause denial of service.
CVE-2018-1000802
Python Software Foundation Python (CPython) version 2.7 contains a
CWE-77: Improper Neutralization of Special Elements used in a
Command ('Command Injection') vulnerability in shutil module
(make_archive function) that can result in Denial of service,
Information gain via injection of arbitrary files on the system or
entire drive. This attack appear to be exploitable via Passage of
unfiltered user input to the function.
For Debian 8 "Jessie", these problems have been fixed in version
2.7.9-2+deb8u2.
We recommend that you upgrade your python2.7 packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
--
DLA 1520-1: python3.4 security update
Package : python3.4
Version : 3.4.2-1+deb8u1
CVE ID : CVE-2017-1000158 CVE-2018-1060 CVE-2018-1061 CVE-2018-1000802
Multiple vulnerabilities were found in the CPython interpreter which
can cause denial of service, information gain, and arbitrary code
execution.
CVE-2017-1000158
CPython (aka Python) is vulnerable to an integer overflow in the
PyString_DecodeEscape function in stringobject.c, resulting in
heap-based buffer overflow (and possible arbitrary code execution)
CVE-2018-1060
python is vulnerable to catastrophic backtracking in pop3lib's
apop() method. An attacker could use this flaw to cause denial of
service.
CVE-2018-1061
python is vulnerable to catastrophic backtracking in the
difflib.IS_LINE_JUNK method. An attacker could use this flaw to
cause denial of service.
CVE-2018-1000802
Python Software Foundation Python (CPython) version 2.7 contains a
CWE-77: Improper Neutralization of Special Elements used in a
Command ('Command Injection') vulnerability in shutil module
(make_archive function) that can result in Denial of service,
Information gain via injection of arbitrary files on the system or
entire drive. This attack appear to be exploitable via Passage of
unfiltered user input to the function.
For Debian 8 "Jessie", these problems have been fixed in version
3.4.2-1+deb8u1.
We recommend that you upgrade your python3.4 packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
