The following updates has been released for Debian:
[DLA 992-1] eglibc security update
[DLA 993-1] linux security update
[DSA 3886-1] linux security update
[DSA 3887-1] glibc security update
[DSA 3888-1] exim4 security update
[DSA 3889-1] libffi security update
[DLA 992-1] eglibc security update
[DLA 993-1] linux security update
[DSA 3886-1] linux security update
[DSA 3887-1] glibc security update
[DSA 3888-1] exim4 security update
[DSA 3889-1] libffi security update
[DLA 992-1] eglibc security update
Package : eglibc
Version : 2.13-38+deb7u12
CVE ID : CVE-2017-1000366
The Qualys Research Labs discovered various problems in the dynamic
linker of the GNU C Library which allow local privilege escalation by
clashing the stack. For the full details, please refer to their advisory
published at:
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
For Debian 7 "Wheezy", these problems have been fixed in version
2.13-38+deb7u12.
We recommend that you upgrade your eglibc packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[DLA 993-1] linux security update
Package : linux
Version : 3.2.89-1
CVE ID : CVE-2017-0605 CVE-2017-7487 CVE-2017-7645 CVE-2017-7895
CVE-2017-8890 CVE-2017-8924 CVE-2017-8925 CVE-2017-9074
CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 CVE-2017-9242
CVE-2017-1000364
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
CVE-2017-0605
A buffer overflow flaw was discovered in the trace subsystem.
CVE-2017-7487
Li Qiang reported a reference counter leak in the ipxitf_ioctl
function which may result into a use-after-free vulnerability,
triggerable when a IPX interface is configured.
CVE-2017-7645
Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd discovered that
the NFSv2 and NFSv3 server implementations are vulnerable to an
out-of-bounds memory access issue while processing arbitrarily long
arguments sent by NFSv2/NFSv3 PRC clients, leading to a denial of
service.
CVE-2017-7895
Ari Kauppi from Synopsys Ltd discovered that the NFSv2 and NFSv3
server implementations do not properly handle payload bounds
checking of WRITE requests. A remote attacker with write access to a
NFS mount can take advantage of this flaw to read chunks of
arbitrary memory from both kernel-space and user-space.
CVE-2017-8890
It was discovered that the net_csk_clone_lock() function allows a
remote attacker to cause a double free leading to a denial of
service or potentially have other impact.
CVE-2017-8924
Johan Hovold found that the io_ti USB serial driver could leak
sensitive information if a malicious USB device was connected.
CVE-2017-8925
Johan Hovold found a reference counter leak in the omninet USB
serial driver, resulting in a use-after-free vulnerability. This
can be triggered by a local user permitted to open tty devices.
CVE-2017-9074
Andrey Konovalov reported that the IPv6 fragmentation
implementation could read beyond the end of a packet buffer. A
local user or guest VM might be able to use this to leak sensitive
information or to cause a denial of service (crash).
CVE-2017-9075
Andrey Konovalov reported that the SCTP/IPv6 implementation
wrongly initialised address lists on connected sockets, resulting
in a use-after-free vulnerability, a similar issue to
CVE-2017-8890. This can be triggered by any local user.
CVE-2017-9076 / CVE-2017-9077
Cong Wang found that the TCP/IPv6 and DCCP/IPv6 implementations
wrongly initialised address lists on connected sockets, a similar
issue to CVE-2017-9075.
CVE-2017-9242
Andrey Konovalov reported a packet buffer overrun in the IPv6
implementation. A local user could use this for denial of service
(memory corruption; crash) and possibly for privilege escalation.
CVE-2017-1000364
The Qualys Research Labs discovered that the size of the stack guard
page is not sufficiently large. The stack-pointer can jump over the
guard-page and moving from the stack into another memory region
without accessing the guard-page. In this case no page-fault
exception is raised and the stack extends into the other memory
region. An attacker can exploit this flaw for privilege escalation.
The default stack gap protection is set to 256 pages and can be
configured via the stack_guard_gap kernel parameter on the kernel
command line.
Further details can be found at
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
For Debian 7 "Wheezy", these problems have been fixed in version
3.2.89-1. This version also includes bug fixes from upstream version
3.2.89.
For Debian 8 "Jessie", these problems have been fixed in version
3.16.43-2+deb8u1.
For Debian 9 "Stretch", these problems have been fixed in version
4.9.30-2+deb9u1 or earlier versions before the stretch release.
We recommend that you upgrade your linux packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[DSA 3886-1] linux security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3886-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
June 19, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : linux
CVE ID : CVE-2017-0605 CVE-2017-7487 CVE-2017-7645 CVE-2017-7895
CVE-2017-8064 CVE-2017-8890 CVE-2017-8924 CVE-2017-8925
CVE-2017-9074 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077
CVE-2017-9242 CVE-2017-1000364
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
CVE-2017-0605
A buffer overflow flaw was discovered in the trace subsystem.
CVE-2017-7487
Li Qiang reported a reference counter leak in the ipxitf_ioctl
function which may result into a use-after-free vulnerability,
triggerable when a IPX interface is configured.
CVE-2017-7645
Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd discovered that
the NFSv2 and NFSv3 server implementations are vulnerable to an
out-of-bounds memory access issue while processing arbitrarily long
arguments sent by NFSv2/NFSv3 PRC clients, leading to a denial of
service.
CVE-2017-7895
Ari Kauppi from Synopsys Ltd discovered that the NFSv2 and NFSv3
server implementations do not properly handle payload bounds
checking of WRITE requests. A remote attacker with write access to a
NFS mount can take advantage of this flaw to read chunks of
arbitrary memory from both kernel-space and user-space.
CVE-2017-8064
Arnd Bergmann found that the DVB-USB core misused the device
logging system, resulting in a use-after-free vulnerability, with
unknown security impact.
CVE-2017-8890
It was discovered that the net_csk_clone_lock() function allows a
remote attacker to cause a double free leading to a denial of
service or potentially have other impact.
CVE-2017-8924
Johan Hovold found that the io_ti USB serial driver could leak
sensitive information if a malicious USB device was connected.
CVE-2017-8925
Johan Hovold found a reference counter leak in the omninet USB
serial driver, resulting in a use-after-free vulnerability. This
can be triggered by a local user permitted to open tty devices.
CVE-2017-9074
Andrey Konovalov reported that the IPv6 fragmentation
implementation could read beyond the end of a packet buffer. A
local user or guest VM might be able to use this to leak sensitive
information or to cause a denial of service (crash).
CVE-2017-9075
Andrey Konovalov reported that the SCTP/IPv6 implementation
wrongly initialised address lists on connected sockets, resulting
in a use-after-free vulnerability, a similar issue to
CVE-2017-8890. This can be triggered by any local user.
CVE-2017-9076 / CVE-2017-9077
Cong Wang found that the TCP/IPv6 and DCCP/IPv6 implementations
wrongly initialised address lists on connected sockets, a similar
issue to CVE-2017-9075.
CVE-2017-9242
Andrey Konovalov reported a packet buffer overrun in the IPv6
implementation. A local user could use this for denial of service
(memory corruption; crash) and possibly for privilege escalation.
CVE-2017-1000364
The Qualys Research Labs discovered that the size of the stack guard
page is not sufficiently large. The stack-pointer can jump over the
guard-page and moving from the stack into another memory region
without accessing the guard-page. In this case no page-fault
exception is raised and the stack extends into the other memory
region. An attacker can exploit this flaw for privilege escalation.
The default stack gap protection is set to 256 pages and can be
configured via the stack_guard_gap kernel parameter on the kernel
command line.
Further details can be found at
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
For the oldstable distribution (jessie), these problems have been fixed
in version 3.16.43-2+deb8u1.
For the stable distribution (stretch), these problems have been fixed in
version 4.9.30-2+deb9u1 or earlier versions before the stretch release.
We recommend that you upgrade your linux packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 3887-1] glibc security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3887-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
June 19, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : glibc
CVE ID : CVE-2017-1000366
The Qualys Research Labs discovered various problems in the dynamic
linker of the GNU C Library which allow local privilege escalation by
clashing the stack. For the full details, please refer to their advisory
published at:
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
For the oldstable distribution (jessie), this problem has been fixed
in version 2.19-18+deb8u10.
For the stable distribution (stretch), this problem has been fixed in
version 2.24-11+deb9u1.
For the unstable distribution (sid), this problem will be fixed soon.
We recommend that you upgrade your glibc packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 3888-1] exim4 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3888-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
June 19, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : exim4
CVE ID : CVE-2017-1000369
The Qualys Research Labs discovered a memory leak in the Exim mail
transport agent. This is not a security vulnerability in Exim by itself,
but can be used to exploit a vulnerability in stack handling. For the
full details, please refer to their advisory published at:
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
For the oldstable distribution (jessie), this problem has been fixed
in version 4.84.2-2+deb8u4.
For the stable distribution (stretch), this problem has been fixed in
version 4.89-2+deb9u1.
For the unstable distribution (sid), this problem will be fixed soon.
We recommend that you upgrade your exim4 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[DSA 3889-1] libffi security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3889-1 security@debian.org
https://www.debian.org/security/ Yves-Alexis Perez
June 19, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libffi
CVE ID : CVE-2017-1000376
Debian Bug : 751907
libffi, a library used to call code written in one language from code written
in a different language, was enforcing an executable stack on the i386
architecture. While this might not be considered a vulnerability by itself,
this could be leveraged when exploiting other vulnerabilities, like for example
the "stack clash" class of vulnerabilities discovered by Qualys Research Labs.
For the full details, please refer to their advisory published at:
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
For the oldstable distribution (jessie), this problem has been fixed
in version 3.1-2+deb8u1.
For the stable distribution (stretch), this problem has been fixed in
version 3.2.1-4.
For the testing distribution (buster), this problem has been fixed
in version 3.2.1-4.
For the unstable distribution (sid), this problem has been fixed in
version 3.2.1-4.
We recommend that you upgrade your libffi packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
