The following security updates has been released for Arch Linux:
ASA-201811-16: chromium: information disclosure
ASA-201811-17: libtiff: multiple issues
ASA-201811-16: chromium: information disclosure
ASA-201811-17: libtiff: multiple issues
ASA-201811-16: chromium: information disclosure
Arch Linux Security Advisory ASA-201811-16
==========================================
Severity: Medium
Date : 2018-11-20
CVE-ID : CVE-2018-17478
Package : chromium
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-812
Summary
=======
The package chromium before version 70.0.3538.110-1 is vulnerable to
information disclosure.
Resolution
==========
Upgrade to 70.0.3538.110-1.
# pacman -Syu "chromium>=70.0.3538.110-1"
The problem has been fixed upstream in version 70.0.3538.110.
Workaround
==========
None.
Description
===========
An out of bounds memory access has been found in the V8 component of
the chromium browser before 70.0.3538.110.
Impact
======
A remote attacker can access sensitive information or crash the browser
via a crafted web page.
References
==========
https://chromereleases.googleblog.com/2018/11/stable-channel-update-for-desktop.html
https://bugs.chromium.org/p/chromium/issues/detail?id=897512
https://security.archlinux.org/CVE-2018-17478
ASA-201811-17: libtiff: multiple issues
Arch Linux Security Advisory ASA-201811-17
==========================================
Severity: High
Date : 2018-11-20
CVE-ID : CVE-2017-9935 CVE-2017-11613 CVE-2018-18557 CVE-2018-18661
Package : libtiff
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-790
Summary
=======
The package libtiff before version 4.0.10-1 is vulnerable to multiple
issues including arbitrary code execution and denial of service.
Resolution
==========
Upgrade to 4.0.10-1.
# pacman -Syu "libtiff>=4.0.10-1"
The problems have been fixed upstream in version 4.0.10.
Workaround
==========
None.
Description
===========
- CVE-2017-9935 (arbitrary code execution)
In LibTIFF before 4.0.10, there is a heap-based buffer overflow in the
t2p_write_pdf function in tools/tiff2pdf.c. This heap overflow could
lead to different damages. For example, a crafted TIFF document can
lead to an out-of-bounds read in TIFFCleanup, an invalid free in
TIFFClose or t2p_free, memory corruption in t2p_readwrite_pdf_image, or
a double free in t2p_free. Given these possibilities, it probably could
cause arbitrary code execution.
- CVE-2017-11613 (denial of service)
In LibTIFF before 4.0.10, there is a denial of service vulnerability in
the TIFFOpen function triggered by resource consumption via crafted
input files. During the TIFFOpen process, td_imagelength is not
checked. The value of td_imagelength can be directly controlled by an
input file. In the ChopUpSingleUncompressedStrip function, the
_TIFFCheckMalloc function is called based on td_imagelength. If we set
the value of td_imagelength close to the amount of system memory, it
will hang the system or trigger the OOM killer.
- CVE-2018-18557 (arbitrary code execution)
LibTIFF before 4.0.10 (with JBIG enabled) decodes arbitrarily-sized
JBIG into a buffer, ignoring the buffer size, which leads to a
tif_jbig.c JBIGDecode out-of-bounds write.
- CVE-2018-18661 (denial of service)
A null-pointer dereference has been found in LibTIFF before 4.0.10 in
the LZWDecode() function in the file tif_lzw.c.
Impact
======
A remote attacker might be able to cause a denial of service or execute
arbitrary code on the affected host via a crafted picture file.
References
==========
https://bugs.archlinux.org/task/60599
http://bugzilla.maptools.org/show_bug.cgi?id=2704
https://gitlab.com/libtiff/libtiff/commit/5848777bd7e4f465681a7c4d0acf96a1dbd5b75c
http://bugzilla.maptools.org/show_bug.cgi?id=2724
https://gitlab.com/libtiff/libtiff/commit/3719385a3fac5cfb20b487619a5f08abbf967cf8
https://gitlab.com/libtiff/libtiff/commit/7a092f8af2568d61993a8cc2e7a35a998d7d37be
https://bugs.chromium.org/p/project-zero/issues/detail?id=1697
https://gitlab.com/libtiff/libtiff/merge_requests/38
https://gitlab.com/libtiff/libtiff/commit/681748ec2f5ce88da5f9fa6831e1653e46af8a66
http://bugzilla.maptools.org/show_bug.cgi?id=2819
https://gitlab.com/libtiff/libtiff/commit/99b10edde9a0fc28cc0e7b7757aa18ac4c8c225f
https://security.archlinux.org/CVE-2017-9935
https://security.archlinux.org/CVE-2017-11613
https://security.archlinux.org/CVE-2018-18557
https://security.archlinux.org/CVE-2018-18661