Ubuntu Security Notice 5707-1 - It was discovered that Libtasn1 did not properly perform bounds checking. An attacker could possibly use this issue to cause a crash.

    ==========================================================================Ubuntu Security Notice USN-5707-1October 31, 2022libtasn1-6 vulnerability==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 16.04 ESMSummary:Libtasn1 could cause a crash when processing certain inputs.Software Description:- libtasn1-6 - Library to manage ASN.1 structuresDetails:It was discovered that Libtasn1 did not properly perform boundschecking. An attacker could possibly use this issue to cause acrash.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 16.04 ESM:   libtasn1-6                   4.7-3ubuntu0.16.04.3+esm3In general, a standard system update will make all the necessary changes.References:   https://ubuntu.com/security/notices/USN-5707-1   CVE-2021-46848

Ubuntu Security Notice USN-5707-1

Gentoo Linux Security Advisory 202210-36 - A vulnerability has been found in libjxl which could result in denial of service. Versions less than 0.7.0_pre20220825 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202210-36  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Low  
    Title: libjxl: Denial of Service  
     Date: October 31, 2022  
     Bugs: #856037  
       ID: 202210-36

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
A vulnerability has been found in libjxl which could result in denial of  
service.

Background  
=========  
libjxl is the JPEG XL image format reference implementation.

Affected packages  
================  
    -------------------------------------------------------------------  
     Package              /     Vulnerable     /            Unaffected  
    -------------------------------------------------------------------  
  1  media-libs/libjxl          < 0.7.0_pre20220825>= 0.7.0_pre20220825

Description  
==========  
libjxl contains an unecessary assertion in  
jxl::LowMemoryRenderPipeline::Init.

Impact  
=====  
An attacker can cause a denial of service of the libjxl process via a  
crafted input file.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=media-libs/libjxl-0.7.0_pre20220825"

References  
=========  
[ 1 ] CVE-2022-34000  
      https://nvd.nist.gov/vuln/detail/CVE-2022-34000

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202210-36

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2022 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202210-36

Gentoo Linux Security Advisory 202210-37 - Multiple vulnerabilities have been found in PJSIP, the worst of which could result in arbitrary code execution. Versions less than 2.12.1 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202210-37  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: PJSIP: Multiple Vulnerabilities  
     Date: October 31, 2022  
     Bugs: #803614, #829894, #875863  
       ID: 202210-37

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
=======  
Multiple vulnerabilities have been found in PJSIP, the worst of which  
could result in arbitrary code execution.

Background  
=========  
PJSIP is a free and open source multimedia communication library written  
in C language implementing standard based protocols such as SIP, SDP,  
RTP, STUN, TURN, and ICE.

Affected packages  
================  
    -------------------------------------------------------------------  
     Package              /     Vulnerable     /            Unaffected  
    -------------------------------------------------------------------  
  1  net-libs/pjproject         < 2.12.1                    >= 2.12.1

Description  
==========  
Multiple vulnerabilities have been discovered in PJSIP. Please review  
the CVE identifiers referenced below for details.

Impact  
=====  
Please review the referenced CVE identifiers for details.

Workaround  
=========  
There is no known workaround at this time.

Resolution  
=========  
All PJSIP users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=net-libs/pjproject-2.12.1"

References  
=========  
[ 1 ] CVE-2021-32686  
      https://nvd.nist.gov/vuln/detail/CVE-2021-32686  
[ 2 ] CVE-2021-37706  
      https://nvd.nist.gov/vuln/detail/CVE-2021-37706  
[ 3 ] CVE-2021-41141  
      https://nvd.nist.gov/vuln/detail/CVE-2021-41141  
[ 4 ] CVE-2021-43804  
      https://nvd.nist.gov/vuln/detail/CVE-2021-43804  
[ 5 ] CVE-2021-43845  
      https://nvd.nist.gov/vuln/detail/CVE-2021-43845  
[ 6 ] CVE-2022-21722  
      https://nvd.nist.gov/vuln/detail/CVE-2022-21722  
[ 7 ] CVE-2022-21723  
      https://nvd.nist.gov/vuln/detail/CVE-2022-21723  
[ 8 ] CVE-2022-23608  
      https://nvd.nist.gov/vuln/detail/CVE-2022-23608  
[ 9 ] CVE-2022-24754  
      https://nvd.nist.gov/vuln/detail/CVE-2022-24754  
[ 10 ] CVE-2022-24763  
      https://nvd.nist.gov/vuln/detail/CVE-2022-24763  
[ 11 ] CVE-2022-24764  
      https://nvd.nist.gov/vuln/detail/CVE-2022-24764  
[ 12 ] CVE-2022-24786  
      https://nvd.nist.gov/vuln/detail/CVE-2022-24786  
[ 13 ] CVE-2022-24792  
      https://nvd.nist.gov/vuln/detail/CVE-2022-24792  
[ 14 ] CVE-2022-24793  
      https://nvd.nist.gov/vuln/detail/CVE-2022-24793  
[ 15 ] CVE-2022-31031  
      https://nvd.nist.gov/vuln/detail/CVE-2022-31031  
[ 16 ] CVE-2022-39244  
      https://nvd.nist.gov/vuln/detail/CVE-2022-39244  
[ 17 ] CVE-2022-39269  
      https://nvd.nist.gov/vuln/detail/CVE-2022-39269

Availability  
===========  
This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202210-37

Concerns?  
========  
Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
======  
Copyright 2022 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202210-37

Gentoo Linux Security Advisory 202210-33 - A vulnerability has been discovered in Libtirpc which could result in denial of service. Versions less than 1.3.2 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202210-33  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: Libtirpc: Denial of Service  
     Date: October 31, 2022  
     Bugs: #859634  
       ID: 202210-33

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

A vulnerability has been discovered in Libtirpc which could result in  
denial of service.

Background  
==========

Libtirpc is a port of Sun's Transport-Independent RPC library to Linux.

Affected packages  
=================

    -------------------------------------------------------------------  
     Package              /     Vulnerable     /            Unaffected  
    -------------------------------------------------------------------  
  1  net-libs/libtirpc          < 1.3.2                      >= 1.3.2

Description  
===========

Currently svc_run does not handle poll timeout and rendezvous_request  
does not handle EMFILE error returned from accept(2 as it used to.  
These two missing functionality were removed by commit b2c9430f46c4.

The effect of not handling poll timeout allows idle TCP conections  
to remain ESTABLISHED indefinitely. When the number of connections  
reaches the limit of the open file descriptors (ulimit -n) then  
accept(2) fails with EMFILE. Since there is no handling of EMFILE  
error this causes svc_run() to get in a tight loop calling accept(2).  
This resulting in the RPC service of svc_run is being down, it's  
no longer able to service any requests.

Due to a lack of handling of certain error cases, connections to  
Libtirpc could remain ESTABLISHED indefinitely.

Impact  
======

Denial of service can be achieved via establishing enough connections to  
Libtirpc to reach the limit of open file descriptors for the process.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All Libtirpc users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=net-libs/libtirpc-1.3.2"

References  
==========

[ 1 ] CVE-2021-46828  
      https://nvd.nist.gov/vuln/detail/CVE-2021-46828

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202210-33

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2022 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202210-33

Debian Linux Security Advisory 5267-1 - Nicky Mouha discovered a buffer overflow in 'sha3', a Python library for the SHA-3 hashing functions.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5267-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffOctober 30, 2022                      https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : pysha3CVE ID         : CVE-2022-37454Debian Bug     : 1023030Nicky Mouha discovered a buffer overflow in 'sha3', a Python library forthe SHA-3 hashing functions.For the stable distribution (bullseye), this problem has been fixed inversion 1.0.2-4.1+deb11u1.We recommend that you upgrade your pysha3 packages.For the detailed security status of pysha3 please refer toits security tracker page at:https://security-tracker.debian.org/tracker/pysha3Further information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmNeydYACgkQEMKTtsN8TjZM0RAAk28/0iK+MlZR4EtgLm8chSw8YsaDjyCC6yVv82fz5yjYRhNkCteunkH0ffN2B8EXRJN8pqRV89ptnwOkwW3KjaJ6un3new3Zg4sPFB2DULd3yoxD3YGlzbh/EmHsnDSN88M8TSSi6IGErBIrMNqKt0FORg9/whpujDOJToo5np8uV7/SZNEMo2BOLtLIoXjMB4erlaI5pEE9/mEr6hzXJNsiVy82GtGZESuFo0XWu3hsD6BCzBvWKvZIOuALuTE9BEPGWJBPAIAqDS48yEd8KXiSEex9zsxdAa2vhsFHJ3U1LvwxZY0DvjG5JSjImc9U/p7DrwHhSyuS/pUFkR47Hl+d5i6+9IcU3lvFjszrq9bX019HuF2/U9ZfgvNQL/LmUpxFEyEziE3xkMG/SBP809fJ+UAU1XRV4qj6Yd/dN9TBZXE4eTcjzVCnjxjEzJKjaMcNl1qMM5JanG69iuGdy61ubTA/vEjxNH3qQOnJmITc1RuLlpkiU7TVA6ggNJ59xPQLLvgJ0lTY0oOQ0+pGh8aTHixHQFa35ynES6i+gKULv6M+fa/oayRLpw+06fGoSxdPmM8LHp9c54pLN3KgPIIcb/Aimkl+ReUYnrSXsaerfmyXS3f0LEjfhSxozXAooTxRr3eh5pUpTd3fuooodn9Zh3o5E5QcTbK82UGkTLI==p4UM-----END PGP SIGNATURE-----

Debian Security Advisory 5267-1

The Qualys Research Team has discovered authorization bypass and symlink vulnerabilities in multipathd. The authorization bypass was introduced in version 0.7.0 and the symlink vulnerability was introduced in version 0.7.7.

    Qualys Security AdvisoryLeeloo Multipath: Authorization bypass and symlink attack in multipathd(CVE-2022-41974 and CVE-2022-41973)========================================================================Contents========================================================================SummaryCVE-2022-41974: Authorization bypassCVE-2022-41973: Symlink attackAcknowledgmentsTimeline========================================================================Summary========================================================================We discovered two local vulnerabilities (an authorization bypass and asymlink attack) in multipathd, a daemon that is running as root in thedefault installation of (for example) Ubuntu Server:https://ubuntu.com/server/docs/device-mapper-multipathing-introductionhttps://github.com/opensvc/multipath-toolsWe combined these two vulnerabilities with a third vulnerability, inanother package that is also installed by default on Ubuntu Server, andobtained full root privileges on Ubuntu Server 22.04; other releases areprobably also exploitable. We will publish this third vulnerability, andthe complete details of this local privilege escalation, in an upcomingadvisory.The authorization bypass (CVE-2022-41974) was introduced in February2017 (version 0.7.0) by commit 9acda0c ("Perform socket client uid checkon IPC commands"), but earlier versions perform no authorization checksat all: any unprivileged local user can issue any privileged command tomultipathd.The symlink attack (CVE-2022-41973) was introduced in May 2018 (version0.7.7) by commit 65d0a63 ("functions to indicate mapping failure in/dev/shm"); the vulnerable code was hardened significantly in May 2020(version 0.8.5) by commit 40ee3ea ("simplify failed wwid code"), but itremains exploitable nonetheless.========================================================================CVE-2022-41974: Authorization bypass========================================================================The multipathd daemon listens for client connections on an abstract Unixsocket (conveniently, the multipathd binary itself can act as a client,if executed with non-option arguments; we use this feature extensivelyin this advisory to connect and send commands to the multipathd daemon):------------------------------------------------------------------------$ ps -ef | grep 'multipath[d]'root         377       1  0 13:55 ?        00:00:00 /sbin/multipathd -d -s$ ss -l -x | grep 'multipathd'u_str LISTEN 0      4096        @/org/kernel/linux/storage/multipathd 18105------------------------------------------------------------------------The commands sent by a client to multipathd are composed of keywords,and internally, each keyword is identified by a different bit; forexample, "list" is 1 (1<<0), "add" is 2 (1<<1), and "path" (whichrequires a parameter) is 65536 (1<<16):------------------------------------------------------------------------155 load_keys (void)...163         r += add_key(keys, "list", LIST, 0);164         r += add_key(keys, "show", LIST, 0);165         r += add_key(keys, "add", ADD, 0);...183         r += add_key(keys, "path", PATH, 1);------------------------------------------------------------------------ 53 #define LIST            (1ULL << __LIST) 54 #define ADD             (1ULL << __ADD) .. 69 #define PATH            (1ULL << __PATH)------------------------------------------------------------------------  6 enum {  7         __LIST,                 /*  0 */  8         __ADD, .. 23         __PATH,------------------------------------------------------------------------In turn, each command is associated with a handler (a C function) by itsfingerprint -- the bitwise OR of its constituent keywords; for example,the command "list path PARAM" is associated with cli_list_path() by thefingerprint 65537 (LIST+PATH=1+65536), and the command "add path PARAM"is associated with cli_add_path() by the fingerprint 65538(ADD+PATH=2+65536):------------------------------------------------------------------------1522 void init_handler_callbacks(void)....1527         set_handler_callback(LIST+PATH, cli_list_path);....1549         set_handler_callback(ADD+PATH, cli_add_path);------------------------------------------------------------------------321 static uint64_t322 fingerprint(const struct _vector *vec)...325         uint64_t fp = 0;...331         vector_foreach_slot(vec, kw, i)332                 fp += kw->code;333 334         return fp;------------------------------------------------------------------------ 89 static struct handler * 90 find_handler (uint64_t fp) .. 95         vector_foreach_slot (handlers, h, i) 96                 if (h->fingerprint == fp) 97                         return h; 98  99         return NULL;------------------------------------------------------------------------When multipathd receives a command from a client, it first performs anauthentication check and an authorization check (both at line 491):------------------------------------------------------------------------431 static int client_state_machine(struct client *c, struct vectors *vecs,...485         case CLT_PARSE:486                 c->error = parse_cmd(c);487                 if (!c->error) {...491                         if (!c->is_root && kw->code != LIST) {492                                 c->error = -EPERM;...495                         }496                 }497                 if (c->error)...501                 else502                         set_client_state(c, CLT_WORK);...522         case CLT_WORK:523                 c->error = execute_handler(c, vecs);------------------------------------------------------------------------- Authentication: if the client's UID (obtained from SO_PEERCRED) is 0  (i.e., if is_root is true), then the client is privileged; otherwise,  it is unprivileged.- Authorization: if the client is privileged, it is allowed to execute  any commands; otherwise, only unprivileged LIST commands are allowed  (i.e., commands whose first keyword is either "list" or "show").Attentive readers may have noticed that multipathd does not, in fact,calculate the fingerprint of a command by bitwise-ORing its constituentkeywords, but by arithmetic-ADDing them (at line 332). While these twooperations are equivalent if no keyword is repeated, we (attackers) cansend a seemingly unprivileged command (whose first keyword is "list")but whose fingerprint matches a privileged command (by repeating the"list" keyword): we can exploit this flaw to bypass multipathd'sauthorization check.For example, we are not allowed to execute "add path PARAM" (whosefingerprint is 2+65536=65538) because the first keyword is not "list",but we are allowed to execute the equivalent "list list path PARAM"(whose fingerprint is also 1+1+65536=65538, instead of 1|1|65536=65537)because the first keyword is "list" (the multipathd daemon below replies"blacklisted" because PARAM is an invalid path, not because the commandis denied):------------------------------------------------------------------------$ multipathd add path PARAMpermission deny: need to be root$ multipathd list list path PARAMblacklisted------------------------------------------------------------------------This authorization bypass greatly enlarges the attack surface ofmultipathd: 34 privileged command handlers become available to localattackers, in addition to the 23 unprivileged command handlers that arenormally available. We audited only a few of these command handlers,because we quickly discovered a low-hanging vulnerability (a symlinkattack) in one of them.========================================================================CVE-2022-41973: Symlink attack========================================================================multipathd operates insecurely, as root, in /dev/shm (a sticky,world-writable directory similar to /tmp). The vulnerable code (inmark_failed_wwid()) may be executed during the normal lifetime ofmultipathd, but a local attacker can force its execution by exploitingthe authorization bypass CVE-2022-41974; for example, by adding a"whitelisted, unmonitored" device to multipathd:------------------------------------------------------------------------$ multipathd list devices | grep 'whitelisted, unmonitored'    sda1 devnode whitelisted, unmonitored    ...$ multipathd list list path sda1fail------------------------------------------------------------------------This command, which is equivalent to "add path sda1", results in thefollowing system-call trace (strace) of the multipathd daemon:------------------------------------------------------------------------386 openat(AT_FDCWD, "/dev/shm/multipath/failed_wwids", O_RDONLY|O_DIRECTORY) = -1 ENOENT (No such file or directory)387 mkdir("/dev", 0700)                     = -1 EEXIST (File exists)388 mkdir("/dev/shm", 0700)                 = -1 EEXIST (File exists)389 mkdir("/dev/shm/multipath", 0700)       = 0390 mkdir("/dev/shm/multipath/failed_wwids", 0700) = 0391 openat(AT_FDCWD, "/dev/shm/multipath/failed_wwids", O_RDONLY|O_DIRECTORY) = 12392 getpid()                                = 375393 openat(12, "VBOX_HARDDISK_VB60265ca5-df119cb6.177", O_RDONLY|O_CREAT|O_EXCL, 0400) = 13394 close(13)                               = 0395 linkat(12, "VBOX_HARDDISK_VB60265ca5-df119cb6.177", 12, "VBOX_HARDDISK_VB60265ca5-df119cb6", 0) = 0396 unlinkat(12, "VBOX_HARDDISK_VB60265ca5-df119cb6.177", 0) = 0397 close(12)                               = 0------------------------------------------------------------------------- at line 389, the directory "/dev/shm/multipath" is created, if it does  not exist already;- at line 390, the directory "/dev/shm/multipath/failed_wwids" is  created, if it does not exist already;- at lines 391-397, the empty file  "/dev/shm/multipath/failed_wwids/VBOX_HARDDISK_VB60265ca5-df119cb6" is  created, if it does not exist already (its name is the "World Wide ID"  of the added device).multipathd is therefore vulnerable to two different symlink attacks:1/ if we (attackers) create an arbitrary symlink "/dev/shm/multipath",then we can create a directory named "failed_wwids" (user root, grouproot, mode 0700) anywhere in the filesystem;2/ if we create an arbitrary symlink "/dev/shm/multipath/failed_wwids",then we can create a file named "VBOX_HARDDISK_VB60265ca5-df119cb6"(user root, group root, mode 0400, size 0) anywhere in the filesystem.These two symlink attacks are very weak, because we do not control thename, user, group, mode, or contents of the directory or file that wecreate; only its location. Despite these limitations, we were able tocombine multipathd's vulnerabilities (authorization bypass and symlinkattack) with a third vulnerability (in another package), and obtainedfull root privileges on Ubuntu Server 22.04; we will publish this thirdvulnerability in an upcoming advisory.Side note: initially, we thought that the symlink attack 1/ would fail,because /dev/shm is a sticky world-writable directory, and the kernel'sfs.protected_symlinks is 1 by default; to our great surprise, however,it succeeded. Eventually, we understood that only the final component ofa path is protected, not its intermediate components; for example, if/tmp/foo is a symlink, then an access to /tmp/foo itself is protected,but an access to /tmp/foo/bar is not. Interestingly, this weakness wasalready pointed out in 2017 by Solar Designer, and the originalOpenwall, grsecurity, and Yama protections are not affected:https://www.openwall.com/lists/kernel-hardening/2017/06/06/74========================================================================Acknowledgments========================================================================We thank Martin Wilck and Benjamin Marzinski for their hard work on thisrelease, and the SUSE Security Team for their help with this disclosure.We also thank the members of linux-distros@openwall.========================================================================Timeline========================================================================2022-08-24: Advisory sent to security@suse.2022-10-10: Advisory and patches sent to linux-distros@openwall.2022-10-24: Coordinated Release Date (15:00 UTC).

Leeloo Multipath Authorization Bypass / Symlink Attack

Gentoo Linux Security Advisory 202210-32 - An integer overflow has been found in hiredis which could result in arbitrary code execution. Versions less than 1.0.1 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202210-32  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: hiredis, hiredis-py: Multiple Vulnerabilities  
     Date: October 31, 2022  
     Bugs: #873079, #816318  
       ID: 202210-32

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

An integer overflow has been found in hiredis which could result in  
arbitrary code execution.

Background  
==========

hiredis is a minimalistic C client library for the Redis database.

hiredis-py is a Python extension that wraps hiredis.

Affected packages  
=================

    -------------------------------------------------------------------  
     Package              /     Vulnerable     /            Unaffected  
    -------------------------------------------------------------------  
  1  dev-libs/hiredis           < 1.0.1                      >= 1.0.1  
  2  dev-python/hiredis         < 2.0.0                      >= 2.0.0

Description  
===========

Hiredis is vulnerable to integer overflow if provided maliciously  
crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing  
`multi-bulk` (array-like) replies, hiredis fails to check if `count *  
sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not,  
and the `calloc()` call doesn't itself make this check, it would result  
in a short allocation and subsequent buffer overflow.

Impact  
======

Malicious Redis commands could result in remote code execution.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All hiredis users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=dev-libs/hiredis-1.0.1"

All hiredis-py users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=dev-python/hiredis-2.0.0"

References  
==========

[ 1 ] CVE-2021-32765  
      https://nvd.nist.gov/vuln/detail/CVE-2021-32765

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202210-32

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2022 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202210-32

Debian Linux Security Advisory 5266-1 - A heap use-after-free vulnerability after overeager destruction of a shared DTD in the XML_ExternalEntityParserCreate function in Expat, an XML parsing C library, may result in denial of service or potentially the execution of arbitrary code.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5266-1                   security@debian.orghttps://www.debian.org/security/                     Salvatore BonaccorsoOctober 30, 2022                      https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : expatCVE ID         : CVE-2022-43680Debian Bug     : 1022743A heap use-after-free vulnerability after overeager destruction of ashared DTD in the XML_ExternalEntityParserCreate function in Expat, anXML parsing C library, may result in denial of service or potentiallythe execution of arbitrary code.For the stable distribution (bullseye), this problem has been fixed inversion 2.2.10-2+deb11u5.We recommend that you upgrade your expat packages.For the detailed security status of expat please refer to its securitytracker page at:https://security-tracker.debian.org/tracker/expatFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmNehABfFIAAAAAALgAoaXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xNDz0TT5RAAiDBqtdgoagQspAsmWvoT1IJw0fsx2IFA4ynzyAI33nXegNKfDUGmc9wWKVm4APPaFWvy9s4hlA7HeMUdRQRxuW2iL5q3Jnkbjcnm1kISTgxPymt0HFeJWr9TVRSQt0OqUtzzOvNAz2lSd86551EMPa/oS0fvLq/vDTC3mTL1WsoMsouJR+l7potTMtJf43G10AmfLx+XgSsfmHU2Hvf5S2PO7aEmNHic9HW7bwUqm6KF2lZs5Qo4IVykqQ3eKufLg0HZcOi+QMWxpKYzxOR/tnzYHjLAzTI7yjugBBufcaux1kYnB0ULnDLfOc+uHXuhttfji4sbEzGB9uWDX+rhtBszcaM/Ww53J8tDy3chnv93pi5em1ABQljrPjFz/+N4g4tsNgdCTvMjT332kPi6W9zFUA/iB21LP4H7xc3stGCVubZW0UVcvOu2ubCabr/XQBOtlnc4tj/L9UyQW+Rfqe9x1WHkhwTuHMg8/YcqWljv3LwTz1DXfyFF0vmSlliOr0POP7I0iJvrw647rVBaNEsVPNqFhPu5Ro5jd5y3gt+f763J692JXfTPQJc3PaJz37NCdupga7lPu1W5cSLAYtze5JxqH4XJaKFprpaGfo3OFIDas0Z5yIs8DxMbjmY9VlpMQ8vKfHYPgoKV+NRv9bKKpBLxYI/o4bq8uA4JgpE==bLU+-----END PGP SIGNATURE-----

Debian Security Advisory 5266-1

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.

Faraday 4.2.0

Apple Security Advisory 2022-10-27-15 - Safari 16.1 addresses code execution, spoofing, and use-after-free vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-2022-10-27-15 Additional information for APPLE-SA-2022-10-24-7 Safari 16.1

Safari 16.1 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/HT213495.

WebKit  
Available for: macOS Big Sur and macOS Monterey  
Impact: Visiting a malicious website may lead to user interface  
spoofing  
Description: The issue was addressed with improved UI handling.  
WebKit Bugzilla: 243693  
CVE-2022-42799: Jihwan Kim (@gPayl0ad), Dohyun Lee (@l33d0hyun)

WebKit  
Available for: macOS Big Sur and macOS Monterey  
Impact: Processing maliciously crafted web content may lead to  
arbitrary code execution  
Description: A type confusion issue was addressed with improved  
memory handling.  
WebKit Bugzilla: 244622  
CVE-2022-42823: Dohyun Lee (@l33d0hyun) of SSD Labs

WebKit  
Available for: macOS Big Sur and macOS Monterey  
Impact: Processing maliciously crafted web content may disclose  
sensitive user information  
Description: A logic issue was addressed with improved state  
management.  
WebKit Bugzilla: 245058  
CVE-2022-42824: Abdulrahman Alqabandi of Microsoft Browser  
Vulnerability Research, Ryan Shin of IAAI SecLab at Korea University,  
Dohyun Lee (@l33d0hyun) of DNSLab at Korea University

WebKit  
Available for: macOS Big Sur and macOS Monterey  
Impact: Processing maliciously crafted web content may disclose  
internal states of the app  
Description: A correctness issue in the JIT was addressed with  
improved checks.  
WebKit Bugzilla: 242964  
CVE-2022-32923: Wonyoung Jung (@nonetype_pwn) of KAIST Hacking Lab  
Entry added October 27, 2022

WebKit PDF  
Available for: macOS Big Sur and macOS Monterey  
Impact: Processing maliciously crafted web content may lead to  
arbitrary code execution  
Description: A use after free issue was addressed with improved  
memory management.  
WebKit Bugzilla: 242781  
CVE-2022-32922: Yonghwi Jin (@jinmo123) at Theori working with Trend  
Micro Zero Day Initiative

Additional recognition

WebKit  
We would like to acknowledge Maddie Stone of Google Project Zero,  
Narendra Bhati (@imnarendrabhati) of Suma Soft Pvt. Ltd., an  
anonymous researcher for their assistance.

Safari 16.1 may be obtained from the Mac App Store.  
All information is also posted on the Apple Security Updates  
web site: https://support.apple.com/en-us/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEBP+4DupqR5Sgt1DB4RjMIDkeNxkFAmNbKowACgkQ4RjMIDke  
NxlhOg/+I94LgMI7No4xw6dub1rdzNTbMV6A0R14HXwA7PoMzXgXJotYFyAfGUY4  
zd2fE9ixEuXqt+OsVrQ0/ZU4HcLEJLQk2ZkULoDfNeGiuJpi6k9VhPp6995XtLNb  
zGZgMu5dOPBkYsSaM5XaVwLQPtsIbac3u/Uoo6l2TyyN1B2clsI1dS2IXS8DEHkr  
2fCImTAcFfqIW7TZ6xqAdYOL5QLoJ8qXTcjSMaWtPpPzkfpZCTTwV8ifauK5rTQd  
JsFf49RFWMNdZ3qHNRaENsFMh1Y+bMRIW6Xt41WKXhSPdNXonv93N472YGhMtt7Z  
k+IuibGRVlwzc5Ri4AnQspBjhint6vo4vbJ39h1FoSzqTm3PruH+HGrhlfMTGR8/  
0s/QDBLQbA+UlM5r6uinQ5pI771rRyHTCWOxLUVVopDOV9ImV36Y+INakc3pTXL1  
420Wg31lCMO3cwwXyVYq/zDbCpJ2gDptSWTqlubli+omxMG7LRs0Vn9P4NTosVzk  
jN49FHJE2moD8O0D+sia6+lhyVhcP8UIA3WtcXegVngrwL6sAoFa5SCp49wmbb/O  
Ye1eysxuMR2xu7piVbUpGh0wRY50MbwwSWX0vRt0CwxcoiQK90lQFbqy2RFX4eN8  
k/jjh3nPUl20WxgOfQfLfiY/9aPcQSzvcOzba2bSovdgyk8xH+o=  
=3IzG  
-----END PGP SIGNATURE-----

Source

Packet Storm