Vulnerability Roundup 18 #21967

grahamc · 2017-01-18T12:09:52Z

Here are all the vulnerabilities from https://lwn.net/Vulnerabilities
since our last roundup.

cc: @fpletz @FRidh @Mic92 @7c6f434c @LnL7 @bachp .

Note: The list of people CC'd on this issue participated in the last
roundup. If you participate on this roundup, I'll cc you on the next
one. If you don't participate in the next one, you won't be CC'd on
the one after that. If you would like to be CC'd on the next roundup,
add a comment to the most recent vulnerability roundup.

Permanent CC's: @joepie91, @phanimahesh, @the-kenny,
@NixOS/security-notifications
If you would like to be CC'd on all roundups (or removed from the
list), open a PR editing
https://github.com/NixOS/security/blob/master/lwnvulns/src/bin/instructions.md.

Notes on the list

The reports have been roughly grouped by the package name. This
isn't perfect, but is intended to help identify if a whole group
of reports is resolved already.
Some issues will be duplicated, because it affects multiple
packages. For example, there are sometimes problems that impact
thunderbird, and firefox. LWN might report in one vulnerability
"thunderbird firefox". These names have been split to make sure
both packages get addressed.
By each issue is a link to code search for the package name, and
a Github search by filename. These are to help, but may not return
results when we do in fact package the software. If a search
doesn't turn up, please try altering the search criteria or
looking in nixpkgs manually before asserting we don't have it.
This issue is created by https://github.com/NixOS/security

Instructions:

Triage a report: If we don't have the software or our version isn't
vulnerable, tick the box or add a comment with the report number,
stating it isn't vulnerable.
Fix the issue: If we do have the software and it is vulnerable,
either leave a comment on this issue saying so, even open a pull
request with the fix. If you open a PR, make sure to tag this
issue so we can coordinate.
When an entire section is completed, move the section to the
"Triaged and Resolved Issues" details block below.

Upon Completion ...

Run the issue through reformat one last time
Review commits since last roundup for backport candidates
Send an update e-mail to nix-security-announce@googlegroups.com
Update the database at https://github.com/NixOS/security

Without further ado...

Assorted (32 issues)

pgbouncer (2 issues)

#711323 (search, files) pgbouncer: authentication bypass
#645925 (search, files) pgbouncer: denial of service

The text was updated successfully, but these errors were encountered:

vcunat · 2017-01-18T13:40:46Z

Our libX11 is not vulnerable. According to the Debian commit the problem was introduced after 1.6.4 release as an incorrect attempt to fix a memory leak. So, our version may only leak memory. I'd personally wait for a release for this one.

the-kenny · 2017-01-18T14:36:45Z

Our simgear doesn't seem to be vulnerable either: The Fedora alert is about 2016.3.1 and we're on 2016.4.3.

I'll push an update to 2016.4.4 in a few hours.

/cc #21967.

7c6f434c · 2017-01-18T15:06:21Z

libgit2: we have a fresh enough version

globin · 2017-01-18T15:12:53Z

libupnp: 3be6e9f (not related to this roundup)

NeQuissimus · 2017-01-18T15:34:20Z

We have Docker 1.12.6, which closes the vulnerability mentioned

vcunat · 2017-01-18T15:38:23Z

gnutls: their advisories possibly imply that 3.4 branch is no longer maintained at this point, though I see no explicit saying of that. In any case, master and 16.09 have 3.4 as the default which was last updated on Dec 08 upstream.

bachp · 2017-01-18T18:05:17Z

Does someone have an idea how to handle the ark issues? Do we need to update all of KDE?

bachp · 2017-01-18T18:10:14Z

Actually I think the ark issue is already fixed in 7d01fff

grahamc · 2017-01-19T01:41:07Z

Thanks for the research and looking y'all did today. I wasn't able to do very much due to working on secret side projects, but am carving out some time now.

grahamc · 2017-01-19T02:27:06Z

Ikiwiki needs patching to 3.20170111 with backport

Fixes the following security issues: * CVE-2017-5334 * CVE-2017-5335 * CVE-2017-5336 * CVE-2017-5337 See https://www.gnutls.org/news.html#2017-01-09 for more information. (cherry picked from commit 85ac790) /cc #21967.

/cc #21967. (cherry picked from commit 68c9530)

7c6f434c · 2017-01-19T10:28:03Z

ikiwiki: done

vcunat · 2017-01-19T10:38:37Z

libtiff: took all patches from Debian, on both active branches.

https://webkitgtk.org/security/WSA-2017-0001.html /cc #21967.

grahamc · 2017-01-19T23:57:42Z

pdns: fixed in 1fe5134 (for notes later)

grahamc · 2017-01-20T02:18:05Z

Bind addressed in 2fd0a9f and 7b34209 (thank you, @peti)

grahamc · 2017-01-20T02:55:37Z

@bachp I suspect we need to fix ark on 16.09. Can you check in to that?

@NixOS/security-notifications (for all three updates) Relevant to NixOS#21967

7c6f434c · 2017-01-20T10:55:58Z

php security update ported to stable, except the php71 part which is not relevant there.

nlewo · 2017-01-20T11:27:51Z

#22001 fixes all qemu CVEs mentionned above excepted CVE-2016-9908 because vulnerable code is not present in our qemu version.

We should definitely upgrade our qemu version as initiated by @7c6f434c with the 2.8 version.

7c6f434c · 2017-01-20T11:34:01Z

@nlewo thanks

@grahamc I cherry-picked to stable, but I used the merge commit; not sure if I should have picked one-by-one

Re: qemu_28: NixPkgs-wise it is a no-brainer; NixOS tests need to be re-checked by people actually using NixOS and its tests, I guess.

grahamc · 2017-01-20T11:50:10Z

Amazing, @nlewo, thank you so much! How did you find the patches?

@7c6f434c Nice! Extremely timely on those, thank you! Usually I pick one by one, but this should be fine :)

I'll see about running tests with qemu_28.

nlewo · 2017-01-20T12:08:47Z

@7c6f434c There are some tests that are declared in nixos/release.nix but I don't know if the CI executes them. I'm responsible of two of them and I'll try to run them with qemu 2.8.

@grahamc By reading mails associated to the CVE desc on http://cve.mitre.org. I also get some information from https://security-tracker.debian.org (which is really nice).

grahamc · 2017-01-20T12:26:03Z

@nlewo if you submit a PR changing the default to 2.8, I can easily run the tests.

bachp · 2017-01-20T16:54:34Z

@grahamc I will try if I can backport the patch. I think it is this one here: KDE/ark@82fdfd2

grahamc · 2017-01-21T13:10:27Z

Special thank you to @nlewo and @bachp for getting those more annoying ones (IMO...) done, @7c6f434c for merging and cherry-picking commits, @vcunat for finding like a million patches that we were missing on debian ...! @the-kenny for so quickly triaging the flight package, @globin for tagging his libupnp patch despite being in this issue (very useful for making sure it gets in the notices) and @NeQuissimus, and any other anonymous triagers out there!

fpletz · 2017-01-21T13:17:44Z

@grahamc Last minute fix for libopus: 140d135

https://webkitgtk.org/security/WSA-2017-0001.html /cc #21967. (cherry picked from commit 5326cb7)

Fixes the following security issues: * CVE-2017-5334 * CVE-2017-5335 * CVE-2017-5336 * CVE-2017-5337 See https://www.gnutls.org/news.html#2017-01-09 for more information. (cherry picked from commit 85ac790) /cc NixOS#21967.

/cc NixOS#21967. (cherry picked from commit 68c9530)

https://webkitgtk.org/security/WSA-2017-0001.html /cc NixOS#21967. (cherry picked from commit 5326cb7)

grahamc added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Jan 18, 2017

grahamc mentioned this issue Jan 18, 2017

Vulnerability Roundup 17 #21803

Closed

28 tasks

vcunat added a commit that referenced this issue Jan 18, 2017

libtiff: apply security patches from Debian

68c9530

/cc #21967.

vcunat added a commit that referenced this issue Jan 19, 2017

libtiff: apply security patches from Debian

89c567c

/cc #21967. (cherry picked from commit 68c9530)

vcunat added a commit that referenced this issue Jan 19, 2017

webkit: security 2.14.2 -> 2.14.3

5326cb7

https://webkitgtk.org/security/WSA-2017-0001.html /cc #21967.

7c6f434c added a commit to 7c6f434c/nixpkgs that referenced this issue Jan 20, 2017

php71: 7.1.0 -> 7.1.1

e5acde0

@NixOS/security-notifications (for all three updates) Relevant to NixOS#21967

bachp mentioned this issue Jan 20, 2017

ark: add security patch for CVE-2017-5330 #22007

Merged

7 tasks

grahamc closed this as completed Jan 21, 2017

vcunat added a commit that referenced this issue Jan 24, 2017

webkit: security 2.14.1 -> 2.14.3

4d8e248

https://webkitgtk.org/security/WSA-2017-0001.html /cc #21967. (cherry picked from commit 5326cb7)

grahamc mentioned this issue Jan 25, 2017

Vulnerability Roundup 19 #22128

Closed

34 tasks

adrianpk added a commit to adrianpk/nixpkgs that referenced this issue May 31, 2024

libtiff: apply security patches from Debian

344362b

/cc NixOS#21967. (cherry picked from commit 68c9530)

adrianpk added a commit to adrianpk/nixpkgs that referenced this issue May 31, 2024

webkit: security 2.14.1 -> 2.14.3

5866ea9

https://webkitgtk.org/security/WSA-2017-0001.html /cc NixOS#21967. (cherry picked from commit 5326cb7)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Vulnerability Roundup 18 #21967

Vulnerability Roundup 18 #21967

grahamc commented Jan 18, 2017 •

edited

Loading

vcunat commented Jan 18, 2017

the-kenny commented Jan 18, 2017

7c6f434c commented Jan 18, 2017

globin commented Jan 18, 2017

NeQuissimus commented Jan 18, 2017

vcunat commented Jan 18, 2017

bachp commented Jan 18, 2017

bachp commented Jan 18, 2017

grahamc commented Jan 19, 2017

grahamc commented Jan 19, 2017 •

edited by 7c6f434c

Loading

7c6f434c commented Jan 19, 2017

vcunat commented Jan 19, 2017

grahamc commented Jan 19, 2017

grahamc commented Jan 20, 2017 •

edited

Loading

grahamc commented Jan 20, 2017

7c6f434c commented Jan 20, 2017

nlewo commented Jan 20, 2017

7c6f434c commented Jan 20, 2017

grahamc commented Jan 20, 2017

nlewo commented Jan 20, 2017

grahamc commented Jan 20, 2017

bachp commented Jan 20, 2017

grahamc commented Jan 21, 2017

fpletz commented Jan 21, 2017

Vulnerability Roundup 18 #21967

Vulnerability Roundup 18 #21967

Comments

grahamc commented Jan 18, 2017 • edited Loading

Notes on the list

Instructions:

Upon Completion ...

Assorted (32 issues)

pgbouncer (2 issues)

vcunat commented Jan 18, 2017

the-kenny commented Jan 18, 2017

7c6f434c commented Jan 18, 2017

globin commented Jan 18, 2017

NeQuissimus commented Jan 18, 2017

vcunat commented Jan 18, 2017

bachp commented Jan 18, 2017

bachp commented Jan 18, 2017

grahamc commented Jan 19, 2017

grahamc commented Jan 19, 2017 • edited by 7c6f434c Loading

7c6f434c commented Jan 19, 2017

vcunat commented Jan 19, 2017

grahamc commented Jan 19, 2017

grahamc commented Jan 20, 2017 • edited Loading

grahamc commented Jan 20, 2017

7c6f434c commented Jan 20, 2017

nlewo commented Jan 20, 2017

7c6f434c commented Jan 20, 2017

grahamc commented Jan 20, 2017

nlewo commented Jan 20, 2017

grahamc commented Jan 20, 2017

bachp commented Jan 20, 2017

grahamc commented Jan 21, 2017

fpletz commented Jan 21, 2017

grahamc commented Jan 18, 2017 •

edited

Loading

grahamc commented Jan 19, 2017 •

edited by 7c6f434c

Loading

grahamc commented Jan 20, 2017 •

edited

Loading