Vulnerability Roundup 28

[ckauhaus]

Auto-generated from vulnix $( nix-instantiate -I nixpkgs=. '<nixpkgs/nixos/tests/login.nix>' ) on current master.

audiofile-0.3.6 (search, files)

• CVE-2017-6827
• CVE-2017-6828
• CVE-2017-6829
• CVE-2017-6830
• CVE-2017-6831
• CVE-2017-6832
• CVE-2017-6833
• CVE-2017-6834
• CVE-2017-6835
• CVE-2017-6836
• CVE-2017-6837
• CVE-2017-6838
• CVE-2017-6839

cyrus-sasl-2.1.26 (search, files)

• CVE-2013-4122

freetype-2.7.1 (search, files)

• CVE-2017-8105

jquery-ui-1.11.4 (search, files)

• CVE-2016-7103

libarchive-3.3.2 (search, files)

• CVE-2017-14166
• CVE-2017-14501 [no upstream fix]
• CVE-2017-14502
• CVE-2017-14503 [no upstream fix]

libjpeg-turbo-1.5.2 (search, files)

• CVE-2017-15232 [patch doesn't apply cleanly to stable version]

libsndfile-1.0.28 (search, files)

• CVE-2017-12562
• CVE-2017-14245 [no upstream fix]
• CVE-2017-14246 [no upstream fix]
• CVE-2017-14634
• CVE-2017-6892
• CVE-2017-8361
• CVE-2017-8362
• CVE-2017-8363
• CVE-2017-8365

libtasn1-4.12 (search, files)

• CVE-2017-10790

libtiff-4.0.8 (search, files)

• CVE-2017-10688
• CVE-2017-11335
• CVE-2017-11613 [no upstream fix, debian and redhat won't fix this]
• CVE-2017-12944
• CVE-2017-13726
• CVE-2017-13727
• CVE-2017-9935 [no upstream fix]
• CVE-2017-9936
• CVE-2017-9937

libvorbis-1.3.5 (search, files)

• CVE-2017-11333 [no upstream fix]
• CVE-2017-14160 [no upstream fix]
• CVE-2017-14632 [no upstream fix]
• CVE-2017-14633 [no upstream fix]

libxslt-1.1.29 (search, files)

• CVE-2017-5029

openjpeg-2.1.2 (search, files)

• CVE-2016-10504
• CVE-2016-10505
• CVE-2016-10506
• CVE-2016-10507
• CVE-2016-9112
• CVE-2016-9113
• CVE-2016-9114
• CVE-2016-9115
• CVE-2016-9116
• CVE-2016-9117
• CVE-2016-9118

openldap-2.4.45 (search, files)

• CVE-2017-14159

pcre-8.40 (search, files)

• CVE-2017-7186
• CVE-2017-7244
• CVE-2017-7245
• CVE-2017-7246

perl-5.24.2 (search, files)

• CVE-2017-12814
• CVE-2017-12837
• CVE-2017-12883

sqlite-3.20.0 (search, files)

• CVE-2017-13685

owncloud-7.0.5 (search, files)

• CVE-2015-4717
• CVE-2015-4718
• CVE-2015-5954
• CVE-2015-6500
• CVE-2015-6670
• CVE-2015-7699

jython-2.7.0 (search, files)

• CVE-2016-4000

zabbix-2.0.11 (search, files)

• CVE-2014-9450
• CVE-2016-4338

[grahamc]

🚨 ⚡️ 👍 🔥 🚒 🎆 🙌 📯 😄 😂 😹 :partyparrot:

[grahamc]

cc: @LnL7 @7c6f434c @fpletz @globin @NeQuissimus @wizeman @FRidh @vcunat @peterhoeg @ndowens @dezgeg @nh2.

Note: The list of people CC'd on this issue participated in the last
roundup. If you participate on this roundup, I'll cc you on the next
one. If you don't participate in the next one, you won't be CC'd on
the one after that. If you would like to be CC'd on the next roundup,
add a comment to the most recent vulnerability roundup.

Permanent CC's: @joepie91, @phanimahesh, @the-kenny, @7c6f434c, @k0001, @peterhoeg
@NixOS/security-notifications

If you would like to be CC'd on all roundups, PM me.

[ckauhaus]

This list needs manual cleanup since vulnix does not honour CVE patches already present. Working on this.

[disassembler]

I'm looking at freetype.

[disassembler]

freetype-2.7.1 (search, files) (CVE-2017-8105) is already patched.

[dezgeg]

Sqlite needs merging #30927 AFAICT.

[disassembler]

#21161 Should resolved jquery-ui CVE.

[disassembler]

libxslt is already patched in master and 17.09.

[disassembler]

I'll take libjpeg-turbo

[fpletz]

libvorbis

• CVE-2017-11333
  • No upstream fix yet https://gitlab.xiph.org/xiph/vorbis/issues/2332
  • Only a DoS, Debian considers this a minor issue https://security-tracker.debian.org/tracker/CVE-2017-11333
• CVE-2017-14160
  • No upstream fix yet https://gitlab.xiph.org/xiph/vorbis/issues/2330
• CVE-2017-14632
  • No upstream fix yet (RCE vul)call oggpack_writeclear() with uninitialized stack var opb in function vorbis_analysis_headerout() when vi->channels<=0 in libvorbis 1.3.5 xiph/vorbis#29
• CVE-2017-14633
  • No upstream fix yet https://gitlab.xiph.org/xiph/vorbis/issues/2329

[fpletz]

The openldap CVE-2017-14159 is a minor issue with PID file creation. It is only really applicable if initscripts are used, so NixOS isn't even vulnerable since our openldap service neither uses nor creates a PID file. Ticked off.

[NeQuissimus]

All the audiofile stuff seems to be mpruett/audiofile#42

[pbogdan]

sqlite - staging is already on 3.20.1 but that suffers from CVE-2017-15286, a PR is opened to update to 3.21.0 #30927