Nixpkgs: Vulnerability Roundup 18

[grahamc]

Here are all the vulnerabilities from https://lwn.net/Vulnerabilities
since our last roundup.

cc: @fpletz @FRidh @Mic92 @7c6f434c @LnL7 @bachp .

_Note:_ The list of people CC'd on this issue participated in the last
roundup. If you participate on this roundup, I'll cc you on the next
one. If you don't participate in the next one, you won't be CC'd on
the one after that. If you would like to be CC'd on the next roundup,
add a comment to the most recent vulnerability roundup.

Permanent CC's: @joepie91, @phanimahesh, @the-kenny,
@NixOS/security-notifications
If you would like to be CC'd on _all_ roundups (or removed from the
list), open a PR editing
https://github.com/NixOS/security/blob/master/lwnvulns/src/bin/instructions.md.

Notes on the list

1. The reports have been roughly grouped by the package name. This
   isn't perfect, but is intended to help identify if a whole group
   of reports is resolved already.
2. Some issues will be duplicated, because it affects multiple
   packages. For example, there are sometimes problems that impact
   thunderbird, and firefox. LWN might report in one vulnerability
   "thunderbird firefox". These names have been split to make sure
   both packages get addressed.
3. By each issue is a link to code search for the package name, and
   a Github search by filename. These are to help, but may not return
   results when we do in fact package the software. If a search
   doesn't turn up, please try altering the search criteria or
   looking in nixpkgs manually before asserting we don't have it.
4. This issue is created by https://github.com/NixOS/security

Instructions:

1. Triage a report: If we don't have the software or our version isn't
   vulnerable, tick the box or add a comment with the report number,
   stating it isn't vulnerable.
2. Fix the issue: If we do have the software and it is vulnerable,
   either leave a comment on this issue saying so, even open a pull
   request with the fix. If you open a PR, make sure to tag this
   issue so we can coordinate.
3. When an entire section is completed, move the section to the
   "Triaged and Resolved Issues" details block below.

Upon Completion ...

• [x] Run the issue through reformat one last time
• [ ] Review commits since last roundup for backport candidates
• [ ] Send an update e-mail to [email protected]
• [x] Update the database at https://github.com/NixOS/security

Without further ado...

Assorted (32 issues)

• [x] [#711581](https://lwn.net/Vulnerabilities/711581/) (search, files) ark: code execution
• [x] [#711782](https://lwn.net/Vulnerabilities/711782/) (search, files) qemu: multiple vulnerabilities
• [x] [#645632](https://lwn.net/Vulnerabilities/645632/) (search, files) fuse: privilege escalation
• [x] [#711858](https://lwn.net/Vulnerabilities/711858/) (search, files) icinga: cross-site scripting
• [x] [#711775](https://lwn.net/Vulnerabilities/711775/) (search, files) icoutils: three vulnerabilities
• [x] [#711459](https://lwn.net/Vulnerabilities/711459/) (search, files) python-psaml2: XML external entity attacks
• [x] [#711583](https://lwn.net/Vulnerabilities/711583/) (search, files) rabbitmq-server: authentication bypass
• [x] [#711774](https://lwn.net/Vulnerabilities/711774/) (search, files) wordpress: multiple vulnerabilities
• [x] [#711780](https://lwn.net/Vulnerabilities/711780/) (search, files) apache: denial of service
• [x] [#711463](https://lwn.net/Vulnerabilities/711463/) (search, files) bind: denial of service
• [x] [#711457](https://lwn.net/Vulnerabilities/711457/) (search, files) bind: three denial of service flaws
• [x] [#652803](https://lwn.net/Vulnerabilities/652803/) (search, files) freeradius: insufficient certificate verification
• [x] [#710286](https://lwn.net/Vulnerabilities/710286/) (search, files) openjpeg2: multiple vulnerabilities
• [x] [#711464](https://lwn.net/Vulnerabilities/711464/) (search, files) gnutls: multiple vulnerabilities
• [x] [#711458](https://lwn.net/Vulnerabilities/711458/) (search, files) ikiwiki: three vulnerabilities
• [x] [#711329](https://lwn.net/Vulnerabilities/711329/) (search, files) kernel: denial of service
• [x] [#711777](https://lwn.net/Vulnerabilities/711777/) (search, files) tiff: three vulnerabilities
• [x] [#598449](https://lwn.net/Vulnerabilities/598449/) (search, files) miniupnpc: denial of service
• [x] [#711779](https://lwn.net/Vulnerabilities/711779/) (search, files) onionshare: file injection
• [x] [#711776](https://lwn.net/Vulnerabilities/711776/) (search, files) pdns: multiple vulnerabilities
• [x] [#711461](https://lwn.net/Vulnerabilities/711461/) (search, files) qpid-java: information disclosure
• [x] [#711462](https://lwn.net/Vulnerabilities/711462/) (search, files) springframework-security: security constraint bypass
• [x] [#711330](https://lwn.net/Vulnerabilities/711330/) (search, files) webkit2gtk: multiple vulnerabilities
• [x] [#711856](https://lwn.net/Vulnerabilities/711856/) (search, files) SimGear: file overwrites
• [x] [#711582](https://lwn.net/Vulnerabilities/711582/) (search, files) docker: privilege escalation
• [x] [#711781](https://lwn.net/Vulnerabilities/711781/) (search, files) irssi: out of bounds read
• [x] [#711586](https://lwn.net/Vulnerabilities/711586/) (search, files) libgit2: multiple vulnerabilities
• [x] [#711778](https://lwn.net/Vulnerabilities/711778/) (search, files) libx11: denial of service
• [x] [#711324](https://lwn.net/Vulnerabilities/711324/) (search, files) phpBB: two vulnerabilities
• [x] [#711325](https://lwn.net/Vulnerabilities/711325/) (search, files) phpmyadmin: two vulnerabilities
• [x] [#657322](https://lwn.net/Vulnerabilities/657322/) (search, files) vzctl: insecure ploop-based containers
• [x] [#711587](https://lwn.net/Vulnerabilities/711587/) (search, files) webmin: largely unspecified

pgbouncer (2 issues)

• [x] [#711323](https://lwn.net/Vulnerabilities/711323/) (search, files) pgbouncer: authentication bypass
• [x] [#645925](https://lwn.net/Vulnerabilities/645925/) (search, files) pgbouncer: denial of service

[vcunat]

Our libX11 is not vulnerable. According to the Debian commit the problem was introduced after 1.6.4 release as an incorrect attempt to fix a memory leak. So, our version may only leak memory. I'd personally wait for a release for this one.

[the-kenny]

Our simgear doesn't seem to be vulnerable either: The Fedora alert is about 2016.3.1 and we're on 2016.4.3.

I'll push an update to 2016.4.4 in a few hours.

[7c6f434c]

libgit2: we have a fresh enough version

[globin]

libupnp: https://github.com/NixOS/nixpkgs/commit/3be6e9fc5af88fca55ba3b3a2f8be46ed21c9f35 (not related to this roundup)

[NeQuissimus]

We have Docker 1.12.6, which closes the vulnerability mentioned

[vcunat]

gnutls: their advisories possibly imply that 3.4 branch is no longer maintained at this point, though I see no explicit saying of that. In any case, master and 16.09 have 3.4 as the default which was last updated on Dec 08 upstream.

[bachp]

Does someone have an idea how to handle the ark issues? Do we need to update all of KDE?

[bachp]

Actually I think the ark issue is already fixed in https://github.com/NixOS/nixpkgs/commit/7d01fff5160b12f2ce6795c028a1178bcd33805a

[grahamc]

Thanks for the research and looking y'all did today. I wasn't able to do very much due to working on secret side projects, but am carving out some time now.

[grahamc]

• [x] Ikiwiki needs patching to 3.20170111 with backport

[7c6f434c]

ikiwiki: done

[vcunat]

libtiff: took all patches from Debian, on both active branches.

[grahamc]

pdns: fixed in 1fe51342a98638d32349e0930afe6c1751e612ef (for notes later)

[grahamc]

Bind addressed in 2fd0a9f3c74a29e87952c7657aed8194258a83c4 and 7b34209e1bb5d38106115e52506a2ed777608672 (thank you, @peti)

[grahamc]

@bachp I suspect we need to fix ark on 16.09. Can you check in to that?

[7c6f434c]

php security update ported to stable, except the php71 part which is not relevant there.

[nlewo]

22001 fixes all qemu CVEs mentionned above excepted CVE-2016-9908 because vulnerable code is not present in our qemu version.

We should definitely upgrade our qemu version as initiated by @7c6f434c with the 2.8 version.

[7c6f434c]

@nlewo thanks

@grahamc I cherry-picked to stable, but I used the merge commit; not sure if I should have picked one-by-one

Re: qemu_28: NixPkgs-wise it is a no-brainer; NixOS tests need to be re-checked by people actually using NixOS and its tests, I guess.

[grahamc]

Amazing, @nlewo, thank you so much! How did you find the patches?

@7c6f434c Nice! _Extremely_ timely on those, thank you! Usually I pick one by one, but this should be fine :)

I'll see about running tests with qemu_28.

[nlewo]

@7c6f434c There are some tests that are declared in nixos/release.nix but I don't know if the CI executes them. I'm responsible of two of them and I'll try to run them with qemu 2.8.

@grahamc By reading mails associated to the CVE desc on http://cve.mitre.org. I also get some information from https://security-tracker.debian.org (which is really nice).

[grahamc]

@nlewo if you submit a PR changing the default to 2.8, I can easily run the tests.

[bachp]

@grahamc I will try if I can backport the patch. I think it is this one here: https://github.com/KDE/ark/commit/82fdfd24d46966a117fa625b68784735a40f9065

[grahamc]

Special thank you to @nlewo and @bachp for getting those more annoying ones (IMO...) done, @7c6f434c for merging and cherry-picking commits, @vcunat for finding like a million patches that we were missing on debian ...! @the-kenny for so quickly triaging the flight package, @globin for tagging his libupnp patch despite being in this issue (very useful for making sure it gets in the notices) and @NeQuissimus, and any other anonymous triagers out there!

[fpletz]

@grahamc Last minute fix for libopus: 140d135ee2e2f2ea538591fe25719c9c91d4651e