Nixpkgs: Vulnerability Roundup 19

[grahamc]

Here are all the vulnerabilities from https://lwn.net/Vulnerabilities
since our last roundup.

cc: @vcunat @the-kenny @7c6f434c @globin @bachp @nlewo @fpletz @NeQuissimus. (nice goup!)

_Note:_ The list of people CC'd on this issue participated in the last
roundup. If you participate on this roundup, I'll cc you on the next
one. If you don't participate in the next one, you won't be CC'd on
the one after that. If you would like to be CC'd on the next roundup,
add a comment to the most recent vulnerability roundup.

Permanent CC's: @joepie91, @phanimahesh, @the-kenny,
@NixOS/security-notifications
If you would like to be CC'd on _all_ roundups (or removed from the
list), open a PR editing
https://github.com/NixOS/security/blob/master/lwnvulns/src/bin/instructions.md.

Notes on the list

1. The reports have been roughly grouped by the package name. This
   isn't perfect, but is intended to help identify if a whole group
   of reports is resolved already.
2. Some issues will be duplicated, because it affects multiple
   packages. For example, there are sometimes problems that impact
   thunderbird, and firefox. LWN might report in one vulnerability
   "thunderbird firefox". These names have been split to make sure
   both packages get addressed.
3. By each issue is a link to code search for the package name, and
   a Github search by filename. These are to help, but may not return
   results when we do in fact package the software. If a search
   doesn't turn up, please try altering the search criteria or
   looking in nixpkgs manually before asserting we don't have it.
4. This issue is created by https://github.com/NixOS/security

Instructions:

1. Triage a report: If we don't have the software or our version isn't
   vulnerable, tick the box or add a comment with the report number,
   stating it isn't vulnerable.
2. Fix the issue: If we do have the software and it is vulnerable,
   either leave a comment on this issue saying so, even open a pull
   request with the fix. If you open a PR, make sure to tag this
   issue so we can coordinate.
3. When an entire section is completed, move the section to the
   "Triaged and Resolved Issues" details block below.

Upon Completion ...

• [x] Run the issue through reformat one last time
• [ ] Review commits since last roundup for backport candidates
• [ ] Send an update e-mail to [email protected]
• [x] Update the database at https://github.com/NixOS/security

Without further ado...

Assorted (28 issues)

• [x] [#712299](https://lwn.net/Vulnerabilities/712299/) (search, files) ed: denial of service
• [x] [#712364](https://lwn.net/Vulnerabilities/712364/) (search, files) gd: two denial of service flaws
• [x] [#712065](https://lwn.net/Vulnerabilities/712065/) (search, files) libav: multiple vulnerabilities
• [x] [#640613](https://lwn.net/Vulnerabilities/640613/) (search, files) ppp: denial of service
• [x] [#662269](https://lwn.net/Vulnerabilities/662269/) (search, files) squid: nonce replay vulnerability
• [x] [#711945](https://lwn.net/Vulnerabilities/711945/) (search, files) webkit2gtk: multiple vulnerabilities
• [x] [#712297](https://lwn.net/Vulnerabilities/712297/) (search, files) groovy: code execution
• [x] [#712057](https://lwn.net/Vulnerabilities/712057/) (search, files) java: multiple vulnerabilities
• [x] [#712058](https://lwn.net/Vulnerabilities/712058/) (search, files) java: multiple vulnerabilities
• [x] [#712059](https://lwn.net/Vulnerabilities/712059/) (search, files) java: two unspecified vulnerabilities
• [x] [#712369](https://lwn.net/Vulnerabilities/712369/) (search, files) kernel: privilege escalation
• [x] [#712067](https://lwn.net/Vulnerabilities/712067/) (search, files) mariadb: multiple unspecified vulnerabilities
• [x] [#712068](https://lwn.net/Vulnerabilities/712068/) (search, files) mysql: multiple vulnerabilities
• [x] [#712068](https://lwn.net/Vulnerabilities/712068/) (search, files) mysql: multiple vulnerabilities
• [x] [#642649](https://lwn.net/Vulnerabilities/642649/) (search, files) DirectFB: two vulnerabilities
• [x] [#480386](https://lwn.net/Vulnerabilities/480386/) (search, files) cvs: remote code execution
• [x] [#644511](https://lwn.net/Vulnerabilities/644511/) (search, files) dcraw: denial of service
• [x] [#712370](https://lwn.net/Vulnerabilities/712370/) (search, files) firejail: three vulnerabilities
• [x] [#712359](https://lwn.net/Vulnerabilities/712359/) (search, files) hesiod: two vulnerabilities
• [x] [#712300](https://lwn.net/Vulnerabilities/712300/) (search, files) libnl3: privilege escalation
• [x] [#712363](https://lwn.net/Vulnerabilities/712363/) (search, files) tiff: code execution
• [x] [#610398](https://lwn.net/Vulnerabilities/610398/) (search, files) lua: code execution
• [x] [#712060](https://lwn.net/Vulnerabilities/712060/) (search, files) mapserver: code execution
• [x] [#712298](https://lwn.net/Vulnerabilities/712298/) (search, files) opus: code execution
• [x] [#712155](https://lwn.net/Vulnerabilities/712155/) (search, files) php: code execution
• [x] [#711946](https://lwn.net/Vulnerabilities/711946/) (search, files) php-PHPMailer: information disclosure
• [x] [#712371](https://lwn.net/Vulnerabilities/712371/) (search, files) t1lib: code execution
• [x] [#712304](https://lwn.net/Vulnerabilities/712304/) (search, files) xtrabackup: information disclosure

qemu (2 issues)

• [x] [#712302](https://lwn.net/Vulnerabilities/712302/) (search, files) qemu: denial of service
• [x] [#712301](https://lwn.net/Vulnerabilities/712301/) (search, files) qemu: denial of service

[7c6f434c]

lua5_1: that's an old bug

[7c6f434c]

Re: qemu: what is the current status of maybe-we-should-update-to-2.8?

[7c6f434c]

firejail: old story

[grahamc]

I never saw a PR come through trying 2.8, and I'd still like to try it. Note cvs is an old bug, but we are vulnerable :)

[vcunat]

tiff: we already apply debian/patches/17-CVE-2017-5225.patch since the last roundup, so that should be OK.

[vcunat]

libopus: OK since 140d135e.

[grahamc]

ed is good on master but needs a backport to stable. It _looks_ like all three commits to ed can be backported. what do you think, @vcunat?

[vcunat]

It's just 1.13 -> 1.14.1 and some nitpicks along. I'd think the update is safe (but a mass rebuild).

[grahamc]

OK I'll hold on to that backport until later.

[vcunat]

webkitgtk: the version on master should be OK, but we have 2.12 as the default on 16.09, so it's probably vulnerable. I can't see any complaints since we updated the default on master, and the versions should be compatible (in this direction), so I think we should switch.

[grahamc]

Sounds fine to me, re: webkitgtk. Not ideal, but nor is webkitgtk ;)

[grahamc]

I set up a PR to push changes to: https://github.com/NixOS/nixpkgs/pull/22131 you can both push to that branch, I think. Also that branch is building in a hydra (link in the description.)

[vcunat]

t1lib: I believe CVE-2011-5244 was fixed by our particular patch for CVE-2010-2642. That patch from Gentoo is certainly equal to the one we apply (taken from Arch).

[grahamc]

Collapsed the done items. Almost half done :o

[grahamc]

~Might be good to upgrade mariadb to 10.2.x before 17.03 branch-off.~ 10.2 isn't stable.

[NeQuissimus]

Java and kernel are fine

[NeQuissimus]

So is our Groovy version

[grahamc]

👍 I collapsed the completed tasks.

[bachp]

As dar as I can tell squid on 16.09 is not vulnerable. It has the same version as master 3.5.23 and the issue only mentiones 3.4 and 3.5.0.1 through 3.5.1.

EDIT: I just noticed it is ticked ;) Never mind.

[fpletz]

We already have a fixed version of ed (1.14.1) and not present on release (1.13) because the issue was introduced in 1.14.

[fpletz]

We're safe on the second qemu issue (CVE-2016-10028) because we don't build our qemu with virtio-gpu-3d enabled.

[fpletz]

The first qemu issue (CVE-2016-9923) is fixed in 2.8.0 and the patch is not easily applicable to our version.

[fpletz]

Pushed fixes for libav, ppp and gd to #22131.

[grahamc]

I think we can go ahead and upgrade qemu: https://github.com/NixOS/nixpkgs/pull/22134 but probably shouldn't do so for stable... :/ hard question. We don't really have a way to track vulnerabilities we know NixOS has but aren't fixing.

[7c6f434c]

Is there any known incompatible change for Qemu 2.8 (or any regressions)? Qemu looks like software where just doing the upgrade could be safe.

[7c6f434c]

squid: old stuff

[7c6f434c]

@bachp technically, one of the links references a bug in 3.5.22

[grahamc]

Just pushed new qemus everywhere. Good work, all done! Thank you! :D