Nixpkgs: Vulnerability Roundup 23

[grahamc]

Here are all the vulnerabilities from https://lwn.net/Vulnerabilities
since our last roundup.

cc: @peterhoeg @7c6f434c @bendlas @LnL7 @phanimahesh @vcunat @tavyc @joachifm.

_Note:_ The list of people CC'd on this issue participated in the last
roundup. If you participate on this roundup, I'll cc you on the next
one. If you don't participate in the next one, you won't be CC'd on
the one after that. If you would like to be CC'd on the next roundup,
add a comment to the most recent vulnerability roundup.

Permanent CC's: @joepie91, @phanimahesh, @the-kenny, @7c6f434c, @k0001, @peterhoeg
@NixOS/security-notifications
If you would like to be CC'd on _all_ roundups (or removed from the
list), open a PR editing
https://github.com/NixOS/security/blob/master/lwnvulns/src/bin/instructions.md.

Notes on the list

1. The reports have been roughly grouped by the package name. This
   isn't perfect, but is intended to help identify if a whole group
   of reports is resolved already.
2. Some issues will be duplicated, because it affects multiple
   packages. For example, there are sometimes problems that impact
   thunderbird, and firefox. LWN might report in one vulnerability
   "thunderbird firefox". These names have been split to make sure
   both packages get addressed.
3. By each issue is a link to code search for the package name, and
   a Github search by filename. These are to help, but may not return
   results when we do in fact package the software. If a search
   doesn't turn up, please try altering the search criteria or
   looking in nixpkgs manually before asserting we don't have it.
4. This issue is created by https://github.com/NixOS/security

Instructions:

1. Triage a report: If we don't have the software or our version isn't
   vulnerable, tick the box or add a comment with the report number,
   stating it isn't vulnerable.
2. Fix the issue: If we do have the software and it is vulnerable,
   either leave a comment on this issue saying so, even open a pull
   request with the fix. If you open a PR, make sure to tag this
   issue so we can coordinate.
3. When an entire section is completed, move the section to the
   "Triaged and Resolved Issues" details block below.

Upon Completion ...

• [x] Run the issue through reformat one last time
• [x] Review commits since last roundup for backport candidates
• [x] Send an update e-mail to [email protected]
• [x] Update the database at https://github.com/NixOS/security

Without further ado...

Assorted (25 issues)

• [x] [#714850](https://lwn.net/Vulnerabilities/714850/) (search, files) diffoscope: file overwrite
• [x] [#715043](https://lwn.net/Vulnerabilities/715043/) (search, files) firebird: access restriction bypass
• [x] [#715166](https://lwn.net/Vulnerabilities/715166/) (search, files) libass: denial of service
• [x] [#715170](https://lwn.net/Vulnerabilities/715170/) (search, files) libplist: three vulnerabilities
• [x] [#714582](https://lwn.net/Vulnerabilities/714582/) (search, files) lynx: invalid URL parsing
• [x] [#715167](https://lwn.net/Vulnerabilities/715167/) (search, files) nagios-core: privilege escalation
• [x] [#714852](https://lwn.net/Vulnerabilities/714852/) (search, files) postfixadmin: security bypass
• [x] [#714853](https://lwn.net/Vulnerabilities/714853/) (search, files) python-crypto: code execution
• [x] [#715038](https://lwn.net/Vulnerabilities/715038/) (search, files) zoneminder: information disclosure
• [x] [#715045](https://lwn.net/Vulnerabilities/715045/) (search, files) kernel: denial of service
• [x] [#715045](https://lwn.net/Vulnerabilities/715045/) (search, files) kernel: denial of service
• [x] [#715165](https://lwn.net/Vulnerabilities/715165/) (search, files) dropbear: code execution
• [x] [#715041](https://lwn.net/Vulnerabilities/715041/) (search, files) jitsi: user spoofing
• [x] [#715162](https://lwn.net/Vulnerabilities/715162/) (search, files) kernel: information disclosure
• [x] [#714581](https://lwn.net/Vulnerabilities/714581/) (search, files) libevent: three vulnerabilities
• [x] [#715042](https://lwn.net/Vulnerabilities/715042/) (search, files) netpbm: three vulnerabilities
• [x] [#714586](https://lwn.net/Vulnerabilities/714586/) (search, files) php5: three vulnerabilities
• [x] [#715036](https://lwn.net/Vulnerabilities/715036/) (search, files) python-peewee: largely unspecified
• [x] [#715168](https://lwn.net/Vulnerabilities/715168/) (search, files) qemu: multiple vulnerabilities
• [x] [#715169](https://lwn.net/Vulnerabilities/715169/) (search, files) redis: code execution
• [x] [#715037](https://lwn.net/Vulnerabilities/715037/) (search, files) sshrc: unspecified
• [x] [#715045](https://lwn.net/Vulnerabilities/715045/) (search, files) kernel: denial of service
• [x] [#715171](https://lwn.net/Vulnerabilities/715171/) (search, files) tomcat: denial of service
• [x] [#715171](https://lwn.net/Vulnerabilities/715171/) (search, files) tomcat: denial of service
• [x] [#715035](https://lwn.net/Vulnerabilities/715035/) (search, files) wireshark: denial of service

mupdf (2 issues)

• [x] [#715044](https://lwn.net/Vulnerabilities/715044/) (search, files) mupdf: two vulnerabilities
• [x] [#715039](https://lwn.net/Vulnerabilities/715039/) (search, files) mupdf: denial of service

xen (2 issues)

• [x] [#715164](https://lwn.net/Vulnerabilities/715164/) (search, files) xen: denial of service
• [x] [#714585](https://lwn.net/Vulnerabilities/714585/) (search, files) xen: three vulnerabilities

[LnL7]

redis is not vulnerable, it was updated to a more recent version for the last round up.

[7c6f434c]

dropbear: fixed in 2016.74, we have it, both branches

[fpletz]

I've already got a commit with qemu patches from a few hours ago that I didn't push to master yet. I will take care of the remaining qemu issues.

[globin]

PHP vulnerabilities are fixed in the versions we are shipping.

[grahamc]

I'm working on the Xen issues.

[7c6f434c]

wireshark: the report is for 1.12.1, but 2.2.4 is also affected; fixed in 194d137bd3646b8e73901d5c01ee4e90d3dcf2a4 and cherry-picked

[grahamc]

Tomcat is already fixed.

[grahamc]

xen patched in cc4919da8968ccdd2e4f76cbdde7e2ed6c385130 / 142fd06afc50d9513477ab29c9be17e46e38248f

[NeQuissimus]

We have all the kernel issues covered

[wizeman]

I have contacted the security team privately before, but I believe neovim has a serious vulnerability which was fixed in version 1.0.7. NixOS stable only has version 1.0.5.

Not sure if vim is also affected.

[grahamc]

hey @wizeman, I thought I had covered that last roundup, thank you for bringing it up again here, I'll make sure it is patched this time around. I'm sorry I missed it last.

[FRidh]

We don't have peewee in Nixpkgs so I am ticking it.

[vcunat]

Libevent should be OK now.

[FRidh]

We don't have pycrypto anymore but use pycryptodome. Maybe the latter is affected, I don't know.

[FRidh]

I've updated diffoscope on master https://github.com/NixOS/nixpkgs/commit/de4643eb80ffa13b65c6e5e662235080c093b3e1. Not sure what to do with it on 16.09 though.

[peterhoeg]

netpbm was fixed in last week's roundup.

[ndowens]

Not finding sshrc in repo

Jitsi is at a newer version than listed on CVE

[grahamc]

firebird fixed in 6c37a92 / d87a40e

[grahamc]

libass is old

[grahamc]

nagios-core is old.

[grahamc]

We don't package postfixadmin.

[grahamc]

We don't package zoneminder.

[grahamc]

@wizeman is there any way you can work on updating stable to 0.1.7? It appears to be a fairly complex update, based on master's changes.

[grahamc]

@FRidh Looks like the crypto vulnerability has been taken down by LWN. I emailed them asking about it.

[grahamc]

@dezgeg @edolstra: is this diffoscope acceptable to backport to stable? https://github.com/NixOS/nixpkgs/commit/de4643eb80ffa13b65c6e5e662235080c093b3e1

[grahamc]

I'm working on patches for the DCCP bug (cc @NeQuissimus, @fpletz). Just waiting on compilation to check.

[dezgeg]

Yes, diffoscope is most likely ok to upgrade in stable.

[nh2]

Would like to be CCd.

[fpletz]

mupdf fixed in 6dfbb070fbfa48986c05c334996b8c3c47432cdd. The other mupdf issue is for mujs for which we already have the current git commit in which the issues are fixed.

[fpletz]

libplist has been marked as insecure in 30cea5f02245a20022ea93f8eec2f4fe053ad97a. Checked it off above.

[fpletz]

See comments to https://github.com/NixOS/nixpkgs/commit/afd59811a1f4b2037d77293064a4fee0ac91af6f. Maybe our gstreamer was still vulnerable. I'm preparing a bump to be on the safe side.

[vcunat]

I just picked that diffoscope update to 16.09, so I suppose we can check it off.

[grahamc]

The pycrypto issue turned out to be a duplicate. Thanks, everyone, for finishing this out without me. I've had a busy time since last Thursday. Great work!