ASA-201807-11 generated external raw

[ASA-201807-11] znc: multiple issues
Arch Linux Security Advisory ASA-201807-11 ========================================== Severity: High Date : 2018-07-19 CVE-ID : CVE-2018-14055 CVE-2018-14056 Package : znc Type : multiple issues Remote : Yes Link : Summary ======= The package znc before version 1.7.1-1 is vulnerable to multiple issues including privilege escalation and directory traversal. Resolution ========== Upgrade to 1.7.1-1. # pacman -Syu "znc>=1.7.1-1" The problems have been fixed upstream in version 1.7.1. Workaround ========== None. Description =========== - CVE-2018-14055 (privilege escalation) ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to escalate privilege, inject rogue values into znc.conf, and gain shell access. - CVE-2018-14056 (directory traversal) ZNC before 1.7.1-rc1 is prone to a path traversal flaw. A non-admin user can set web skin name to ../ to access files outside of the intended skins directories and to cause DoS. Impact ====== An authenticated non-admin user is able to read arbitrary files, crash the application, escalate privileges, or execute arbitrary commands on the host. References ==========