November 2019 - Arch-security - lists.archlinux.org

[ASA-201911-12] linux-zen: arbitrary code execution
by Levente Polyak 14 Nov '19

14 Nov '19

Arch Linux Security Advisory ASA-201911-12 ========================================== Severity: Critical Date : 2019-11-13 CVE-ID : CVE-2019-17666 Package : linux-zen Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1066 Summary ======= The package linux-zen before version 5.3.9.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.9.1-1. # pacman -Syu "linux-zen>=5.3.9.1-1" The problem has been fixed upstream in version 5.3.9.1. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-11] linux-lts: arbitrary code execution
by Levente Polyak 14 Nov '19

14 Nov '19

Arch Linux Security Advisory ASA-201911-11 ========================================== Severity: Critical Date : 2019-11-13 CVE-ID : CVE-2019-17666 Package : linux-lts Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1065 Summary ======= The package linux-lts before version 4.19.82-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.19.82-1. # pacman -Syu "linux-lts>=4.19.82-1" The problem has been fixed upstream in version 4.19.82. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-10] linux: arbitrary code execution
by Levente Polyak 14 Nov '19

14 Nov '19

Arch Linux Security Advisory ASA-201911-10 ========================================== Severity: Critical Date : 2019-11-13 CVE-ID : CVE-2019-17666 Package : linux Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1064 Summary ======= The package linux before version 5.3.9.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.9.1-1. # pacman -Syu "linux>=5.3.9.1-1" The problem has been fixed upstream in version 5.3.9.1. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-9] linux-hardened: arbitrary code execution
by Levente Polyak 07 Nov '19

07 Nov '19

Arch Linux Security Advisory ASA-201911-9 ========================================= Severity: Critical Date : 2019-11-07 CVE-ID : CVE-2019-17666 Package : linux-hardened Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1063 Summary ======= The package linux-hardened before version 5.3.7.b-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.7.b-1. # pacman -Syu "linux-hardened>=5.3.7.b-1" The problem has been fixed upstream in version 5.3.7.b. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-8] squid: multiple issues
by Remi Gacogne 07 Nov '19

07 Nov '19

Arch Linux Security Advisory ASA-201911-8 ========================================= Severity: Critical Date : 2019-11-07 CVE-ID : CVE-2019-12526 CVE-2019-18678 CVE-2019-18679 Package : squid Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1062 Summary ======= The package squid before version 4.9-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 4.9-1. # pacman -Syu "squid>=4.9-1" The problems have been fixed upstream in version 4.9. Workaround ========== - CVE-2019-12526 Deny urn: protocol URI being proxied to all clients: acl URN proto URN http_access deny URN - CVE-2019-18678 There are no workarounds for this vulnerability. - CVE-2019-18679 Digest authentication can be disabled by removing all 'auth_param digest ...' configuration settings from squid.conf. Description =========== - CVE-2019-12526 (arbitrary code execution) A heap-based buffer overflow has been found in Squid before 4.9, when processing URN. - CVE-2019-18678 (content spoofing) A HTTP request splitting issue has been found in Squid before 4.9. This issue allows attackers to smuggle HTTP requests through frontend software to a Squid which splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between client and Squid with attacker controlled content at arbitrary URLs. - CVE-2019-18679 (information disclosure) An information disclosure issue has been found in Squid before 4.9, when processing HTTP Digest Authentication. The nonce tokens contain the raw byte value of a pointer which sits within heap memory allocation, which reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks. Impact ====== A remote attacker might access sensitive information, corrupt the content of arbitrary URLs in the caches or execute arbitrary code. References ========== http://www.squid-cache.org/Advisories/SQUID-2019_7.txt http://www.squid-cache.org/Advisories/SQUID-2019_10.txt http://www.squid-cache.org/Advisories/SQUID-2019_11.txt http://www.squid-cache.org/Versions/v4/changesets/squid-4-7aa0184a720fd2161… http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156d… http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156d… https://security.archlinux.org/CVE-2019-12526 https://security.archlinux.org/CVE-2019-18678 https://security.archlinux.org/CVE-2019-18679

1 0

[ASA-201911-7] electron: arbitrary code execution
by Remi Gacogne 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-7 ========================================= Severity: Critical Date : 2019-11-04 CVE-ID : CVE-2019-13720 Package : electron Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1061 Summary ======= The package electron before version 7.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.0.1-1. # pacman -Syu "electron>=7.0.1-1" The problem has been fixed upstream in version 7.0.1. Workaround ========== None. Description =========== A use-after-free vulnerability has been found in the audio component of the chromium browser before 78.0.3904.87. Google is aware of reports that an exploit for this vulnerability exists in the wild. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://github.com/electron/electron/commit/25b3ee29cf9a8e3f59dcbabf7345b5b… https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-des… https://crbug.com/1019226 https://security.archlinux.org/CVE-2019-13720

1 0

[ASA-201911-6] samba: multiple issues
by Christian Rebischke 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-6 ========================================= Severity: Medium Date : 2019-11-03 CVE-ID : CVE-2019-10218 CVE-2019-14833 CVE-2019-14847 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1057 Summary ======= The package samba before version 4.10.10-1 is vulnerable to multiple issues including arbitrary filesystem access, insufficient validation and denial of service. Resolution ========== Upgrade to 4.10.10-1. # pacman -Syu "samba>=4.10.10-1" The problems have been fixed upstream in version 4.10.10. Workaround ========== None. Description =========== - CVE-2019-10218 (arbitrary filesystem access) An issue has been found in Samba before 4.10.10 where a malicious server can craft a pathname containing separators and return this to client code, causing the client to use this access local pathnames for reading or writing instead of SMB network pathnames. - CVE-2019-14833 (insufficient validation) A security issue has been found in Samba before 4.10.10, where the check password script does not receive the full password string when the password contains multi-byte (non-ASCII) characters. Since Samba Version 4.5.0 a Samba AD DC can use a custom command to verify the password complexity. The command can be specified with the "check password script" smb.conf parameter. This command is called when Samba handles a user password change or a new user password is set. The script receives the new cleartext password string in order to run custom password complexity checks like dictionary checks to avoid weak user passwords. If the check password script parameter is not specified, Samba runs the internal password quality checks. The internal check makes sure that a password contains characters from three of five different characters categories. - CVE-2019-14847 (denial of service) A denial of service has been found in Samba before 4.10.10, where users with the "get changes" extended access right can crash the AD DC LDAP server by requesting an attribute using the range= syntax. By default, the supported versions of Samba impacted by this issue run using the "standard" process model, which is unaffected. This is controlled by the -M or --model parameter to the samba binary. Unsupported Samba versions before Samba 4.7 use a single process for the LDAP server, and so are impacted. Samba 4.8, 4.9 and 4.10 are impacted if -M prefork or -M single is used. To mitigate this issue, select -M standard (the default). Impact ====== An attacker is able to access and write on files via arbitrary paths or crash the application. References ========== https://www.samba.org/samba/security/CVE-2019-10218.html https://www.samba.org/samba/ftp/patches/security/samba-4.10.9-security-2019… https://www.samba.org/samba/security/CVE-2019-14833.html https://download.samba.org/pub/samba/patches/security/samba-4.10.9-security… https://www.samba.org/samba/security/CVE-2019-14847.html https://security.archlinux.org/CVE-2019-10218 https://security.archlinux.org/CVE-2019-14833 https://security.archlinux.org/CVE-2019-14847

1 0

[ASA-201911-5] ghostscript: sandbox escape
by Christian Rebischke 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-5 ========================================= Severity: High Date : 2019-11-03 CVE-ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 Package : ghostscript Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-1031 Summary ======= The package ghostscript before version 9.50-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 9.50-1. # pacman -Syu "ghostscript>=9.50-1" The problems have been fixed upstream in version 9.50. Workaround ========== None. Description =========== - CVE-2019-14811 (sandbox escape) Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator. - CVE-2019-14812 (sandbox escape) Safer Mode Bypass by .forceput Exposure in setuserparams - CVE-2019-14813 (sandbox escape) Safer Mode Bypass by .forceput Exposure in setsystemparams - CVE-2019-14817 (sandbox escape) Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures. Impact ====== An attacker is able to escape the sandbox provided by ghostscript. References ========== https://marc.info/?l=oss-security&m=156699539604858 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc427… http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=cd1b1cacadac2479e… https://security.archlinux.org/CVE-2019-14811 https://security.archlinux.org/CVE-2019-14812 https://security.archlinux.org/CVE-2019-14813 https://security.archlinux.org/CVE-2019-14817

1 0

[ASA-201911-4] python2: information disclosure
by Christian Rebischke 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-4 ========================================= Severity: High Date : 2019-11-03 CVE-ID : CVE-2019-9636 Package : python2 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-978 Summary ======= The package python2 before version 2.7.17-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.7.17-1. # pacman -Syu "python2>=2.7.17-1" The problem has been fixed upstream in version 2.7.17. Workaround ========== None. Description =========== Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. A specially crafted URL could be incorrectly parsed by urllib.parse.urlsplit and urllib.parse.urlparse to locate cookies or authentication data and send that information to a different host than when parsed correctly. Impact ====== A remote attacker is able to craft a malicious URL and transfer private data to a different host than expected. References ========== https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html https://github.com/python/cpython/commit/daad2c482c91de32d8305abbccc76a5de8… https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3… https://security.archlinux.org/CVE-2019-9636

1 0

[ASA-201911-3] glibc: information disclosure
by Christian Rebischke 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-3 ========================================= Severity: High Date : 2019-11-03 CVE-ID : CVE-2019-9169 Package : glibc Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-855 Summary ======= The package glibc before version 2.30-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.30-1. # pacman -Syu "glibc>=2.30-1" The problem has been fixed upstream in version 2.30. Workaround ========== None. Description =========== In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. Impact ====== An attacker is able to use malicious regular expressions to get access to sensitive information. References ========== https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=583dd860d5… https://sourceware.org/bugzilla/show_bug.cgi?id=24114 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142 https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140 https://security.archlinux.org/CVE-2019-9169

1 0