November 2019 - Arch-security - lists.archlinux.org

[ASA-201911-2] qt5-webengine: arbitrary code execution
by Remi Gacogne 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-2 ========================================= Severity: Critical Date : 2019-11-02 CVE-ID : CVE-2019-13720 Package : qt5-webengine Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1059 Summary ======= The package qt5-webengine before version 5.13.2-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.13.2-2. # pacman -Syu "qt5-webengine>=5.13.2-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A use-after-free vulnerability has been found in the audio component of the chromium browser before 78.0.3904.87. Google is aware of reports that an exploit for this vulnerability exists in the wild. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/64347 https://code.qt.io/cgit/qt/qtwebengine-chromium.git/patch/?id=d6e5fc10e417e… https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-des… https://crbug.com/1019226 https://security.archlinux.org/CVE-2019-13720

1 0

[ASA-201911-2] qt5-webengine: arbitrary code execution
by Morten Linderud 02 Nov '19

02 Nov '19

Arch Linux Security Advisory ASA-201911-2 ========================================= Severity: Critical Date : 2019-11-02 CVE-ID : CVE-2019-13720 Package : qt5-webengine Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1059 Summary ======= The package qt5-webengine before version 5.13.2-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.13.2-2. # pacman -Syu "qt5-webengine>=5.13.2-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A use-after-free vulnerability has been found in the audio component of the chromium browser before 78.0.3904.87. Google is aware of reports that an exploit for this vulnerability exists in the wild. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/64347 https://code.qt.io/cgit/qt/qtwebengine-chromium.git/patch/?id=d6e5fc10e417e… https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-des… https://crbug.com/1019226 https://security.archlinux.org/CVE-2019-13720

1 0

[ASA-201911-1] chromium: arbitrary code execution
by Remi Gacogne 01 Nov '19

01 Nov '19

Arch Linux Security Advisory ASA-201911-1 ========================================= Severity: Critical Date : 2019-11-01 CVE-ID : CVE-2019-13720 CVE-2019-13721 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1058 Summary ======= The package chromium before version 78.0.3904.87-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 78.0.3904.87-1. # pacman -Syu "chromium>=78.0.3904.87-1" The problems have been fixed upstream in version 78.0.3904.87. Workaround ========== None. Description =========== - CVE-2019-13720 (arbitrary code execution) A use-after-free vulnerability has been found in the audio component of the chromium browser before 78.0.3904.87. Google is aware of reports that an exploit for this vulnerability exists in the wild. - CVE-2019-13721 (arbitrary code execution) A use-after-free vulnerability has been found in the PDFium component of the chromium browser before 78.0.3904.87. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-des… https://crbug.com/1019226 https://crbug.com/1013868 https://security.archlinux.org/CVE-2019-13720 https://security.archlinux.org/CVE-2019-13721

1 0