February 2019 - Arch-security - lists.archlinux.org

[ASA-201902-28] logstash: information disclosure
by Morten Linderud 26 Feb '19

26 Feb '19

Arch Linux Security Advisory ASA-201902-28 ========================================== Severity: High Date : 2019-02-25 CVE-ID : CVE-2019-7612 Package : logstash Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-913 Summary ======= The package logstash before version 6.6.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 6.6.1-1. # pacman -Syu "logstash>=6.6.1-1" The problem has been fixed upstream in version 6.6.1. Workaround ========== None. Description =========== A sensitive data disclosure flaw was found in the way Logstash logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message. Impact ====== A local attacker is able to obtain URL credentials by reading the error log. References ========== https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update… https://security.archlinux.org/CVE-2019-7612

1 0

[ASA-201902-27] elasticsearch: privilege escalation
by Morten Linderud 26 Feb '19

26 Feb '19

Arch Linux Security Advisory ASA-201902-27 ========================================== Severity: High Date : 2019-02-25 CVE-ID : CVE-2019-7611 Package : elasticsearch Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-912 Summary ======= The package elasticsearch before version 6.6.1-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 6.6.1-1. # pacman -Syu "elasticsearch>=6.6.1-1" The problem has been fixed upstream in version 6.6.1. Workaround ========== None. Description =========== A permission issue was found in Elasticsearch when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index. Impact ====== An authenticated remote user can gain additional privileges on a index. References ========== https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update… https://security.archlinux.org/CVE-2019-7611

1 0

[ASA-201902-26] kibana: multiple issues
by Morten Linderud 26 Feb '19

26 Feb '19

Arch Linux Security Advisory ASA-201902-26 ========================================== Severity: High Date : 2019-02-25 CVE-ID : CVE-2019-7608 CVE-2019-7609 CVE-2019-7610 Package : kibana Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-911 Summary ======= The package kibana before version 6.6.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 6.6.1-1. # pacman -Syu "kibana>=6.6.1-1" The problems have been fixed upstream in version 6.6.1. Workaround ========== None. Description =========== - CVE-2019-7608 (information disclosure) Kibana versions before 5.6.15 and 6.6.1 had a cross-site scripting (XSS) vulnerability that could allow an attacker to obtain sensitive information from, or perform destructive actions on behalf of, other Kibana users. - CVE-2019-7609 (arbitrary code execution) Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. - CVE-2019-7610 (arbitrary code execution) Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the security audit logger. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system. Impact ====== An authenticated malicious user can disclose sensitive information or execute arbitrary code. References ========== https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update… https://security.archlinux.org/CVE-2019-7608 https://security.archlinux.org/CVE-2019-7609 https://security.archlinux.org/CVE-2019-7610

1 0

[ASA-201902-25] bind: multiple issues
by Morten Linderud 26 Feb '19

26 Feb '19

Arch Linux Security Advisory ASA-201902-25 ========================================== Severity: High Date : 2019-02-25 CVE-ID : CVE-2018-5744 CVE-2018-5745 CVE-2019-6465 Package : bind Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-915 Summary ======= The package bind before version 9.13.7-1 is vulnerable to multiple issues including denial of service and access restriction bypass. Resolution ========== Upgrade to 9.13.7-1. # pacman -Syu "bind>=9.13.7-1" The problems have been fixed upstream in version 9.13.7. Workaround ========== None. Description =========== - CVE-2018-5744 (denial of service) A failure to free memory can occur when processing messages having a specific combination of EDNS options has been found in bind before 9.13.7. By exploiting this condition, an attacker can potentially cause named's memory use to grow without bounds until all memory available to the process is exhausted. Typically a server process is limited as to the amount of memory it can use but if the named process is not limited by the operating system all free memory on the server could be exhausted. - CVE-2018-5745 (denial of service) "managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which operators configure for use in DNSSEC validation. Before 9.13.7, due to an error in the managed-keys feature, it is possible for a BIND server which uses managed-keys to exit due to an assertion failure if, during key rollover, a trust anchor's keys are replaced with keys which use an unsupported algorithm. - CVE-2019-6465 (access restriction bypass) Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable in bind before 9.13.7. A client exercising this defect can request and receive a zone transfer of a DLZ even when not permitted to do so by the allow-transfer ACL. Impact ====== A remote user can bypass the allow-transfer ACL to access sensitive information in a DLZ, or crash the server. References ========== https://kb.isc.org/docs/cve-2018-5744 https://kb.isc.org/docs/cve-2018-5745 https://kb.isc.org/docs/cve-2019-6465 https://security.archlinux.org/CVE-2018-5744 https://security.archlinux.org/CVE-2018-5745 https://security.archlinux.org/CVE-2019-6465

1 0

[ASA-201902-24] systemd: denial of service
by Morten Linderud 26 Feb '19

26 Feb '19

Arch Linux Security Advisory ASA-201902-24 ========================================== Severity: High Date : 2019-02-21 CVE-ID : CVE-2019-6454 Package : systemd Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-906 Summary ======= The package systemd before version 241.7-1 is vulnerable to denial of service. Resolution ========== Upgrade to 241.7-1. # pacman -Syu "systemd>=241.7-1" The problem has been fixed upstream in version 241.7. Workaround ========== None. Description =========== It was found that bus_process_object() in bus-objects.c allocates a buffer on the stack large enough to temporarily store the object path specified in the incoming message. A malicious unprivileged local user to send a message which results in the stack pointer moving outside of the bounds of the currently mapped stack region, jumping over the stack guard pages. A specifically crafted DBUS message could crash PID 1 and result in a subsequent kernel panic. Impact ====== A local attacker can cause a denial of service via a crafted DBUS message. References ========== https://bugs.archlinux.org/task/61804 https://bugzilla.redhat.com/show_bug.cgi?id=1667032 https://www.openwall.com/lists/oss-security/2019/02/18/3 https://github.com/systemd/systemd/commit/612b74d32f970c43c14ad087ad0864247… https://github.com/systemd/systemd/commit/61397a60d98e368a5720b37e83f3169e3… https://github.com/systemd/systemd/commit/f519a19bcd5afe674a9b8fc462cd77d8b… https://security.archlinux.org/CVE-2019-6454

1 0

[ASA-201902-23] thunderbird: multiple issues
by Morten Linderud 26 Feb '19

26 Feb '19

Arch Linux Security Advisory ASA-201902-23 ========================================== Severity: Critical Date : 2019-02-20 CVE-ID : CVE-2018-18335 CVE-2018-18356 CVE-2018-18509 CVE-2019-5785 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-908 Summary ======= The package thunderbird before version 60.5.1-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 60.5.1-1. # pacman -Syu "thunderbird>=60.5.1-1" The problems have been fixed upstream in version 60.5.1. Workaround ========== None. Description =========== - CVE-2018-18335 (arbitrary code execution) A heap-based buffer overflow has been found in the Skia component of chromium before 71.0.3578.80 and thunderbird before 60.5.1. - CVE-2018-18356 (arbitrary code execution) A use-after-free has been found in the Skia component of chromium before 71.0.3578.80 and firefox before 65.0.1 and thunderbird before 60.5.1. - CVE-2018-18509 (insufficient validation) A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird before 60.5.1 as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. - CVE-2019-5785 (arbitrary code execution) An integer overflow issue has been found in the Skia component of firefox before 65.0.1 and thunderbird before 60.5.1. Impact ====== A remote attacker can reuse a valid S/MIME signature to craft an e-mail message with arbitrary content, and execute arbitrary code through skia. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/ https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=895362 https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2018-183… https://bugzilla.mozilla.org/show_bug.cgi?id=1525815 https://bugs.chromium.org/p/chromium/issues/detail?id=883666 https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2018-183… https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2018-183… https://bugzilla.mozilla.org/show_bug.cgi?id=1525817 https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1507218 https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2019-5785 https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2019-5785 https://bugzilla.mozilla.org/show_bug.cgi?id=1525433 https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexit… https://security.archlinux.org/CVE-2018-18335 https://security.archlinux.org/CVE-2018-18356 https://security.archlinux.org/CVE-2018-18509 https://security.archlinux.org/CVE-2019-5785

1 0

[ASA-201902-22] msmtp: certificate verification bypass
by Morten Linderud 25 Feb '19

25 Feb '19

Arch Linux Security Advisory ASA-201902-22 ========================================== Severity: High Date : 2019-02-17 CVE-ID : CVE-2019-8337 Package : msmtp Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-905 Summary ======= The package msmtp before version 1.8.3-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 1.8.3-1. # pacman -Syu "msmtp>=1.8.3-1" The problem has been fixed upstream in version 1.8.3. Workaround ========== None. Description =========== In msmtp 1.8.2, when tls_trust_file has its default configuration, certificate-verification results are not properly checked. Impact ====== The default configuration would omit certification verification. References ========== https://marlam.de/msmtp/news/ https://gitlab.marlam.de/marlam/msmtp/commit/a81d0a5126304f9f8b29a75d058044… https://security.archlinux.org/CVE-2019-8337

1 0

[ASA-201902-21] python-mysql-connector: authentication bypass
by Morten Linderud 25 Feb '19

25 Feb '19

Arch Linux Security Advisory ASA-201902-21 ========================================== Severity: High Date : 2019-02-17 CVE-ID : CVE-2019-2435 Package : python-mysql-connector Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-898 Summary ======= The package python-mysql-connector before version 8.0.15-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 8.0.15-1. # pacman -Syu "python-mysql-connector>=8.0.15-1" The problem has been fixed upstream in version 8.0.15. Workaround ========== None. Description =========== A flaw was found in mysql-connector prior to version 8.0.13. Unauthenticated attacker with network access via TLS could compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and can result in unauthorized creation, deletion or modification access to critical data. Impact ====== An unauthenticated attacker could serve malicious TLS traffic and bypass authentication. References ========== https://bugs.archlinux.org/task/61758 https://github.com/mysql/mysql-connector-python/commit/069bc6737dd13b7f3a41… https://security.netapp.com/advisory/ntap-20190118-0002/ https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html https://security.archlinux.org/CVE-2019-2435

1 0

[ASA-201902-20] flatpak: privilege escalation
by Jelle van der Waa 18 Feb '19

18 Feb '19

Arch Linux Security Advisory ASA-201902-20 ========================================== Severity: High Date : 2019-02-17 CVE-ID : CVE-2019-5736 Package : flatpak Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-880 Summary ======= The package flatpak before version 1.2.3-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.2.3-1. # pacman -Syu "flatpak>=1.2.3-1" The problem has been fixed upstream in version 1.2.3. Workaround ========== None. Description =========== A vulnerability discovered in runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe. Impact ====== A malicious container can escalate privileges to gain access as root on the host system and execute arbitrary code. References ========== https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9d https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef39840581… https://www.openwall.com/lists/oss-security/2019/02/11/2 https://security.archlinux.org/CVE-2019-5736

1 0

[ASA-201902-19] cairo: arbitrary code execution
by Jelle van der Waa 18 Feb '19

18 Feb '19

Arch Linux Security Advisory ASA-201902-19 ========================================== Severity: Critical Date : 2019-02-17 CVE-ID : CVE-2018-19876 Package : cairo Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-826 Summary ======= The package cairo before version 1.16.0-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.16.0-2. # pacman -Syu "cairo>=1.16.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A memory-corruption issue has been found in cairo versions <= 1.16.0, in the cairo_ft_apply_variations() function in cairo-ft-font.c. This function frees memory using the wrong free function, leading to memory corruption. As cairo is used, among others, by WebKitGTK+, this could be triggered by a crafted web content in some cases. Impact ====== A malicious remote user could execute arbitrary code by sending specially crafted web content. References ========== https://seclists.org/oss-sec/2018/q4/205 https://gitlab.freedesktop.org/cairo/cairo/merge_requests/5 https://security.archlinux.org/CVE-2018-19876

1 0

[ASA-201902-18] hiawatha: directory traversal
by Jelle van der Waa 18 Feb '19

18 Feb '19

Arch Linux Security Advisory ASA-201902-18 ========================================== Severity: High Date : 2019-02-16 CVE-ID : CVE-2019-8358 Package : hiawatha Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-900 Summary ======= The package hiawatha before version 10.8.4-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 10.8.4-1. # pacman -Syu "hiawatha>=10.8.4-1" The problem has been fixed upstream in version 10.8.4. Workaround ========== None. Description =========== In Hiawatha before 10.8.4 a remote attacker is able to do directory traversal if AllowDotFiles is enabled. Impact ====== A remote attacker is able to read arbitrary files from a hiawatha server. References ========== https://www.hiawatha-webserver.org/changelog https://security.archlinux.org/CVE-2019-8358

1 0

[ASA-201902-17] webkit2gtk: arbitrary code execution
by Jelle van der Waa 18 Feb '19

18 Feb '19

Arch Linux Security Advisory ASA-201902-17 ========================================== Severity: Critical Date : 2019-02-15 CVE-ID : CVE-2019-6212 CVE-2019-6215 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-899 Summary ======= The package webkit2gtk before version 2.22.6-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.22.6-1. # pacman -Syu "webkit2gtk>=2.22.6-1" The problems have been fixed upstream in version 2.22.6. Workaround ========== None. Description =========== - CVE-2019-6212 (arbitrary code execution) Multiple memory corruption issues have been found in WebKitGTK+ before 2.22.6, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-6215 (arbitrary code execution) A type confusion issue has been found in WebKitGTK+ before 2.22.6, where processing maliciously crafted web content may lead to arbitrary code execution. Impact ====== A remote attacker can execute arbitrary code via maliciously crafted web content. References ========== https://webkitgtk.org/security/WSA-2019-0001.html https://webkitgtk.org/security/WSA-2019-0001.html#CVE-2019-6212 https://webkitgtk.org/security/WSA-2019-0001.html#CVE-2019-6215 https://security.archlinux.org/CVE-2019-6212 https://security.archlinux.org/CVE-2019-6215

1 0

[ASA-201902-16] firefox: multiple issues
by Jelle van der Waa 18 Feb '19

18 Feb '19

Arch Linux Security Advisory ASA-201902-16 ========================================== Severity: High Date : 2019-02-13 CVE-ID : CVE-2018-18356 CVE-2018-18511 CVE-2019-5785 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-896 Summary ======= The package firefox before version 65.0.1-1 is vulnerable to multiple issues including arbitrary code execution and same-origin policy bypass. Resolution ========== Upgrade to 65.0.1-1. # pacman -Syu "firefox>=65.0.1-1" The problems have been fixed upstream in version 65.0.1. Workaround ========== None. Description =========== - CVE-2018-18356 (arbitrary code execution) A use-after-free has been found in the Skia component of chromium before 71.0.3578.80 and firefox before 65.0.1. - CVE-2018-18511 (same-origin policy bypass) A cross-origin theft of images issue has been found in the ImageBitmapRenderingContext component of firefox 65.0, where cross- origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. The issue has been fixed in 65.0.1 and versions prior to 65.0 were not affected. - CVE-2019-5785 (arbitrary code execution) An integer overflow issue has been found in the Skia component of firefox before 65.0.1. Impact ====== A remote attacker can bypass the same-origin policy to access sensitive information, or execute arbitrary code, via a crafted web content. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/ https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=883666 https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2018-183… https://bugzilla.mozilla.org/show_bug.cgi?id=1525817 https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2019-5785 https://bugzilla.mozilla.org/show_bug.cgi?id=1526218 https://bugzilla.mozilla.org/show_bug.cgi?id=1525433 https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexit… https://security.archlinux.org/CVE-2018-18356 https://security.archlinux.org/CVE-2018-18511 https://security.archlinux.org/CVE-2019-5785

1 0

[ASA-201902-15] python2-django: denial of service
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-15 ========================================== Severity: Medium Date : 2019-02-12 CVE-ID : CVE-2019-6975 Package : python2-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-882 Summary ======= The package python2-django before version 1.11.19-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.11.19-1. # pacman -Syu "python2-django>=1.11.19-1" The problem has been fixed upstream in version 1.11.19. Workaround ========== None. Description =========== Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows uncontrolled memory consumption via a malicious attacker- supplied value to the django.utils.numberformat.format() function. If the affected numberformat function as used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters receives a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format(). Impact ====== A remote attacker is able to crash a target server that uses float- number-based filters by making the server filter numbers with very large exponents or number of digits. References ========== https://www.djangoproject.com/weblog/2019/feb/11/security-releases/ https://www.openwall.com/lists/oss-security/2019/02/11/1 https://github.com/django/django/commit/0bbb560183fabf0533289700845dafa9495… https://github.com/django/django/commit/40cd19055773705301c3428ed5e08a036d2… https://security.archlinux.org/CVE-2019-6975

1 0

[ASA-201902-14] python-django: denial of service
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-14 ========================================== Severity: Medium Date : 2019-02-12 CVE-ID : CVE-2019-6975 Package : python-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-881 Summary ======= The package python-django before version 2.1.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.1.6-1. # pacman -Syu "python-django>=2.1.6-1" The problem has been fixed upstream in version 2.1.6. Workaround ========== None. Description =========== Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows uncontrolled memory consumption via a malicious attacker- supplied value to the django.utils.numberformat.format() function. If the affected numberformat function as used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters receives a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format(). Impact ====== A remote attacker is able to crash a target server that uses float- number-based filters by making the server filter numbers with very large exponents or number of digits. References ========== https://www.djangoproject.com/weblog/2019/feb/11/security-releases/ https://www.openwall.com/lists/oss-security/2019/02/11/1 https://github.com/django/django/commit/0bbb560183fabf0533289700845dafa9495… https://github.com/django/django/commit/40cd19055773705301c3428ed5e08a036d2… https://security.archlinux.org/CVE-2019-6975

1 0

[ASA-201902-13] lib32-curl: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-13 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : lib32-curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-874 Summary ======= The package lib32-curl before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "lib32-curl>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0

[ASA-201902-12] lib32-libcurl-compat: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-12 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : lib32-libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-875 Summary ======= The package lib32-libcurl-compat before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "lib32-libcurl-compat>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0

[ASA-201902-11] lib32-libcurl-gnutls: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-11 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : lib32-libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-876 Summary ======= The package lib32-libcurl-gnutls before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0

[ASA-201902-10] libcurl-gnutls: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-10 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-877 Summary ======= The package libcurl-gnutls before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "libcurl-gnutls>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0

[ASA-201902-9] curl: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-9 ========================================= Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-873 Summary ======= The package curl before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "curl>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0

[ASA-201902-8] aubio: denial of service
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-8 ========================================= Severity: Medium Date : 2019-02-12 CVE-ID : CVE-2018-19800 CVE-2018-19801 CVE-2018-19802 Package : aubio Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-888 Summary ======= The package aubio before version 0.4.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.4.9-1. # pacman -Syu "aubio>=0.4.9-1" The problems have been fixed upstream in version 0.4.9. Workaround ========== None. Description =========== - CVE-2018-19800 (denial of service) A potential buffer overflow vulnerability was found on invalid new_aubio-tempo in aubio before 0.4.9, which may lead to application crash when playing a crafted audio file. - CVE-2018-19801 (denial of service) A NULL pointer dereference (denial of service) vulnerability was found on invalid n_filters in aubio before 0.4.9, which may lead to application crash when playing a crafted audio file. - CVE-2018-19802 (denial of service) A NULL pointer dereference (denial of service) vulnerability was found on invalid new_aubio_onset in aubio before 0.4.9, which may lead to application crash when playing a crafted audio file. Impact ====== An attacker might be able to crash the software by tricking the user into opening a crafted audio file. References ========== https://github.com/aubio/aubio/blob/0.4.9/ChangeLog#L14-L17 https://github.com/aubio/aubio/commit/1cf031a3a5b869368562b1251419fd45191ea… https://github.com/aubio/aubio/commit/bcc53876548334b4c5f1ebd47a5bd5f151974… https://github.com/aubio/aubio/commit/c5ee1307bdc004e43302abeca1802c2692b33… https://security.archlinux.org/CVE-2018-19800 https://security.archlinux.org/CVE-2018-19801 https://security.archlinux.org/CVE-2018-19802

1 0

[ASA-201902-7] libu2f-host: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-7 ========================================= Severity: High Date : 2019-02-11 CVE-ID : CVE-2018-20340 Package : libu2f-host Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-884 Summary ======= The package libu2f-host before version 1.1.7-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.1.7-1. # pacman -Syu "libu2f-host>=1.1.7-1" The problem has been fixed upstream in version 1.1.7. Workaround ========== None. Description =========== Yubico library libu2f-host prior to version 1.1.7 contains an unchecked buffer, which could allow a buffer overflow. Libu2f-host is a library that implements the host party of the U2F protocol. This issue can allow an attacker with a custom made malicious USB device masquerading as a security key, and physical access to a computer where PAM U2F or an application with libu2f-host integrated, to potentially execute arbitrary code on that computer. Users of the YubiKey PAM U2F Tool are the most impacted since the arbitrary code could execute with elevated privileges. Impact ====== A malicious USB device can execute arbitrary code on the host. References ========== https://www.yubico.com/support/security-advisories/ysa-2019-01/ https://security.archlinux.org/CVE-2018-20340

1 0

[ASA-201902-6] runc: privilege escalation
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-6 ========================================= Severity: High Date : 2019-02-11 CVE-ID : CVE-2019-5736 Package : runc Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-878 Summary ======= The package runc before version 1.0.0rc6-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.0.0rc6-1. # pacman -Syu "runc>=1.0.0rc6-1" The problem has been fixed upstream in version 1.0.0rc6. Workaround ========== Don't run privileged containers. Description =========== A vulnerability discovered in runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe. Impact ====== A malicious container can escalate privileges to gain access as root on the host system and execute arbitrary code. References ========== https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9d https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef39840581… https://www.openwall.com/lists/oss-security/2019/02/11/2 https://security.archlinux.org/CVE-2019-5736

1 0

[ASA-201902-5] rdesktop: multiple issues
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-5 ========================================= Severity: High Date : 2019-02-11 CVE-ID : CVE-2018-8791 CVE-2018-8792 CVE-2018-8793 CVE-2018-8794 CVE-2018-8795 CVE-2018-8796 CVE-2018-8797 CVE-2018-8798 CVE-2018-8799 CVE-2018-8800 CVE-2018-20174 CVE-2018-20175 CVE-2018-20176 CVE-2018-20177 CVE-2018-20178 CVE-2018-20179 CVE-2018-20180 CVE-2018-20181 CVE-2018-20182 Package : rdesktop Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-871 Summary ======= The package rdesktop before version 1.8.4-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 1.8.4-1. # pacman -Syu "rdesktop>=1.8.4-1" The problems have been fixed upstream in version 1.8.4. Workaround ========== None. Description =========== - CVE-2018-8791 (information disclosure) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function rdpdr_process() that results in an information leak. - CVE-2018-8792 (denial of service) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function cssp_read_tsrequest() that results in a denial of service (segfault). - CVE-2018-8793 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution. - CVE-2018-8794 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to an integer overflow that leads to an out-of-bounds write in function process_bitmap_updates() and results in a memory corruption and possibly even a remote code execution. - CVE-2018-8795 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to an integer overflow that leads to a heap-based buffer overflow in function process_bitmap_updates() and results in a memory corruption and probably even a remote code execution. - CVE-2018-8796 (denial of service) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function process_bitmap_updates() that results in a denial of service (segfault). - CVE-2018-8797 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in function process_plane() that results in a memory corruption and probably even a remote code execution. - CVE-2018-8798 (information disclosure) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function rdpsnd_process_ping() that results in an information leak. - CVE-2018-8799 (denial of service) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function process_secondary_order() that results in a denial of service (segfault). - CVE-2018-8800 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in function ui_clip_handle_data() that results in a memory corruption and probably even a remote code execution. - CVE-2018-20174 (information disclosure) rdesktop before 1.8.4 is vulnerable to an information leak in ui_clip_handle_data(). - CVE-2018-20175 (denial of service) rdesktop before 1.8.4 is vulnerable to denial of service in mcs_recv_connect_response() and mcs_parse_domain_params(). - CVE-2018-20176 (denial of service) rdesktop before 1.8.4 is vulnerable to denial of service in sec_parse_crypt_info() and sec_recv(). - CVE-2018-20177 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a memory corruption issue in rdp_in_unistr() that could lead to arbitrary code execution. - CVE-2018-20178 (denial of service) rdesktop before 1.8.4 is vulnerable to denial of service in process_demand_active(). - CVE-2018-20179 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in lspci_process(). - CVE-2018-20180 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in rdpsnddbg_process(). - CVE-2018-20181 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in seamless_process(). - CVE-2018-20182 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in seamless_process_line(). Impact ====== A remote attacker is able to execute arbitrary code, access sensitive information or crash rdesktop when the client connects to a malicious server in control of the attacker. References ========== https://bugs.archlinux.org/task/61652 https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad8… https://security.archlinux.org/CVE-2018-8791 https://security.archlinux.org/CVE-2018-8792 https://security.archlinux.org/CVE-2018-8793 https://security.archlinux.org/CVE-2018-8794 https://security.archlinux.org/CVE-2018-8795 https://security.archlinux.org/CVE-2018-8796 https://security.archlinux.org/CVE-2018-8797 https://security.archlinux.org/CVE-2018-8798 https://security.archlinux.org/CVE-2018-8799 https://security.archlinux.org/CVE-2018-8800 https://security.archlinux.org/CVE-2018-20174 https://security.archlinux.org/CVE-2018-20175 https://security.archlinux.org/CVE-2018-20176 https://security.archlinux.org/CVE-2018-20177 https://security.archlinux.org/CVE-2018-20178 https://security.archlinux.org/CVE-2018-20179 https://security.archlinux.org/CVE-2018-20180 https://security.archlinux.org/CVE-2018-20181 https://security.archlinux.org/CVE-2018-20182

1 0

[ASA-201902-4] spice: arbitrary code execution
by Santiago Torres-Arias 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-4 ========================================= Severity: Critical Date : 2019-02-11 CVE-ID : CVE-2019-3813 Package : spice Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-866 Summary ======= The package spice before version 0.14.0-3 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.14.0-3. # pacman -Syu "spice>=0.14.0-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of- bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. Impact ====== A remote, unauthenticated attacker might be able to crash the server, or even execute arbitrary code on said server. References ========== https://bugs.archlinux.org/task/61650 https://gitlab.freedesktop.org/spice/spice/commit/a4a16ac42d2f19a17e3655654… https://access.redhat.com/errata/RHSA-2019:0231 https://security.archlinux.org/CVE-2019-3813

1 0

[ASA-201902-3] chromium: multiple issues
by Santiago Torres-Arias 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-3 ========================================= Severity: Critical Date : 2019-02-11 CVE-ID : CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5783 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-861 Summary ======= The package chromium before version 72.0.3626.81-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing and insufficient validation. Resolution ========== Upgrade to 72.0.3626.81-1. # pacman -Syu "chromium>=72.0.3626.81-1" The problems have been fixed upstream in version 72.0.3626.81. Workaround ========== None. Description =========== - CVE-2019-5754 (arbitrary code execution) A security issue has been found in the QUIC implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5755 (arbitrary code execution) A security issue has been found in the V8 implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5756 (arbitrary code execution) A use after free issue has been found in the PDFium component of the chromium browser before 72.0.3626.81. - CVE-2019-5757 (arbitrary code execution) A type confusion issue has been found in the SVG implementation in the chromium browser before 72.0.3626.81. - CVE-2019-5758 (arbitrary code execution) A use after free issue has been found in the blink component of the chromium browser before 72.0.3626.81. - CVE-2019-5759 (arbitrary code execution) A use after free issue has been found in the HTML select elements component of the chromium browser before 72.0.3626.81. - CVE-2019-5760 (arbitrary code execution) A use after free issue has been found in the WebRTC implementation in the chromium browser before 72.0.3626.81. - CVE-2019-5761 (arbitrary code execution) A use after free issue has been found in the SwiftShader component of the chromium browser before 72.0.3626.81. - CVE-2019-5762 (arbitrary code execution) A use after free issue has been found in the PDFium component of the chromium browser before 72.0.3626.81. - CVE-2019-5763 (arbitrary code execution) A security issue has been found in the V8 implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5764 (arbitrary code execution) A use-after-free vulnerability has been found in the WebRTC component of the chromium browser before 72.0.3626.81. - CVE-2019-5765 (access restriction bypass) An insufficient policy enforcement issue has been found in the chromium browser before 72.0.3626.81. - CVE-2019-5766 (access restriction bypass) An insufficient policy enforcement issue has been found in the Canvas component of the chromium browser before 72.0.3626.81. - CVE-2019-5767 (content spoofing) An incorrect security UI issue has been found in the WebAPKs component of the chromium browser before 72.0.3626.81. - CVE-2019-5768 (access restriction bypass) An insufficient policy enforcement issue has been found in the DevTools component of the chromium browser before 72.0.3626.81. - CVE-2019-5769 (insufficient validation) An insufficient validation of untrusted input issue has been found in the Blink component of the chromium browser before 72.0.3626.81. - CVE-2019-5770 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the WebGL component of the chromium browser before 72.0.3626.81. - CVE-2019-5771 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the SwiftShader component of the chromium browser before 72.0.3626.81. - CVE-2019-5772 (arbitrary code execution) A use-after-free vulnerability has been found in the PDFium component of the chromium browser before 72.0.3626.81. - CVE-2019-5773 (insufficient validation) An insufficient data validation issue has been found in the IndexedDB component of the chromium browser before 72.0.3626.81. - CVE-2019-5774 (insufficient validation) An insufficient validation of untrusted input issue has been found in the SafeBrowsing component of the chromium browser before 72.0.3626.81. - CVE-2019-5775 (content spoofing) An insufficient policy enforcement issue has been found in the OmniBox component of the chromium browser before 72.0.3626.81, allowing IDN URL spoofing. - CVE-2019-5776 (content spoofing) An insufficient policy enforcement issue has been found in the OmniBox component of the chromium browser before 72.0.3626.81, allowing IDN URL spoofing. - CVE-2019-5777 (content spoofing) An insufficient policy enforcement issue has been found in the OmniBox component of the chromium browser before 72.0.3626.81, allowing IDN URL spoofing. - CVE-2019-5778 (access restriction bypass) An insufficient policy enforcement issue has been found in the Extensions component of the chromium browser before 72.0.3626.81. - CVE-2019-5779 (access restriction bypass) An insufficient policy enforcement issue has been found in the ServiceWorker component of the chromium browser before 72.0.3626.81. - CVE-2019-5780 (access restriction bypass) A security issue has been found in the chromium browser before 72.0.3626.81 leading to Insufficient policy enforcement. - CVE-2019-5781 (content spoofing) A security issue has been found in the Omnibox implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5782 (arbitrary code execution) A security issue has been found in the V8 implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5783 (insufficient validation) An insufficient validation of untrusted input issue has been found in the DevTools component of the chromium browser before 72.0.3626.81. Impact ====== A remote attacker can spoof the URL in the address bar, bypass security policies or execute arbitrary code. References ========== https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=914497 https://bugs.chromium.org/p/chromium/issues/detail?id=913296 https://bugs.chromium.org/p/chromium/issues/detail?id=895152 https://bugs.chromium.org/p/chromium/issues/detail?id=915469 https://bugs.chromium.org/p/chromium/issues/detail?id=913970 https://bugs.chromium.org/p/chromium/issues/detail?id=912211 https://bugs.chromium.org/p/chromium/issues/detail?id=912074 https://bugs.chromium.org/p/chromium/issues/detail?id=904714 https://bugs.chromium.org/p/chromium/issues/detail?id=900552 https://bugs.chromium.org/p/chromium/issues/detail?id=914731 https://bugs.chromium.org/p/chromium/issues/detail?id=913246 https://bugs.chromium.org/p/chromium/issues/detail?id=922627 https://bugs.chromium.org/p/chromium/issues/detail?id=907047 https://bugs.chromium.org/p/chromium/issues/detail?id=902427 https://bugs.chromium.org/p/chromium/issues/detail?id=805557 https://bugs.chromium.org/p/chromium/issues/detail?id=913975 https://bugs.chromium.org/p/chromium/issues/detail?id=908749 https://bugs.chromium.org/p/chromium/issues/detail?id=904265 https://bugs.chromium.org/p/chromium/issues/detail?id=908292 https://bugs.chromium.org/p/chromium/issues/detail?id=917668 https://bugs.chromium.org/p/chromium/issues/detail?id=904182 https://bugs.chromium.org/p/chromium/issues/detail?id=896722 https://bugs.chromium.org/p/chromium/issues/detail?id=863663 https://bugs.chromium.org/p/chromium/issues/detail?id=849421 https://bugs.chromium.org/p/chromium/issues/detail?id=918470 https://bugs.chromium.org/p/chromium/issues/detail?id=891697 https://bugs.chromium.org/p/chromium/issues/detail?id=896725 https://bugs.chromium.org/p/chromium/issues/detail?id=906043 https://bugs.chromium.org/p/chromium/issues/detail?id=895081 https://security.archlinux.org/CVE-2019-5754 https://security.archlinux.org/CVE-2019-5755 https://security.archlinux.org/CVE-2019-5756 https://security.archlinux.org/CVE-2019-5757 https://security.archlinux.org/CVE-2019-5758 https://security.archlinux.org/CVE-2019-5759 https://security.archlinux.org/CVE-2019-5760 https://security.archlinux.org/CVE-2019-5761 https://security.archlinux.org/CVE-2019-5762 https://security.archlinux.org/CVE-2019-5763 https://security.archlinux.org/CVE-2019-5764 https://security.archlinux.org/CVE-2019-5765 https://security.archlinux.org/CVE-2019-5766 https://security.archlinux.org/CVE-2019-5767 https://security.archlinux.org/CVE-2019-5768 https://security.archlinux.org/CVE-2019-5769 https://security.archlinux.org/CVE-2019-5770 https://security.archlinux.org/CVE-2019-5771 https://security.archlinux.org/CVE-2019-5772 https://security.archlinux.org/CVE-2019-5773 https://security.archlinux.org/CVE-2019-5774 https://security.archlinux.org/CVE-2019-5775 https://security.archlinux.org/CVE-2019-5776 https://security.archlinux.org/CVE-2019-5777 https://security.archlinux.org/CVE-2019-5778 https://security.archlinux.org/CVE-2019-5779 https://security.archlinux.org/CVE-2019-5780 https://security.archlinux.org/CVE-2019-5781 https://security.archlinux.org/CVE-2019-5782 https://security.archlinux.org/CVE-2019-5783

1 0

[ASA-201902-2] firefox: multiple issues
by Remi Gacogne 11 Feb '19

11 Feb '19

Arch Linux Security Advisory ASA-201902-2 ========================================= Severity: Critical Date : 2019-02-06 CVE-ID : CVE-2018-18500 CVE-2018-18501 CVE-2018-18502 CVE-2018-18503 CVE-2018-18504 CVE-2018-18505 CVE-2018-18506 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-862 Summary ======= The package firefox before version 65.0-1 is vulnerable to multiple issues including arbitrary code execution, privilege escalation and access restriction bypass. Resolution ========== Upgrade to 65.0-1. # pacman -Syu "firefox>=65.0-1" The problems have been fixed upstream in version 65.0. Workaround ========== None. Description =========== - CVE-2018-18500 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 65.0, that can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. - CVE-2018-18501 (arbitrary code execution) Several memory safety bugs have been found in Firefox < 65.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-18502 (arbitrary code execution) Several memory safety bugs have been found in Firefox < 65.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-18503 (arbitrary code execution) A memory corruption vulnerability has been found in the Audio Buffer component of Firefox < 65.0. When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatch in some situations. - CVE-2018-18504 (arbitrary code execution) A memory corruption and out-of-bounds read have been found in Firefox < 65.0, that can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results in a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. - CVE-2018-18505 (privilege escalation) A privilege escalation issue has been found in Firefox < 65.0. An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. - CVE-2018-18506 (access restriction bypass) When proxy auto-detection is enabled in Firefox < 65.0, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. Impact ====== A remote attacker might be able to execute arbitrary code via a crafted web content, or force requests to localhost to be sent through a proxy to another server. A local attacker might be able to escape firefox's sandbox via privilege escalation . References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1510114 https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1512450%2C1517542%2C1513201… https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1499426%2C1480090%2C1472990… https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1509442 https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1496413 https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1497749 https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1503393 https://security.archlinux.org/CVE-2018-18500 https://security.archlinux.org/CVE-2018-18501 https://security.archlinux.org/CVE-2018-18502 https://security.archlinux.org/CVE-2018-18503 https://security.archlinux.org/CVE-2018-18504 https://security.archlinux.org/CVE-2018-18505 https://security.archlinux.org/CVE-2018-18506

1 0

[ASA-201902-1] dovecot: authentication bypass
by Remi Gacogne 11 Feb '19

11 Feb '19

Arch Linux Security Advisory ASA-201902-1 ========================================= Severity: High Date : 2019-02-06 CVE-ID : CVE-2019-3814 Package : dovecot Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-872 Summary ======= The package dovecot before version 2.3.4.1-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 2.3.4.1-1. # pacman -Syu "dovecot>=2.3.4.1-1" The problem has been fixed upstream in version 2.3.4.1. Workaround ========== None. Description =========== A vulnerability has been found in Dovecot versions prior to 2.3.4.1, allowing a remote client in possession of a trusted SSL certificate to log in as any user, in some configurations. This affects only installations using auth_ssl_require_client_cert = yes and auth_ssl_username_from_cert = yes, and the the attacker might have access to a trusted certificate without the ssl_cert_username_field (default to commonName) set in it. Impact ====== A remote client in possession of a trusted SSL certificate might be able to log in as any user. References ========== https://www.dovecot.org/pipermail/dovecot/2019-February/114575.html https://github.com/dovecot/core/commit/61471a5c42528090cffcca9bceded3167466… https://security.archlinux.org/CVE-2019-3814

1 0