February 2019 - Arch-security - lists.archlinux.org

[ASA-201902-18] hiawatha: directory traversal
by Jelle van der Waa 18 Feb '19

18 Feb '19

Arch Linux Security Advisory ASA-201902-18 ========================================== Severity: High Date : 2019-02-16 CVE-ID : CVE-2019-8358 Package : hiawatha Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-900 Summary ======= The package hiawatha before version 10.8.4-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 10.8.4-1. # pacman -Syu "hiawatha>=10.8.4-1" The problem has been fixed upstream in version 10.8.4. Workaround ========== None. Description =========== In Hiawatha before 10.8.4 a remote attacker is able to do directory traversal if AllowDotFiles is enabled. Impact ====== A remote attacker is able to read arbitrary files from a hiawatha server. References ========== https://www.hiawatha-webserver.org/changelog https://security.archlinux.org/CVE-2019-8358

1 0

[ASA-201902-17] webkit2gtk: arbitrary code execution
by Jelle van der Waa 18 Feb '19

18 Feb '19

Arch Linux Security Advisory ASA-201902-17 ========================================== Severity: Critical Date : 2019-02-15 CVE-ID : CVE-2019-6212 CVE-2019-6215 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-899 Summary ======= The package webkit2gtk before version 2.22.6-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.22.6-1. # pacman -Syu "webkit2gtk>=2.22.6-1" The problems have been fixed upstream in version 2.22.6. Workaround ========== None. Description =========== - CVE-2019-6212 (arbitrary code execution) Multiple memory corruption issues have been found in WebKitGTK+ before 2.22.6, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-6215 (arbitrary code execution) A type confusion issue has been found in WebKitGTK+ before 2.22.6, where processing maliciously crafted web content may lead to arbitrary code execution. Impact ====== A remote attacker can execute arbitrary code via maliciously crafted web content. References ========== https://webkitgtk.org/security/WSA-2019-0001.html https://webkitgtk.org/security/WSA-2019-0001.html#CVE-2019-6212 https://webkitgtk.org/security/WSA-2019-0001.html#CVE-2019-6215 https://security.archlinux.org/CVE-2019-6212 https://security.archlinux.org/CVE-2019-6215

1 0

[ASA-201902-16] firefox: multiple issues
by Jelle van der Waa 18 Feb '19

18 Feb '19

Arch Linux Security Advisory ASA-201902-16 ========================================== Severity: High Date : 2019-02-13 CVE-ID : CVE-2018-18356 CVE-2018-18511 CVE-2019-5785 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-896 Summary ======= The package firefox before version 65.0.1-1 is vulnerable to multiple issues including arbitrary code execution and same-origin policy bypass. Resolution ========== Upgrade to 65.0.1-1. # pacman -Syu "firefox>=65.0.1-1" The problems have been fixed upstream in version 65.0.1. Workaround ========== None. Description =========== - CVE-2018-18356 (arbitrary code execution) A use-after-free has been found in the Skia component of chromium before 71.0.3578.80 and firefox before 65.0.1. - CVE-2018-18511 (same-origin policy bypass) A cross-origin theft of images issue has been found in the ImageBitmapRenderingContext component of firefox 65.0, where cross- origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. The issue has been fixed in 65.0.1 and versions prior to 65.0 were not affected. - CVE-2019-5785 (arbitrary code execution) An integer overflow issue has been found in the Skia component of firefox before 65.0.1. Impact ====== A remote attacker can bypass the same-origin policy to access sensitive information, or execute arbitrary code, via a crafted web content. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/ https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=883666 https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2018-183… https://bugzilla.mozilla.org/show_bug.cgi?id=1525817 https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2019-5785 https://bugzilla.mozilla.org/show_bug.cgi?id=1526218 https://bugzilla.mozilla.org/show_bug.cgi?id=1525433 https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexit… https://security.archlinux.org/CVE-2018-18356 https://security.archlinux.org/CVE-2018-18511 https://security.archlinux.org/CVE-2019-5785

1 0

[ASA-201902-15] python2-django: denial of service
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-15 ========================================== Severity: Medium Date : 2019-02-12 CVE-ID : CVE-2019-6975 Package : python2-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-882 Summary ======= The package python2-django before version 1.11.19-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.11.19-1. # pacman -Syu "python2-django>=1.11.19-1" The problem has been fixed upstream in version 1.11.19. Workaround ========== None. Description =========== Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows uncontrolled memory consumption via a malicious attacker- supplied value to the django.utils.numberformat.format() function. If the affected numberformat function as used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters receives a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format(). Impact ====== A remote attacker is able to crash a target server that uses float- number-based filters by making the server filter numbers with very large exponents or number of digits. References ========== https://www.djangoproject.com/weblog/2019/feb/11/security-releases/ https://www.openwall.com/lists/oss-security/2019/02/11/1 https://github.com/django/django/commit/0bbb560183fabf0533289700845dafa9495… https://github.com/django/django/commit/40cd19055773705301c3428ed5e08a036d2… https://security.archlinux.org/CVE-2019-6975

1 0

[ASA-201902-14] python-django: denial of service
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-14 ========================================== Severity: Medium Date : 2019-02-12 CVE-ID : CVE-2019-6975 Package : python-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-881 Summary ======= The package python-django before version 2.1.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.1.6-1. # pacman -Syu "python-django>=2.1.6-1" The problem has been fixed upstream in version 2.1.6. Workaround ========== None. Description =========== Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows uncontrolled memory consumption via a malicious attacker- supplied value to the django.utils.numberformat.format() function. If the affected numberformat function as used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters receives a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format(). Impact ====== A remote attacker is able to crash a target server that uses float- number-based filters by making the server filter numbers with very large exponents or number of digits. References ========== https://www.djangoproject.com/weblog/2019/feb/11/security-releases/ https://www.openwall.com/lists/oss-security/2019/02/11/1 https://github.com/django/django/commit/0bbb560183fabf0533289700845dafa9495… https://github.com/django/django/commit/40cd19055773705301c3428ed5e08a036d2… https://security.archlinux.org/CVE-2019-6975

1 0

[ASA-201902-13] lib32-curl: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-13 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : lib32-curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-874 Summary ======= The package lib32-curl before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "lib32-curl>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0

[ASA-201902-12] lib32-libcurl-compat: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-12 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : lib32-libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-875 Summary ======= The package lib32-libcurl-compat before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "lib32-libcurl-compat>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0

[ASA-201902-11] lib32-libcurl-gnutls: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-11 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : lib32-libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-876 Summary ======= The package lib32-libcurl-gnutls before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0

[ASA-201902-10] libcurl-gnutls: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-10 ========================================== Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-877 Summary ======= The package libcurl-gnutls before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "libcurl-gnutls>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0

[ASA-201902-9] curl: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-9 ========================================= Severity: High Date : 2019-02-12 CVE-ID : CVE-2018-16890 CVE-2019-3822 CVE-2019-3823 Package : curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-873 Summary ======= The package curl before version 7.64.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.64.0-1. # pacman -Syu "curl>=7.64.0-1" The problems have been fixed upstream in version 7.64.0. Workaround ========== None. Description =========== - CVE-2018-16890 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds. - CVE-2019-3822 (arbitrary code execution) libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large "nt response" data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a "large value" needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. - CVE-2019-3823 (arbitrary code execution) libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads beyond the allocated buffer. The read contents will not be returned to the caller. Impact ====== A malicious remote server could execute arbitrary code by sending malicious NTLM or SMTP replies. References ========== https://curl.haxx.se/docs/CVE-2018-16890.html https://github.com/curl/curl/commit/b780b30d1377adb10bbe774835f49e9b237fb9bb https://curl.haxx.se/docs/CVE-2019-3822.html https://github.com/curl/curl/commit/50c9484278c63b958655a717844f0721263939cc https://curl.haxx.se/docs/CVE-2019-3823.html https://github.com/curl/curl/commit/39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 https://security.archlinux.org/CVE-2018-16890 https://security.archlinux.org/CVE-2019-3822 https://security.archlinux.org/CVE-2019-3823

1 0