April 2019 - Arch-security - lists.archlinux.org

[ASA-201904-12] chromium: multiple issues
by Remi Gacogne 26 Apr '19

26 Apr '19

Arch Linux Security Advisory ASA-201904-12 ========================================== Severity: Critical Date : 2019-04-24 CVE-ID : CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-952 Summary ======= The package chromium before version 74.0.3729.108-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure and insufficient validation. Resolution ========== Upgrade to 74.0.3729.108-1. # pacman -Syu "chromium>=74.0.3729.108-1" The problems have been fixed upstream in version 74.0.3729.108. Workaround ========== None. Description =========== - CVE-2019-5805 (arbitrary code execution) A use-after-free vulnerability has been found in the PDFium component of the chromium browser before 74.0.3729.108. - CVE-2019-5806 (arbitrary code execution) An integer overflow vulnerability has been found in the Andle component of the chromium browser before 74.0.3729.108. - CVE-2019-5807 (arbitrary code execution) A memory corruption vulnerability has been found in the V8 component of the chromium browser before 74.0.3729.108. - CVE-2019-5808 (arbitrary code execution) A use-after-free vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5809 (arbitrary code execution) A use-after-free vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5810 (information disclosure) A user information disclosure vulnerability has been found in the Autofill component of the chromium browser before 74.0.3729.108. - CVE-2019-5811 (access restriction bypass) A CORS bypass vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5813 (information disclosure) An out-of-bounds read vulnerability has been found in the V8 component of the chromium browser before 74.0.3729.108. - CVE-2019-5814 (access restriction bypass) A CORS bypass vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5815 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5818 (information disclosure) An uninitialized value vulnerability has been found in the media reader component of the chromium browser before 74.0.3729.108. - CVE-2019-5819 (insufficient validation) An incorrect escaping vulnerability has been found in the developer tools component of the chromium browser before 74.0.3729.108. - CVE-2019-5820 (arbitrary code execution) An integer overflow vulnerability has been found in the PDFium component of the chromium browser before 74.0.3729.108. - CVE-2019-5821 (arbitrary code execution) An integer overflow vulnerability has been found in the PDFium component of the chromium browser before 74.0.3729.108. - CVE-2019-5822 (access restriction bypass) A CORS bypass vulnerability has been found in the download manager component of the chromium browser before 74.0.3729.108. - CVE-2019-5823 (access restriction bypass) A forced navigation from service worker vulnerability has been found in the chromium browser before 74.0.3729.108. Impact ====== A remote attacker can access sensitive information, bypass security measures and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-des… https://crbug.com/913320 https://crbug.com/943087 https://crbug.com/945644 https://crbug.com/947029 https://crbug.com/941008 https://crbug.com/916838 https://crbug.com/771815 https://crbug.com/942699 https://crbug.com/930057 https://crbug.com/930663 https://crbug.com/929962 https://crbug.com/919356 https://crbug.com/919635 https://crbug.com/919640 https://crbug.com/926105 https://security.archlinux.org/CVE-2019-5805 https://security.archlinux.org/CVE-2019-5806 https://security.archlinux.org/CVE-2019-5807 https://security.archlinux.org/CVE-2019-5808 https://security.archlinux.org/CVE-2019-5809 https://security.archlinux.org/CVE-2019-5810 https://security.archlinux.org/CVE-2019-5811 https://security.archlinux.org/CVE-2019-5813 https://security.archlinux.org/CVE-2019-5814 https://security.archlinux.org/CVE-2019-5815 https://security.archlinux.org/CVE-2019-5818 https://security.archlinux.org/CVE-2019-5819 https://security.archlinux.org/CVE-2019-5820 https://security.archlinux.org/CVE-2019-5821 https://security.archlinux.org/CVE-2019-5822 https://security.archlinux.org/CVE-2019-5823

1 0

[ASA-201904-11] openssh: multiple issues
by Remi Gacogne 26 Apr '19

26 Apr '19

Arch Linux Security Advisory ASA-201904-11 ========================================== Severity: High Date : 2019-04-24 CVE-ID : CVE-2018-20685 CVE-2019-6109 CVE-2019-6111 Package : openssh Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-951 Summary ======= The package openssh before version 8.0p1-1 is vulnerable to multiple issues including insufficient validation, arbitrary file overwrite and content spoofing. Resolution ========== Upgrade to 8.0p1-1. # pacman -Syu "openssh>=8.0p1-1" The problems have been fixed upstream in version 8.0p1. Workaround ========== None. Description =========== - CVE-2018-20685 (insufficient validation) In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. - CVE-2019-6109 (content spoofing) An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The- Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. - CVE-2019-6111 (arbitrary file overwrite) An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). Impact ====== A malicious SCP server can overwrite arbitrary files in the scp client target directory. References ========== https://www.openssh.com/txt/release-8.0 https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.1… https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c… https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt https://github.com/openssh/openssh-portable/commit/8976f1c4b2721c26e878151f… https://github.com/openssh/openssh-portable/commit/391ffc4b9d31fa1f4ad56649… https://security.archlinux.org/CVE-2018-20685 https://security.archlinux.org/CVE-2019-6109 https://security.archlinux.org/CVE-2019-6111

1 0

[ASA-201904-10] libpng: denial of service
by Remi Gacogne 26 Apr '19

26 Apr '19

Arch Linux Security Advisory ASA-201904-10 ========================================== Severity: Low Date : 2019-04-24 CVE-ID : CVE-2019-7317 Package : libpng Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-868 Summary ======= The package libpng before version 1.6.37-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.6.37-1. # pacman -Syu "libpng>=1.6.37-1" The problem has been fixed upstream in version 1.6.37. Workaround ========== None. Description =========== png_image_free in png.c in libpng 1.6.36 has a use-after-free because png_image_free_function is called under png_safe_execute. Impact ====== A remote attacker can crash an application using libpng via a crafted image. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803 https://github.com/glennrp/libpng/issues/275 https://security.archlinux.org/CVE-2019-7317

1 0

[ASA-201904-9] dovecot: denial of service
by Remi Gacogne 24 Apr '19

24 Apr '19

Arch Linux Security Advisory ASA-201904-9 ========================================= Severity: Medium Date : 2019-04-18 CVE-ID : CVE-2019-10691 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-950 Summary ======= The package dovecot before version 2.3.5.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.3.5.2-1. # pacman -Syu "dovecot>=2.3.5.2-1" The problem has been fixed upstream in version 2.3.5.2. Workaround ========== None. Description =========== JSON encoder in Dovecot 2.3 incorrectly assert-crashes when encountering invalid UTF-8 characters. This can be used to crash dovecot in two ways. Attacker can repeatedly crash Dovecot authentication process by logging in using invalid UTF-8 sequence in username. This requires that auth policy is enabled. Crash can also occur if OX push notification driver is enabled and an email is delivered with invalid UTF-8 sequence in From or Subject header. In 2.2, malformed UTF-8 sequences are forwarded "as-is", and thus do not cause problems in Dovecot itself. Target systems should be checked for possible problems in dealing with such sequences. Impact ====== An attacker is able to crash the dovecot process by making it process a username or email containing an unsupported UTF-8 sequence. References ========== https://wiki.dovecot.org/Authentication/Policy https://security.archlinux.org/CVE-2019-10691

1 0

[ASA-201904-8] flashplugin: multiple issues
by Remi Gacogne 24 Apr '19

24 Apr '19

Arch Linux Security Advisory ASA-201904-8 ========================================= Severity: Critical Date : 2019-04-12 CVE-ID : CVE-2019-7096 CVE-2019-7108 Package : flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-949 Summary ======= The package flashplugin before version 32.0.0.171-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 32.0.0.171-1. # pacman -Syu "flashplugin>=32.0.0.171-1" The problems have been fixed upstream in version 32.0.0.171. Workaround ========== None. Description =========== - CVE-2019-7096 (arbitrary code execution) An arbitrary code execution issue has been found in Adobe Flash Player before 32.0.0.171. - CVE-2019-7108 (information disclosure) An out-of-bounds read has been found in Adobe Flash Player before 32.0.0.171. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb19-19.html https://security.archlinux.org/CVE-2019-7096 https://security.archlinux.org/CVE-2019-7108

1 0

[ASA-201904-7] jenkins: multiple issues
by Remi Gacogne 24 Apr '19

24 Apr '19

Arch Linux Security Advisory ASA-201904-7 ========================================= Severity: Medium Date : 2019-04-11 CVE-ID : CVE-2019-1003049 CVE-2019-1003050 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-948 Summary ======= The package jenkins before version 2.172-1 is vulnerable to multiple issues including access restriction bypass and cross-site scripting. Resolution ========== Upgrade to 2.172-1. # pacman -Syu "jenkins>=2.172-1" The problems have been fixed upstream in version 2.172. Workaround ========== None. Description =========== - CVE-2019-1003049 (access restriction bypass) A security issue has been found in Jenkins before 2.172, where the fix for SECURITY-901 in Jenkins 2.150.2 and 2.160 did not reject existing remoting-based CLI authentication caches. This means that users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated. - CVE-2019-1003050 (cross-site scripting) The f:validateButton form control for the Jenkins UI did not properly escape job URLs. This resulted in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names. Impact ====== A remote attacker is able to bypass access restrictions or perform cross-site scripting. References ========== https://seclists.org/oss-sec/2019/q2/15 https://jenkins.io/security/advisory/2019-04-10/ https://security.archlinux.org/CVE-2019-1003049 https://security.archlinux.org/CVE-2019-1003050

1 0

[ASA-201904-5] ghostscript: sandbox escape
by Remi Gacogne 24 Apr '19

24 Apr '19

Arch Linux Security Advisory ASA-201904-5 ========================================= Severity: High Date : 2019-04-11 CVE-ID : CVE-2019-3835 CVE-2019-3838 Package : ghostscript Type : sandbox escape Remote : Yes Link : https://security.archlinux.org/AVG-929 Summary ======= The package ghostscript before version 9.27-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 9.27-1. # pacman -Syu "ghostscript>=9.27-1" The problems have been fixed upstream in version 9.27. Workaround ========== None. Description =========== - CVE-2019-3835 (sandbox escape) It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. - CVE-2019-3838 (sandbox escape) It was found that the forceput operator could be extracted from the DefineResource method using methods similar to the ones described in CVE-2019-6116. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Impact ====== A remote attacker is able to escape the sandbox via a specially crafted PostScript document. References ========== https://bugs.archlinux.org/task/62102 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d683d1e6 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd95bb01 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e8f95a https://security.archlinux.org/CVE-2019-3835 https://security.archlinux.org/CVE-2019-3838

1 0

[ASA-201904-4] thunderbird: arbitrary code execution
by Remi Gacogne 11 Apr '19

11 Apr '19

Arch Linux Security Advisory ASA-201904-4 ========================================= Severity: Critical Date : 2019-04-06 CVE-ID : CVE-2019-9810 CVE-2019-9813 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-947 Summary ======= The package thunderbird before version 60.6.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 60.6.1-1. # pacman -Syu "thunderbird>=60.6.1-1" The problems have been fixed upstream in version 60.6.1. Workaround ========== None. Description =========== - CVE-2019-9810 (arbitrary code execution) An incorrect alias information in the IonMonkey JIT compiler of Firefox before 66.0.1 and Thunderbird before 60.6.1 for the Array.prototype.slice method may lead to missing bounds check and a buffer overflow. - CVE-2019-9813 (arbitrary code execution) An incorrect handling of __proto__ mutations may lead to type confusion in the IonMonkey JIT code of Firefox before 66.0.1 and Thunderbird before 60.6.1, and can be leveraged for arbitrary memory read and write. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9810 https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9810 https://bugzilla.mozilla.org/show_bug.cgi?id=1537924 https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9813 https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9813 https://bugzilla.mozilla.org/show_bug.cgi?id=1538006 https://security.archlinux.org/CVE-2019-9810 https://security.archlinux.org/CVE-2019-9813

1 0

[ASA-201904-3] apache: multiple issues
by Remi Gacogne 11 Apr '19

11 Apr '19

Arch Linux Security Advisory ASA-201904-3 ========================================= Severity: Critical Date : 2019-04-05 CVE-ID : CVE-2019-0196 CVE-2019-0197 CVE-2019-0211 CVE-2019-0215 CVE-2019-0217 CVE-2019-0220 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-946 Summary ======= The package apache before version 2.4.39-1 is vulnerable to multiple issues including privilege escalation, access restriction bypass and denial of service. Resolution ========== Upgrade to 2.4.39-1. # pacman -Syu "apache>=2.4.39-1" The problems have been fixed upstream in version 2.4.39. Workaround ========== None. Description =========== - CVE-2019-0196 (denial of service) A use-after-free issue has been found in the http/2 request handling code of Apache HTTPd <= 2.4.18 and <= 2.4.38. Using crafted network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly. - CVE-2019-0197 (denial of service) An issue has been found in Apache HTTPd >= 2.4.34 and <= 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. A server that never enabled the h2 protocol or that only enabled it for https: and did not configure the "H2Upgrade on" is unaffected by this. - CVE-2019-0211 (privilege escalation) In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. - CVE-2019-0215 (access restriction bypass) In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions. - CVE-2019-0217 (access restriction bypass) In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. - CVE-2019-0220 (access restriction bypass) A security issue has been found in Apache HTTPd 2.4.x before 2.4.39. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them. Impact ====== A remote attacker can bypass access control restrictions, or crash a server via a crafted HTTP/2 query. A local attacker can elevate privileges to root by manipulating the scoreboard. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://security.archlinux.org/CVE-2019-0196 https://security.archlinux.org/CVE-2019-0197 https://security.archlinux.org/CVE-2019-0211 https://security.archlinux.org/CVE-2019-0215 https://security.archlinux.org/CVE-2019-0217 https://security.archlinux.org/CVE-2019-0220

1 0

[ASA-201904-2] gnutls: multiple issues
by Remi Gacogne 11 Apr '19

11 Apr '19

Arch Linux Security Advisory ASA-201904-2 ========================================= Severity: Critical Date : 2019-04-05 CVE-ID : CVE-2019-3829 CVE-2019-3836 Package : gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-945 Summary ======= The package gnutls before version 3.6.7-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 3.6.7-1. # pacman -Syu "gnutls>=3.6.7-1" The problems have been fixed upstream in version 3.6.7. Workaround ========== None. Description =========== - CVE-2019-3829 (arbitrary code execution) A critical memory corruption vulnerability has been found in GnuTLS versions prior to 3.6.7, in any API backed by verify_crt(), including gnutls_x509_trust_list_verify_crt() and related routines. Any client or server that verifies X.509 certificates with GnuTLS is likely affected and can be compromised by a malicious server or active network attacker. - CVE-2019-3836 (denial of service) An invalid pointer access via malformed TLS1.3 async messages has been found in GnuTLS versions prior to 3.6.7. Impact ====== A remote attacker can execute arbitrary code on a client or server validating certificates. References ========== https://lists.gnupg.org/pipermail/gnutls-help/2019-March/004497.html https://gitlab.com/gnutls/gnutls/issues/694 https://gitlab.com/gnutls/gnutls/issues/704 https://security.archlinux.org/CVE-2019-3829 https://security.archlinux.org/CVE-2019-3836

1 0