June 2019 - Arch-security - lists.archlinux.org

[ASA-201906-18] firefox: arbitrary code execution
by Levente Polyak 19 Jun '19

19 Jun '19

Arch Linux Security Advisory ASA-201906-18 ========================================== Severity: Critical Date : 2019-06-19 CVE-ID : CVE-2019-11707 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-994 Summary ======= The package firefox before version 67.0.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 67.0.3-1. # pacman -Syu "firefox>=67.0.3-1" The problem has been fixed upstream in version 67.0.3. Workaround ========== None. Description =========== A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop, in Firefox before 67.0.3. This can allow for an exploitable crash. Mozilla has been made aware of targeted attacks in the wild abusing this flaw. Impact ====== A remote attacker can execute arbitrary code via crafted Javascript code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-18 https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1544386 https://security.archlinux.org/CVE-2019-11707

1 0

[ASA-201906-17] python: information disclosure
by Levente Polyak 19 Jun '19

19 Jun '19

Arch Linux Security Advisory ASA-201906-17 ========================================== Severity: High Date : 2019-06-18 CVE-ID : CVE-2019-9636 Package : python Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-977 Summary ======= The package python before version 3.7.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 3.7.3-1. # pacman -Syu "python>=3.7.3-1" The problem has been fixed upstream in version 3.7.3. Workaround ========== None. Description =========== Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. A specially crafted URL could be incorrectly parsed by urllib.parse.urlsplit and urllib.parse.urlparse to locate cookies or authentication data and send that information to a different host than when parsed correctly. Impact ====== A remote attacker is able to use a specially crafted URL to locate and disclose cookies or authentication data. References ========== https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html https://github.com/python/cpython/commit/daad2c482c91de32d8305abbccc76a5de8… https://github.com/python/cpython/commit/f61599b050c621386a3fc6bc480359e2d3… https://security.archlinux.org/CVE-2019-9636

1 0

[ASA-201906-16] dbus: access restriction bypass
by Levente Polyak 19 Jun '19

19 Jun '19

Arch Linux Security Advisory ASA-201906-16 ========================================== Severity: High Date : 2019-06-18 CVE-ID : CVE-2019-12749 Package : dbus Type : access restriction bypass Remote : No Link : https://security.archlinux.org/AVG-974 Summary ======= The package dbus before version 1.12.16-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 1.12.16-1. # pacman -Syu "dbus>=1.12.16-1" The problem has been fixed upstream in version 1.12.16. Workaround ========== None. Description =========== It has been discovered that dbus before 1.12.16 allows cookie spoofing because of symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. This issue only affects the DBUS_COOKIE_SHA1 authentication mechanism. A malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass. Impact ====== A local attacker could use this issue to bypass authentication and escalate privileges. References ========== https://www.openwall.com/lists/oss-security/2019/06/11/2 https://gitlab.freedesktop.org/dbus/dbus/issues/269 https://gitlab.freedesktop.org/dbus/dbus/commit/47b1a4c41004bf494b87370987b… https://security.archlinux.org/CVE-2019-12749

1 0

[ASA-201906-15] linux-zen: denial of service
by Morten Linderud 18 Jun '19

18 Jun '19

Arch Linux Security Advisory ASA-201906-15 ========================================== Severity: High Date : 2019-06-18 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux-zen Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-985 Summary ======= The package linux-zen before version 5.1.11.zen1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.1.11.zen1-1. # pacman -Syu "linux-zen>=5.1.11.zen1-1" The problems have been fixed upstream in version 5.1.11.zen1. Workaround ========== - CVE-2019-11477 and CVE-2019-11478 $ sudo sysctl -w net.ipv4.tcp_sack=0 The mitigation described below for CVE-2019-11479 is also sufficient for CVE-2019-11477 and CVE-2019-11478 if disabling TCP SACK support is not viable. - CVE-2019-11479 $ sudo iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP The net.ipv4.tcp_mtu_probing sysctl must be disabled (set to 0) when using the iptables rules shown above. Description =========== - CVE-2019-11477 (denial of service) An integer overflow has been discovered in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A sequence of SACKs may be crafted such that one can trigger a kernel panic. A remote attacker could use this to cause a denial of service (system crash). - CVE-2019-11478 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection. - CVE-2019-11479 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP segments. If the Maximum Segment Size (MSS) of a TCP connection was set to low values, such as 48 bytes, it can leave as little as 8 bytes for the user data, which significantly increases the Linux kernel's resource (CPU, Memory, and Bandwidth) utilization. A remote attacker could use this flaw to cause a denial of service (DoS) by repeatedly sending network traffic on a TCP connection with low TCP MSS. Impact ====== A remote attacker is able to crash the system by sending specially crafted TCP packets. References ========== https://www.openwall.com/lists/oss-security/2019/06/17/5 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-11477 https://security.archlinux.org/CVE-2019-11478 https://security.archlinux.org/CVE-2019-11479

1 0

[ASA-201906-14] linux-lts: denial of service
by Morten Linderud 18 Jun '19

18 Jun '19

Arch Linux Security Advisory ASA-201906-14 ========================================== Severity: High Date : 2019-06-18 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux-lts Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-984 Summary ======= The package linux-lts before version 4.19.52-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.19.52-1. # pacman -Syu "linux-lts>=4.19.52-1" The problems have been fixed upstream in version 4.19.52. Workaround ========== - CVE-2019-11477 and CVE-2019-11478 $ sudo sysctl -w net.ipv4.tcp_sack=0 The mitigation described below for CVE-2019-11479 is also sufficient for CVE-2019-11477 and CVE-2019-11478 if disabling TCP SACK support is not viable. - CVE-2019-11479 $ sudo iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP The net.ipv4.tcp_mtu_probing sysctl must be disabled (set to 0) when using the iptables rules shown above. Description =========== - CVE-2019-11477 (denial of service) An integer overflow has been discovered in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A sequence of SACKs may be crafted such that one can trigger a kernel panic. A remote attacker could use this to cause a denial of service (system crash). - CVE-2019-11478 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection. - CVE-2019-11479 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP segments. If the Maximum Segment Size (MSS) of a TCP connection was set to low values, such as 48 bytes, it can leave as little as 8 bytes for the user data, which significantly increases the Linux kernel's resource (CPU, Memory, and Bandwidth) utilization. A remote attacker could use this flaw to cause a denial of service (DoS) by repeatedly sending network traffic on a TCP connection with low TCP MSS. Impact ====== A remote attacker is able to crash the system by sending specially crafted TCP packets. References ========== https://www.openwall.com/lists/oss-security/2019/06/17/5 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-11477 https://security.archlinux.org/CVE-2019-11478 https://security.archlinux.org/CVE-2019-11479

1 0

[ASA-201906-13] linux: denial of service
by Morten Linderud 18 Jun '19

18 Jun '19

Arch Linux Security Advisory ASA-201906-13 ========================================== Severity: High Date : 2019-06-18 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-983 Summary ======= The package linux before version 5.1.11.arch1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.1.11.arch1-1. # pacman -Syu "linux>=5.1.11.arch1-1" The problems have been fixed upstream in version 5.1.11.arch1. Workaround ========== - CVE-2019-11477 and CVE-2019-11478 $ sudo sysctl -w net.ipv4.tcp_sack=0 The mitigation described below for CVE-2019-11479 is also sufficient for CVE-2019-11477 and CVE-2019-11478 if disabling TCP SACK support is not viable. - CVE-2019-11479 $ sudo iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP The net.ipv4.tcp_mtu_probing sysctl must be disabled (set to 0) when using the iptables rules shown above. Description =========== - CVE-2019-11477 (denial of service) An integer overflow has been discovered in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A sequence of SACKs may be crafted such that one can trigger a kernel panic. A remote attacker could use this to cause a denial of service (system crash). - CVE-2019-11478 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection. - CVE-2019-11479 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP segments. If the Maximum Segment Size (MSS) of a TCP connection was set to low values, such as 48 bytes, it can leave as little as 8 bytes for the user data, which significantly increases the Linux kernel's resource (CPU, Memory, and Bandwidth) utilization. A remote attacker could use this flaw to cause a denial of service (DoS) by repeatedly sending network traffic on a TCP connection with low TCP MSS. Impact ====== A remote attacker is able to crash the system by sending specially crafted TCP packets. References ========== https://www.openwall.com/lists/oss-security/2019/06/17/5 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-11477 https://security.archlinux.org/CVE-2019-11478 https://security.archlinux.org/CVE-2019-11479

1 0

[ASA-201906-12] linux-hardened: denial of service
by Levente Polyak 18 Jun '19

18 Jun '19

Arch Linux Security Advisory ASA-201906-12 ========================================== Severity: High Date : 2019-06-17 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux-hardened Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-986 Summary ======= The package linux-hardened before version 5.1.11.a-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.1.11.a-1. # pacman -Syu "linux-hardened>=5.1.11.a-1" The problems have been fixed upstream in version 5.1.11.a. Workaround ========== - CVE-2019-11477 and CVE-2019-11478 $ sudo sysctl -w net.ipv4.tcp_sack=0 The mitigation described below for CVE-2019-11479 is also sufficient for CVE-2019-11477 and CVE-2019-11478 if disabling TCP SACK support is not viable. - CVE-2019-11479 $ sudo iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP The net.ipv4.tcp_mtu_probing sysctl must be disabled (set to 0) when using the iptables rules shown above. Description =========== - CVE-2019-11477 (denial of service) An integer overflow has been discovered in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A sequence of SACKs may be crafted such that one can trigger a kernel panic. A remote attacker could use this to cause a denial of service (system crash). - CVE-2019-11478 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection. - CVE-2019-11479 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP segments. If the Maximum Segment Size (MSS) of a TCP connection was set to low values, such as 48 bytes, it can leave as little as 8 bytes for the user data, which significantly increases the Linux kernel's resource (CPU, Memory, and Bandwidth) utilization. A remote attacker could use this flaw to cause a denial of service (DoS) by repeatedly sending network traffic on a TCP connection with low TCP MSS. Impact ====== A remote attacker is able to crash the system by sending specially crafted TCP packets. References ========== https://www.openwall.com/lists/oss-security/2019/06/17/5 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-11477 https://security.archlinux.org/CVE-2019-11478 https://security.archlinux.org/CVE-2019-11479

1 0

[ASA-201906-11] chromium: arbitrary code execution
by Remi Gacogne 14 Jun '19

14 Jun '19

Arch Linux Security Advisory ASA-201906-11 ========================================== Severity: High Date : 2019-06-14 CVE-ID : CVE-2019-5842 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-981 Summary ======= The package chromium before version 75.0.3770.90-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 75.0.3770.90-1. # pacman -Syu "chromium>=75.0.3770.90-1" The problem has been fixed upstream in version 75.0.3770.90. Workaround ========== None. Description =========== A use-after-free vulnerability has been found in the Blink component of the chromium browser before 75.0.3770.90. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-des… https://crbug.com/961413 https://security.archlinux.org/CVE-2019-5842

1 0

[ASA-201906-10] thunderbird: multiple issues
by Remi Gacogne 14 Jun '19

14 Jun '19

Arch Linux Security Advisory ASA-201906-10 ========================================== Severity: High Date : 2019-06-14 CVE-ID : CVE-2019-11703 CVE-2019-11704 CVE-2019-11705 CVE-2019-11706 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-980 Summary ======= The package thunderbird before version 60.7.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 60.7.1-1. # pacman -Syu "thunderbird>=60.7.1-1" The problems have been fixed upstream in version 60.7.1. Workaround ========== None. Description =========== - CVE-2019-11703 (arbitrary code execution) A flaw in Thunderbird's implementation of iCal before 60.7.1 causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. - CVE-2019-11704 (arbitrary code execution) A flaw in Thunderbird's implementation of iCal before 60.7.1 causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. - CVE-2019-11705 (arbitrary code execution) A flaw in Thunderbird's implementation of iCal before 60.7.1 causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. - CVE-2019-11706 (denial of service) A flaw in Thunderbird's implementation of iCal before 60.7.1 causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. Impact ====== A remote attacker can crash thunderbird or execute arbitrary code on the affected host via a crafted email message. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1553820 https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1553814 https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1553808 https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-117… https://security.archlinux.org/CVE-2019-11703 https://security.archlinux.org/CVE-2019-11704 https://security.archlinux.org/CVE-2019-11705 https://security.archlinux.org/CVE-2019-11706

1 0

[ASA-201906-9] gvim: arbitrary code execution
by Morten Linderud 13 Jun '19

13 Jun '19

Arch Linux Security Advisory ASA-201906-9 ========================================= Severity: High Date : 2019-06-11 CVE-ID : CVE-2019-12735 Package : gvim Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-976 Summary ======= The package gvim before version 8.1.1467-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.1.1467-1. # pacman -Syu "gvim>=8.1.1467-1" The problem has been fixed upstream in version 8.1.1467. Workaround ========== Disable modeline support in the vimrc file by setting: set nomodeline Description =========== getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. Impact ====== A remote attacker could execute code with a maliciously written file. References ========== https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040 https://security.archlinux.org/CVE-2019-12735

1 0