June 2019 - Arch-security - lists.archlinux.org

[ASA-201906-8] vim: arbitrary code execution
by Morten Linderud 13 Jun '19

13 Jun '19

Arch Linux Security Advisory ASA-201906-8 ========================================= Severity: High Date : 2019-06-11 CVE-ID : CVE-2019-12735 Package : vim Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-975 Summary ======= The package vim before version 8.1.1467-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.1.1467-1. # pacman -Syu "vim>=8.1.1467-1" The problem has been fixed upstream in version 8.1.1467. Workaround ========== Disable modeline support in the vimrc file by setting: set nomodeline Description =========== getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. Impact ====== A remote attacker could execute code with a maliciously written file. References ========== https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040 https://security.archlinux.org/CVE-2019-12735

1 0

[ASA-201906-7] openssl: information disclosure
by Morten Linderud 13 Jun '19

13 Jun '19

Arch Linux Security Advisory ASA-201906-7 ========================================= Severity: Low Date : 2019-06-11 CVE-ID : CVE-2019-1543 Package : openssl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-919 Summary ======= The package openssl before version 1.1.1.c-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.1.1.c-1. # pacman -Syu "openssl>=1.1.1.c-1" The problem has been fixed upstream in version 1.1.1.c. Workaround ========== None. Description =========== An issue has been found in OpenSSL <= 1.1.1b, where an application using ChaCha20-Poly1305 could set a non-default nonce length to be longer than 12 bytes and then mistakenly reuse a nonce. ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. Impact ====== A remote attacker could disclose sensitive information via an invalid nonce. References ========== https://www.openssl.org/news/secadv/20190306.txt https://github.com/openssl/openssl/commit/f426625b6a https://security.archlinux.org/CVE-2019-1543

1 0

[ASA-201906-6] lib32-openssl: information disclosure
by Morten Linderud 13 Jun '19

13 Jun '19

Arch Linux Security Advisory ASA-201906-6 ========================================= Severity: Low Date : 2019-06-11 CVE-ID : CVE-2019-1543 Package : lib32-openssl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-920 Summary ======= The package lib32-openssl before version 1:1.1.1.c-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1:1.1.1.c-1. # pacman -Syu "lib32-openssl>=1:1.1.1.c-1" The problem has been fixed upstream in version 1.1.1.c. Workaround ========== None. Description =========== An issue has been found in OpenSSL <= 1.1.1b, where an application using ChaCha20-Poly1305 could set a non-default nonce length to be longer than 12 bytes and then mistakenly reuse a nonce. ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. Impact ====== A remote attacker could disclose sensitive information via an invalid nonce. References ========== https://www.openssl.org/news/secadv/20190306.txt https://github.com/openssl/openssl/commit/f426625b6a https://security.archlinux.org/CVE-2019-1543

1 0

[ASA-201906-5] pam-u2f: information disclosure
by Remi Gacogne 08 Jun '19

08 Jun '19

Arch Linux Security Advisory ASA-201906-5 ========================================= Severity: Medium Date : 2019-06-07 CVE-ID : CVE-2019-12209 CVE-2019-12210 Package : pam-u2f Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-973 Summary ======= The package pam-u2f before version 1.0.8-2 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.0.8-2. # pacman -Syu "pam-u2f>=1.0.8-2" The problems have been fixed upstream in version 1.0.8. Workaround ========== A major mitigation for both issues is to remove the `debug` and `debug_file` options for `pam_u2f.so` in the PAM configuration. Furthermore enabling the `openasuser` option will mitigate the symlink attack in CVE-2019-12209. Description =========== - CVE-2019-12209 (information disclosure) A symbolic link attack has been found in pam-u2f before 1.8.0. The file `$HOME/.config/Yubico/u2f_keys` is blindly followed by the PAM module. It can be a symlink pointing to an arbitrary file. The PAM module only rejects non-regular files and files owned by other users than root or the to-be-authenticated user. Even these checks are only made after open()'ing the file, which may already trigger certain logic in the kernel that is otherwise not reachable to regular users. If the PAM modules' `debug` option is also enabled then most of the content of the file is written either to stdout, stderr, syslog or to the defined debug file. Therefore this can pose an information leak to access e.g. the contents of /etc/shadow, /root/.bash_history or similar sensitive files. Furthermore the symlink attack can be used to use other users' u2f_keys files in the authentication process. - CVE-2019-12210 (information disclosure) A file descriptor leak has been found in pam-u2f before 1.8.0. If the `debug` and `debug_file` options are set then the opened debug file will be inherited to the successfully authenticated user's process. Therefore this user can write further information to it, possibly filling up a privileged file system or manipulating the information found in the debug file. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation. Impact ====== An authenticated user can access sensitive information via a crafted symlink or a leaked file descriptor. References ========== https://seclists.org/oss-sec/2019/q2/149 https://bugzilla.suse.com/show_bug.cgi?id=1087061 https://github.com/Yubico/pam-u2f/commit/7db3386fcdb454e33a3ea30dcfb8e8960d… https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e… https://security.archlinux.org/CVE-2019-12209 https://security.archlinux.org/CVE-2019-12210

1 0

[ASA-201906-4] chromium: multiple issues
by Remi Gacogne 08 Jun '19

08 Jun '19

Arch Linux Security Advisory ASA-201906-4 ========================================= Severity: Critical Date : 2019-06-07 CVE-ID : CVE-2019-5828 CVE-2019-5829 CVE-2019-5830 CVE-2019-5831 CVE-2019-5832 CVE-2019-5833 CVE-2019-5835 CVE-2019-5836 CVE-2019-5837 CVE-2019-5838 CVE-2019-5839 CVE-2019-5840 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-972 Summary ======= The package chromium before version 75.0.3770.80-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing, incorrect calculation and information disclosure. Resolution ========== Upgrade to 75.0.3770.80-1. # pacman -Syu "chromium>=75.0.3770.80-1" The problems have been fixed upstream in version 75.0.3770.80. Workaround ========== None. Description =========== - CVE-2019-5828 (arbitrary code execution) A use-after-free vulnerability has been found in the ServiceWorker component of the chromium browser before 75.0.3770.80. - CVE-2019-5829 (arbitrary code execution) A use-after-free vulnerability has been found in the Download Manager component of the chromium browser before 75.0.3770.80. - CVE-2019-5830 (access restriction bypass) An incorrectly credentialed requests vulnerability has been found in the CORS component of the chromium browser before 75.0.3770.80. - CVE-2019-5831 (incorrect calculation) An incorrect map processing vulnerability has been found in the V8 component of the chromium browser before 75.0.3770.80. - CVE-2019-5832 (access restriction bypass) An incorrect CORS handling vulnerability has been found in the XHR component of the chromium browser before 75.0.3770.80. - CVE-2019-5833 (content spoofing) An inconsistent security UI placement vulnerability has been found in the chromium browser before 75.0.3770.80. - CVE-2019-5835 (information disclosure) An out-of-bounds read vulnerability has been found in the Swiftshader component of the chromium browser before 75.0.3770.80. - CVE-2019-5836 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the Angle component of the chromium browser before 75.0.3770.80. - CVE-2019-5837 (information disclosure) A cross-origin resources size disclosure vulnerability has been found in the Appcache component of the chromium browser before 75.0.3770.80. - CVE-2019-5838 (access restriction bypass) An overly permissive tab access vulnerability has been found in the Extensions component of the chromium browser before 75.0.3770.80. - CVE-2019-5839 (access restriction bypass) An incorrect handling of certain code points vulnerability has been found in the Blink component of the chromium browser before 75.0.3770.80. - CVE-2019-5840 (access restriction bypass) A popup blocker bypass vulnerability has been found in the chromium browser before 75.0.3770.80. Impact ====== A remote attacker can access sensitive information, bypass security measures, spoof content and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-des… https://crbug.com/956597 https://crbug.com/958533 https://crbug.com/665766 https://crbug.com/950328 https://crbug.com/959390 https://crbug.com/945067 https://crbug.com/939239 https://crbug.com/947342 https://crbug.com/918293 https://crbug.com/893087 https://crbug.com/925614 https://crbug.com/951782 https://security.archlinux.org/CVE-2019-5828 https://security.archlinux.org/CVE-2019-5829 https://security.archlinux.org/CVE-2019-5830 https://security.archlinux.org/CVE-2019-5831 https://security.archlinux.org/CVE-2019-5832 https://security.archlinux.org/CVE-2019-5833 https://security.archlinux.org/CVE-2019-5835 https://security.archlinux.org/CVE-2019-5836 https://security.archlinux.org/CVE-2019-5837 https://security.archlinux.org/CVE-2019-5838 https://security.archlinux.org/CVE-2019-5839 https://security.archlinux.org/CVE-2019-5840

1 0

[ASA-201906-3] binutils: multiple issues
by Morten Linderud 05 Jun '19

05 Jun '19

Arch Linux Security Advisory ASA-201906-3 ========================================= Severity: High Date : 2019-06-04 CVE-ID : CVE-2018-19931 CVE-2018-19932 CVE-2018-20002 CVE-2018-20712 Package : binutils Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-832 Summary ======= The package binutils before version 2.32-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.32-1. # pacman -Syu "binutils>=2.32-1" The problems have been fixed upstream in version 2.32. Workaround ========== None. Description =========== - CVE-2018-19931 (arbitrary code execution) An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted. - CVE-2018-19932 (denial of service) An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c. - CVE-2018-20002 (denial of service) The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm. - CVE-2018-20712 (denial of service) A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of- service, as demonstrated by c++filt. Impact ====== An attacker is able to crash or execute arbitrary code on a process that uses libbfd functions by providing a malicious object file. References ========== https://www.securityfocus.com/bid/106144 https://www.securityfocus.com/bid/106142 https://sourceware.org/bugzilla/show_bug.cgi?id=23942 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5f60af5d24d18137… https://sourceware.org/bugzilla/show_bug.cgi?id=23932 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=beab453223769279… https://sourceware.org/bugzilla/show_bug.cgi?id=23952 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c2f5dc30afa34696… http://www.securityfocus.com/bid/106563 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88629 https://sourceware.org/bugzilla/show_bug.cgi?id=24043 https://security.archlinux.org/CVE-2018-19931 https://security.archlinux.org/CVE-2018-19932 https://security.archlinux.org/CVE-2018-20002 https://security.archlinux.org/CVE-2018-20712

1 0

[ASA-201906-2] python-django: cross-site scripting
by Jelle van der Waa 04 Jun '19

04 Jun '19

Arch Linux Security Advisory ASA-201906-2 ========================================= Severity: Medium Date : 2019-06-04 CVE-ID : CVE-2019-11358 CVE-2019-12308 Package : python-django Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-969 Summary ======= The package python-django before version 2.2.2-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 2.2.2-1. # pacman -Syu "python-django>=2.2.2-1" The problems have been fixed upstream in version 2.2.2. Workaround ========== None. Description =========== - CVE-2019-11358 (cross-site scripting) jQuery before 3.4.0, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. The bundled version of jQuery used by the Django admin has been patched to allow for the select2 library's use of jQuery.extend(). - CVE-2019-12308 (cross-site scripting) The clickable "Current URL" link generated by AdminURLFieldWidget displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. AdminURLFieldWidget now validates the provided value using URLValidator before displaying the clickable link. You may customise the validator by passing a validator_class kwarg to AdminURLFieldWidget.__init__(), e.g. when using ModelAdmin.formfield_overrides. Impact ====== A remote attacker is able to execute javascript and create html content in the admin view or by extending the native Object.prototype via jQuery.extend. References ========== https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ https://github.com/django/django/commit/baaf187a4e354bf3976c51e2c83a0d2f8ee… https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b… https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e813… https://security.archlinux.org/CVE-2019-11358 https://security.archlinux.org/CVE-2019-12308

1 0

[ASA-201906-1] python2-django: cross-site scripting
by Jelle van der Waa 04 Jun '19

04 Jun '19

Arch Linux Security Advisory ASA-201906-1 ========================================= Severity: Medium Date : 2019-06-04 CVE-ID : CVE-2019-12308 Package : python2-django Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-970 Summary ======= The package python2-django before version 1.11.21-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.11.21-1. # pacman -Syu "python2-django>=1.11.21-1" The problem has been fixed upstream in version 1.11.21. Workaround ========== None. Description =========== The clickable "Current URL" link generated by AdminURLFieldWidget displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. AdminURLFieldWidget now validates the provided value using URLValidator before displaying the clickable link. You may customise the validator by passing a validator_class kwarg to AdminURLFieldWidget.__init__(), e.g. when using ModelAdmin.formfield_overrides. Impact ====== A remote attacker is able to execute javascript and create html content in the admin view. References ========== https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b… https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e813… https://security.archlinux.org/CVE-2019-12308

1 0