August 2019 - Arch-security - lists.archlinux.org

[ASA-201908-19] pigeonhole: arbitrary code execution
by Jelle van der Waa 29 Aug '19

29 Aug '19

Arch Linux Security Advisory ASA-201908-19 ========================================== Severity: Critical Date : 2019-08-28 CVE-ID : CVE-2019-11500 Package : pigeonhole Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1027 Summary ======= The package pigeonhole before version 0.5.7.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.5.7.2-1. # pacman -Syu "pigeonhole>=0.5.7.2-1" The problem has been fixed upstream in version 0.5.7.2. Workaround ========== None. Description =========== IMAP and ManageSieve protocol parsers in Dovecot before 2.3.7.2 and Pigeonhole before 0.5.7.2 do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Impact ====== A remote, unauthenticated attacker can access sensitive information or execute arbitrary code on the affected host via a crafted ManageSieve command. References ========== https://dovecot.org/pipermail/dovecot-news/2019-August/000417.html https://dovecot.org/pipermail/dovecot-news/2019-August/000418.html https://github.com/dovecot/core/commit/85fcb895ca7f0bcb8ee72047fe0e1e78532f… https://github.com/dovecot/core/commit/f904cbdfec25582bc5e2a7435bf82ff769f2… https://github.com/dovecot/pigeonhole/commit/7ce9990a5e6ba59e89b7fe1c07f574… https://github.com/dovecot/pigeonhole/commit/4a299840cdb51f61f8d1ebc0210b19… https://security.archlinux.org/CVE-2019-11500

1 0

[ASA-201908-18] dovecot: arbitrary code execution
by Jelle van der Waa 29 Aug '19

29 Aug '19

Arch Linux Security Advisory ASA-201908-18 ========================================== Severity: Critical Date : 2019-08-28 CVE-ID : CVE-2019-11500 Package : dovecot Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1026 Summary ======= The package dovecot before version 2.3.7.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.3.7.2-1. # pacman -Syu "dovecot>=2.3.7.2-1" The problem has been fixed upstream in version 2.3.7.2. Workaround ========== None. Description =========== IMAP and ManageSieve protocol parsers in Dovecot before 2.3.7.2 and Pigeonhole before 0.5.7.2 do not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes. Impact ====== A remote, unauthenticated attacker can access sensitive information or execute arbitrary code on the affected host via a crafted IMAP command. References ========== https://dovecot.org/pipermail/dovecot-news/2019-August/000418.html https://github.com/dovecot/core/commit/85fcb895ca7f0bcb8ee72047fe0e1e78532f… https://github.com/dovecot/core/commit/f904cbdfec25582bc5e2a7435bf82ff769f2… https://github.com/dovecot/pigeonhole/commit/7ce9990a5e6ba59e89b7fe1c07f574… https://github.com/dovecot/pigeonhole/commit/4a299840cdb51f61f8d1ebc0210b19… https://security.archlinux.org/CVE-2019-11500

1 0

[ASA-201908-17] libnghttp2: denial of service
by Jelle van der Waa 29 Aug '19

29 Aug '19

Arch Linux Security Advisory ASA-201908-17 ========================================== Severity: Medium Date : 2019-08-27 CVE-ID : CVE-2019-9511 CVE-2019-9513 Package : libnghttp2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1024 Summary ======= The package libnghttp2 before version 1.39.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.39.2-1. # pacman -Syu "libnghttp2>=1.39.2-1" The problems have been fixed upstream in version 1.39.2. Workaround ========== None. Description =========== - CVE-2019-9511 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. - CVE-2019-9513 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service. Impact ====== A remote attacker is able to cause a denial of service by sending a specially crafted packet. References ========== https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://github.com/nginx/nginx/commit/a987f81dd19210bc30b62591db331e31d3d74… https://github.com/nginx/nginx/commit/5ae726912654da10a9a81b2c8436829f3e94f… https://security.archlinux.org/CVE-2019-9511 https://security.archlinux.org/CVE-2019-9513

1 0

[ASA-201908-16] go-pie: multiple issues
by Jelle van der Waa 29 Aug '19

29 Aug '19

Arch Linux Security Advisory ASA-201908-16 ========================================== Severity: Medium Date : 2019-08-24 CVE-ID : CVE-2019-9512 CVE-2019-9514 CVE-2019-14809 Package : go-pie Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1020 Summary ======= The package go-pie before version 2:1.12.8-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 2:1.12.8-1. # pacman -Syu "go-pie>=2:1.12.8-1" The problems have been fixed upstream in version 1.12.8. Workaround ========== None. Description =========== - CVE-2019-9512 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. - CVE-2019-9514 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service. - CVE-2019-14809 (insufficient validation) An issue has been found in Go before 1.12.8, where url.Parse would accept URLs with malformed hosts, such that the Host field could have arbitrary suffixes that would appear in neither Hostname() nor Port(), allowing authorization bypasses in certain applications. Note that URLs with invalid, not numeric ports will now return an error from url.Parse. Impact ====== A remote attacker is able to cause a denial of service by sending a specially crafted packet or bypass authorization due to insufficient validation. References ========== https://groups.google.com/forum/#!msg/golang-announce/65QixT3tcmg/DrFiG6vvC… https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://golang.org/issue/29098 https://security.archlinux.org/CVE-2019-9512 https://security.archlinux.org/CVE-2019-9514 https://security.archlinux.org/CVE-2019-14809

1 0

[ASA-201908-15] go: multiple issues
by Jelle van der Waa 29 Aug '19

29 Aug '19

Arch Linux Security Advisory ASA-201908-15 ========================================== Severity: Medium Date : 2019-08-24 CVE-ID : CVE-2019-9512 CVE-2019-9514 CVE-2019-14809 Package : go Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1021 Summary ======= The package go before version 2:1.12.8-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 2:1.12.8-1. # pacman -Syu "go>=2:1.12.8-1" The problems have been fixed upstream in version 1.12.8. Workaround ========== None. Description =========== - CVE-2019-9512 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. - CVE-2019-9514 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both, potentially leading to a denial of service. - CVE-2019-14809 (insufficient validation) An issue has been found in Go before 1.12.8, where url.Parse would accept URLs with malformed hosts, such that the Host field could have arbitrary suffixes that would appear in neither Hostname() nor Port(), allowing authorization bypasses in certain applications. Note that URLs with invalid, not numeric ports will now return an error from url.Parse. Impact ====== A remote attacker is able to cause a denial of service by sending a specially crafted packet or bypass authorization due to insufficient validation. References ========== https://groups.google.com/forum/#!msg/golang-announce/65QixT3tcmg/DrFiG6vvC… https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://golang.org/issue/29098 https://security.archlinux.org/CVE-2019-9512 https://security.archlinux.org/CVE-2019-9514 https://security.archlinux.org/CVE-2019-14809

1 0

[ASA-201908-14] gettext: arbitrary code execution
by Jelle van der Waa 29 Aug '19

29 Aug '19

Arch Linux Security Advisory ASA-201908-14 ========================================== Severity: High Date : 2019-08-24 CVE-ID : CVE-2018-18751 Package : gettext Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-885 Summary ======= The package gettext before version 0.20.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.20.1-1. # pacman -Syu "gettext>=0.20.1-1" The problem has been fixed upstream in version 0.20.1. Workaround ========== None. Description =========== An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt. Impact ====== A local attacker is able to execute arbitrary code by using a specially crafted message. References ========== https://github.com/CCCCCrash/POCs/tree/master/Bin/Tools-gettext-0.19.8.1/he… https://github.com/CCCCCrash/POCs/tree/master/Bin/Tools-gettext-0.19.8.1/do… https://git.savannah.gnu.org/gitweb/?p=gettext.git;a=commitdiff;h=dce3a16 https://security.archlinux.org/CVE-2018-18751

1 0

Subject: [ASA-201908-13] nginx: denial of service
by Jelle van der Waa 24 Aug '19

24 Aug '19

Arch Linux Security Advisory ASA-201908-13 ========================================== Severity: Medium Date : 2019-08-16 CVE-ID : CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 Package : nginx Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1023 Summary ======= The package nginx before version 1.16.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.16.1-1. # pacman -Syu "nginx>=1.16.1-1" The problems have been fixed upstream in version 1.16.1. Workaround ========== Disable http/2 support. Description =========== - CVE-2019-9511 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. - CVE-2019-9513 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service. - CVE-2019-9516 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service. Impact ====== A remote attacker is able cause a denial of service by sending a specially crafted packet. References ========== https://mailman.nginx.org/pipermail/nginx-announce/2019/000249.html https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://github.com/nginx/nginx/commit/a987f81dd19210bc30b62591db331e31d3d74… https://github.com/nginx/nginx/commit/5ae726912654da10a9a81b2c8436829f3e94f… https://github.com/nginx/nginx/commit/6dfbc8b1c2116f362bb871efebbf9df576738… https://security.archlinux.org/CVE-2019-9511 https://security.archlinux.org/CVE-2019-9513 https://security.archlinux.org/CVE-2019-9516

1 0

[ASA-201908-12] nginx-mainline: denial of service
by Jelle van der Waa 24 Aug '19

24 Aug '19

Arch Linux Security Advisory ASA-201908-12 ========================================== Severity: Medium Date : 2019-08-16 CVE-ID : CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 Package : nginx-mainline Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1022 Summary ======= The package nginx-mainline before version 1.17.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.17.3-1. # pacman -Syu "nginx-mainline>=1.17.3-1" The problems have been fixed upstream in version 1.17.3. Workaround ========== Disable http/2 support. Description =========== - CVE-2019-9511 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. - CVE-2019-9513 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service. - CVE-2019-9516 (denial of service) An issue has been found in several HTTP/2 implementations, where the attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service. Impact ====== A remote attacker is able cause a denial of service by sending a specially crafted packet. References ========== https://mailman.nginx.org/pipermail/nginx-announce/2019/000249.html https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://github.com/nginx/nginx/commit/a987f81dd19210bc30b62591db331e31d3d74… https://github.com/nginx/nginx/commit/5ae726912654da10a9a81b2c8436829f3e94f… https://github.com/nginx/nginx/commit/6dfbc8b1c2116f362bb871efebbf9df576738… https://security.archlinux.org/CVE-2019-9511 https://security.archlinux.org/CVE-2019-9513 https://security.archlinux.org/CVE-2019-9516

1 0

[ASA-201908-11] firefox: information disclosure
by Jelle van der Waa 24 Aug '19

24 Aug '19

Arch Linux Security Advisory ASA-201908-11 ========================================== Severity: Medium Date : 2019-08-16 CVE-ID : CVE-2019-11733 Package : firefox Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1025 Summary ======= The package firefox before version 68.0.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 68.0.2-1. # pacman -Syu "firefox>=68.0.2-1" The problem has been fixed upstream in version 68.0.2. Workaround ========== None. Description =========== An issue has been found in Firefox before 68.0.2. When a master password is set, it is required to be entered before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard through the 'copy password' context menu item without first entering the master password, allowing for potential theft of stored passwords. Impact ====== A local attacker is able to obtain stored passwords without first entering the master password leading to information disclosure. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-24/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-24/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1565780 https://security.archlinux.org/CVE-2019-11733

1 0

[ASA-201908-10] subversion: denial of service
by Jelle van der Waa 24 Aug '19

24 Aug '19

Arch Linux Security Advisory ASA-201908-10 ========================================== Severity: High Date : 2019-08-16 CVE-ID : CVE-2018-11782 CVE-2019-0203 Package : subversion Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1016 Summary ======= The package subversion before version 1.12.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.12.2-1. # pacman -Syu "subversion>=1.12.2-1" The problems have been fixed upstream in version 1.12.2. Workaround ========== None. Description =========== - CVE-2018-11782 (denial of service) Subversion svn:// connections, including svn+ssh:// and svn+<custom>://, use a custom network protocol [1] with Lisp-like syntax. The code implementing the protocol has dedicated codepaths for serialization of revision numbers into protocol integers. A particular client query could cause the server to attempt to reply with a revision number whose value is the invalid revision number constant `SVN_INVALID_REVNUM`, thereby triggering an assertion failure in the the serialization layer. - CVE-2019-0203 (denial of service) A null-pointer-dereference has been found in svnserve that results in a remote unauthenticated Denial-of-Service in some server configurations. The vulnerability can be triggered by an unauthenticated user if the server is configured with anonymous access enabled. Impact ====== A remote attacker is able to cause a denial of service by sending a special packet. References ========== http://subversion.apache.org/security/CVE-2018-11782-advisory.txt http://subversion.apache.org/security/CVE-2019-0203-advisory.txt https://security.archlinux.org/CVE-2018-11782 https://security.archlinux.org/CVE-2019-0203

1 0