January 2020 - Arch-security - lists.archlinux.org

[ASA-202001-6] opensmtpd: arbitrary command execution
by Levente Polyak 31 Jan '20

31 Jan '20

Arch Linux Security Advisory ASA-202001-6 ========================================= Severity: Critical Date : 2020-01-29 CVE-ID : CVE-2020-7247 Package : opensmtpd Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1090 Summary ======= The package opensmtpd before version 6.6.2p1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 6.6.2p1-1. # pacman -Syu "opensmtpd>=6.6.2p1-1" The problem has been fixed upstream in version 6.6.2p1. Workaround ========== None. Description =========== smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation. Impact ====== A remote attacker is able to execute arbitrary commands as root on the affected host. References ========== https://www.openwall.com/lists/oss-security/2020/01/28/3 https://github.com/OpenSMTPD/OpenSMTPD/commit/d2688c097e0ff53037c7403e09426… https://github.com/openbsd/src/commit/9dcfda045474d8903224d175907bfc29761dc… https://security.archlinux.org/CVE-2020-7247

1 0

[ASA-202001-5] chromium: multiple issues
by Remi Gacogne 17 Jan '20

17 Jan '20

Arch Linux Security Advisory ASA-202001-5 ========================================= Severity: Critical Date : 2020-01-17 CVE-ID : CVE-2020-6378 CVE-2020-6379 CVE-2020-6380 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1088 Summary ======= The package chromium before version 79.0.3945.130-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 79.0.3945.130-1. # pacman -Syu "chromium>=79.0.3945.130-1" The problems have been fixed upstream in version 79.0.3945.130. Workaround ========== None. Description =========== - CVE-2020-6378 (arbitrary code execution) A use-after-free vulnerability has been found in the speech recognizer component of the chromium browser before 79.0.3945.130. - CVE-2020-6379 (arbitrary code execution) A use-after-free vulnerability has been found in the speech recognizer component of the chromium browser before 79.0.3945.130. - CVE-2020-6380 (insufficient validation) An extension message verification error has been found in the chromium browser before 79.0.3945.130. Impact ====== A remote attacker can bypass security measures or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-des… https://crbug.com/1018677 https://crbug.com/1033407 https://crbug.com/1032170 https://security.archlinux.org/CVE-2020-6378 https://security.archlinux.org/CVE-2020-6379 https://security.archlinux.org/CVE-2020-6380

1 0

[ASA-202001-4] thunderbird: multiple issues
by Morten Linderud 14 Jan '20

14 Jan '20

Arch Linux Security Advisory ASA-202001-4 ========================================= Severity: Critical Date : 2020-01-14 CVE-ID : CVE-2019-17016 CVE-2019-17017 CVE-2019-17022 CVE-2019-17024 CVE-2019-17026 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1086 Summary ======= The package thunderbird before version 68.4.1-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 68.4.1-1. # pacman -Syu "thunderbird>=68.4.1-1" The problems have been fixed upstream in version 68.4.1. Workaround ========== None. Description =========== - CVE-2019-17016 (insufficient validation) A security issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. - CVE-2019-17017 (arbitrary code execution) A type confusion issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1, in XPCVariant.cpp where, due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. - CVE-2019-17022 (insufficient validation) A security issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1 where CSS sanitization does not escape HTML tags. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. - CVE-2019-17024 (arbitrary code execution) Several memory safety issues have been found in Firefox before 72.0, Firefox ESR before 68.4.1, and Thunderbird before 68.3. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17026 (arbitrary code execution) A type confusion vulnerability has been found in Firefox before 72.0.1, and Thunderbird before 68.4.1. Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion with StoreElementHole and FallibleStoreElement. Mozilla is aware of targeted attacks in the wild abusing this flaw. Impact ====== A remote attacker could bypass security measures or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1599181 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1603055 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1602843 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605… https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1607443 https://security.archlinux.org/CVE-2019-17016 https://security.archlinux.org/CVE-2019-17017 https://security.archlinux.org/CVE-2019-17022 https://security.archlinux.org/CVE-2019-17024 https://security.archlinux.org/CVE-2019-17026

1 0

[ASA-202001-3] firefox: arbitrary code execution
by Remi Gacogne 13 Jan '20

13 Jan '20

Arch Linux Security Advisory ASA-202001-3 ========================================= Severity: Critical Date : 2020-01-10 CVE-ID : CVE-2019-17026 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1085 Summary ======= The package firefox before version 72.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 72.0.1-1. # pacman -Syu "firefox>=72.0.1-1" The problem has been fixed upstream in version 72.0.1. Workaround ========== None. Description =========== A type confusion vulnerability has been found in Firefox before 72.0.1. Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion with StoreElementHole and FallibleStoreElement. Mozilla is aware of targeted attacks in the wild abusing this flaw. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1607443 https://security.archlinux.org/CVE-2019-17026

1 0

[ASA-202001-2] file: arbitrary code execution
by Remi Gacogne 13 Jan '20

13 Jan '20

Arch Linux Security Advisory ASA-202001-2 ========================================= Severity: High Date : 2020-01-09 CVE-ID : CVE-2019-18218 Package : file Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1083 Summary ======= The package file before version 5.38-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.38-1. # pacman -Syu "file>=5.38-1" The problem has been fixed upstream in version 5.38. Workaround ========== None. Description =========== cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). Impact ====== An attacker is able to execute arbitrary code on the affected host by tricking a user to process a specially crafted file via libmagic or file. References ========== https://bugs.archlinux.org/task/64430 https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780 https://security.archlinux.org/CVE-2019-18218

1 0

[ASA-202001-1] firefox: multiple issues
by Remi Gacogne 08 Jan '20

08 Jan '20

Arch Linux Security Advisory ASA-202001-1 ========================================= Severity: Critical Date : 2020-01-08 CVE-ID : CVE-2019-17016 CVE-2019-17017 CVE-2019-17020 CVE-2019-17022 CVE-2019-17023 CVE-2019-17024 CVE-2019-17025 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1084 Summary ======= The package firefox before version 72.0-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation, access restriction bypass and denial of service. Resolution ========== Upgrade to 72.0-1. # pacman -Syu "firefox>=72.0-1" The problems have been fixed upstream in version 72.0. Workaround ========== None. Description =========== - CVE-2019-17016 (insufficient validation) A security issue has been found in Firefox before 72.0. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. - CVE-2019-17017 (arbitrary code execution) A type confusion issue has been found in Firefox before 72.0, in XPCVariant.cpp where, due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. - CVE-2019-17020 (access restriction bypass) A Content Security Policy bypass has been found in Firefox before 72.0, where the CSP is not applied to XSL stylesheets applied to XML documents. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. - CVE-2019-17022 (insufficient validation) A security issue has been found in Firefox before 72.0, where CSS sanitization does not escape HTML tags. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. - CVE-2019-17023 (denial of service) A security issue has been found in the NSS component of Firefox before 72.0. After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. - CVE-2019-17024 (arbitrary code execution) Several memory safety issues have been found in Firefox before 72.0 and Firefox ESR before 68.4. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17025 (arbitrary code execution) Several memory safety issues have been found in Firefox before 72.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker could bypass security measures or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1599181 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1603055 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1597645 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1602843 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1590001 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605… https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1328295%2C1328300%2C1590447… https://security.archlinux.org/CVE-2019-17016 https://security.archlinux.org/CVE-2019-17017 https://security.archlinux.org/CVE-2019-17020 https://security.archlinux.org/CVE-2019-17022 https://security.archlinux.org/CVE-2019-17023 https://security.archlinux.org/CVE-2019-17024 https://security.archlinux.org/CVE-2019-17025

1 0