October 2020 - Arch-security - lists.archlinux.org

[ASA-202010-1] chromium: multiple issues
by Remi Gacogne 14 Oct '20

14 Oct '20

Arch Linux Security Advisory ASA-202010-1 ========================================= Severity: Critical Date : 2020-10-10 CVE-ID : CVE-2020-6557 CVE-2020-15967 CVE-2020-15968 CVE-2020-15969 CVE-2020-15970 CVE-2020-15971 CVE-2020-15972 CVE-2020-15973 CVE-2020-15974 CVE-2020-15975 CVE-2020-15976 CVE-2020-15977 CVE-2020-15978 CVE-2020-15979 CVE-2020-15980 CVE-2020-15981 CVE-2020-15982 CVE-2020-15983 CVE-2020-15984 CVE-2020-15985 CVE-2020-15986 CVE-2020-15987 CVE-2020-15988 CVE-2020-15989 CVE-2020-15990 CVE-2020-15991 CVE-2020-15992 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1238 Summary ======= The package chromium before version 86.0.4240.75-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure and insufficient validation. Resolution ========== Upgrade to 86.0.4240.75-1. # pacman -Syu "chromium>=86.0.4240.75-1" The problems have been fixed upstream in version 86.0.4240.75. Workaround ========== None. Description =========== - CVE-2020-6557 (access restriction bypass) An inappropriate implementation security issue has been found in the networking component of the chromium browser before 86.0.4240.75. - CVE-2020-15967 (arbitrary code execution) A use after free security issue has been found in the payments component of the chromium browser before 86.0.4240.75. - CVE-2020-15968 (arbitrary code execution) A use after free security issue has been found in the Blink component of the chromium browser before 86.0.4240.75. - CVE-2020-15969 (arbitrary code execution) A use after free security issue has been found in the WebRTC component of the chromium browser before 86.0.4240.75. - CVE-2020-15970 (arbitrary code execution) A use after free security issue has been found in the NFC component of the chromium browser before 86.0.4240.75. - CVE-2020-15971 (arbitrary code execution) A use after free security issue has been found in the printing component of the chromium browser before 86.0.4240.75. - CVE-2020-15972 (arbitrary code execution) A use after free security issue has been found in the audio component of the chromium browser before 86.0.4240.75. - CVE-2020-15973 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 86.0.4240.75. - CVE-2020-15974 (arbitrary code execution) An integer overflow security issue has been found in the Blink component of the chromium browser before 86.0.4240.75. - CVE-2020-15975 (arbitrary code execution) An integer overflow security issue has been found in the SwiftShader component of the chromium browser before 86.0.4240.75. - CVE-2020-15976 (arbitrary code execution) A use after free security issue has been found in the WebXR component of the chromium browser before 86.0.4240.75. - CVE-2020-15977 (insufficient validation) An insufficient data validation security issue has been found in the dialogs component of the chromium browser before 86.0.4240.75. - CVE-2020-15978 (insufficient validation) An insufficient data validation security issue has been found in the navigation component of the chromium browser before 86.0.4240.75. - CVE-2020-15979 (access restriction bypass) An inappropriate implementation security issue has been found in the V8 component of the chromium browser before 86.0.4240.75. - CVE-2020-15980 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Intents component of the chromium browser before 86.0.4240.75. - CVE-2020-15981 (information disclosure) An out of bounds read security issue has been found in the audio component of the chromium browser before 86.0.4240.75. - CVE-2020-15982 (information disclosure) A side-channel information leakage security issue has been found in the cache component of the chromium browser before 86.0.4240.75. - CVE-2020-15983 (insufficient validation) An insufficient data validation security issue has been found in the webUI component of the chromium browser before 86.0.4240.75. - CVE-2020-15984 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Omnibox component of the chromium browser before 86.0.4240.75. - CVE-2020-15985 (access restriction bypass) An inappropriate implementation security issue has been found in the Blink component of the chromium browser before 86.0.4240.75. - CVE-2020-15986 (arbitrary code execution) An integer overflow security issue has been found in the media component of the chromium browser before 86.0.4240.75. - CVE-2020-15987 (arbitrary code execution) A use after free security issue has been found in the WebRTC component of the chromium browser before 86.0.4240.75. - CVE-2020-15988 (access restriction bypass) An insufficient policy enforcement security issue has been found in the downloads component of the chromium browser before 86.0.4240.75. - CVE-2020-15989 (information disclosure) An uninitialized use security issue has been found in the PDFium component of the chromium browser before 86.0.4240.75. - CVE-2020-15990 (arbitrary code execution) A use after free security issue has been found in the autofill component of the chromium browser before 86.0.4240.75. - CVE-2020-15991 (arbitrary code execution) A use after free security issue has been found in the password manager component of the chromium browser before 86.0.4240.75. - CVE-2020-15992 (access restriction bypass) An insufficient policy enforcement security issue has been found in the networking component of the chromium browser before 86.0.4240.75. Impact ====== A remote attacker can access sensitive information, bypass security measures and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-des… https://crbug.com/1083278 https://crbug.com/1127322 https://crbug.com/1126424 https://crbug.com/1124659 https://crbug.com/1108299 https://crbug.com/1114062 https://crbug.com/1115901 https://crbug.com/1106890 https://crbug.com/1104103 https://crbug.com/1110800 https://crbug.com/1123522 https://crbug.com/1097724 https://crbug.com/1116280 https://crbug.com/1127319 https://crbug.com/1092453 https://crbug.com/1123023 https://crbug.com/1039882 https://crbug.com/1076786 https://crbug.com/1080395 https://crbug.com/1099276 https://crbug.com/1100247 https://crbug.com/1127774 https://crbug.com/1092518 https://crbug.com/1108351 https://crbug.com/1133671 https://crbug.com/1133688 https://crbug.com/1110195 https://security.archlinux.org/CVE-2020-6557 https://security.archlinux.org/CVE-2020-15967 https://security.archlinux.org/CVE-2020-15968 https://security.archlinux.org/CVE-2020-15969 https://security.archlinux.org/CVE-2020-15970 https://security.archlinux.org/CVE-2020-15971 https://security.archlinux.org/CVE-2020-15972 https://security.archlinux.org/CVE-2020-15973 https://security.archlinux.org/CVE-2020-15974 https://security.archlinux.org/CVE-2020-15975 https://security.archlinux.org/CVE-2020-15976 https://security.archlinux.org/CVE-2020-15977 https://security.archlinux.org/CVE-2020-15978 https://security.archlinux.org/CVE-2020-15979 https://security.archlinux.org/CVE-2020-15980 https://security.archlinux.org/CVE-2020-15981 https://security.archlinux.org/CVE-2020-15982 https://security.archlinux.org/CVE-2020-15983 https://security.archlinux.org/CVE-2020-15984 https://security.archlinux.org/CVE-2020-15985 https://security.archlinux.org/CVE-2020-15986 https://security.archlinux.org/CVE-2020-15987 https://security.archlinux.org/CVE-2020-15988 https://security.archlinux.org/CVE-2020-15989 https://security.archlinux.org/CVE-2020-15990 https://security.archlinux.org/CVE-2020-15991 https://security.archlinux.org/CVE-2020-15992

1 0

[ASA-202009-17] samba: access restriction bypass
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-17 ========================================== Severity: Medium Date : 2020-09-29 CVE-ID : CVE-2020-1472 Package : samba Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-1236 Summary ======= The package samba before version 4.13.0-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 4.13.0-1. # pacman -Syu "samba>=4.13.0-1" The problem has been fixed upstream in version 4.13.0. Workaround ========== Ensure you do not have an schannel directive and if you do make sure it's either = yes or = auto. Description =========== A flaw was found in the Microsoft Windows Netlogon Remote Protocol (MS- NRPC), where it reuses a known, static, zero-value initialization vector (IV) in AES-CFB8 mode. This flaw allows an unauthenticated attacker to impersonate a domain-joined computer, including a domain controller, and possibly obtain domain administrator privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== An unauthenticated attacker can gain administrator access through crafted traffic, if the samba server is configured to run with a vulnerable schannel directive. References ========== https://bugs.archlinux.org/task/67983 https://www.samba.org/samba/security/CVE-2020-1472.html https://security.archlinux.org/CVE-2020-1472

1 0

[ASA-202009-16] zeromq: denial of service
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-16 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-15166 Package : zeromq Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1219 Summary ======= The package zeromq before version 4.3.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.3.3-1. # pacman -Syu "zeromq>=4.3.3-1" The problem has been fixed upstream in version 4.3.3. Workaround ========== None. Description =========== A denial of service has been found in libzmq before 4.3.3, allowing unauthenticated clients to prevent legitimate clients from exchange any message with a CURVE/ZAP-protected server. Impact ====== A remote attacker might be able to cause a denial of service through a malicious connection. References ========== https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m https://github.com/zeromq/libzmq/pull/3913/commits/e7f0090b161ce6344f6bd350… https://oss-fuzz.com/testcase-detail/5707174518194176 https://security.archlinux.org/CVE-2020-15166

1 0

[ASA-202009-15] lib32-zeromq: denial of service
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-15 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-15166 Package : lib32-zeromq Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1220 Summary ======= The package lib32-zeromq before version 4.3.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.3.3-1. # pacman -Syu "lib32-zeromq>=4.3.3-1" The problem has been fixed upstream in version 4.3.3. Workaround ========== None. Description =========== A denial of service has been found in libzmq before 4.3.3, allowing unauthenticated clients to prevent legitimate clients from exchange any message with a CURVE/ZAP-protected server. Impact ====== A remote attacker might be able to cause a denial of service through a malicious connection. References ========== https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m https://github.com/zeromq/libzmq/pull/3913/commits/e7f0090b161ce6344f6bd350… https://oss-fuzz.com/testcase-detail/5707174518194176 https://security.archlinux.org/CVE-2020-15166

1 0

[ASA-202009-14] yaws: multiple issues
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-14 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-12872 CVE-2020-24379 CVE-2020-24916 Package : yaws Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1228 Summary ======= The package yaws before version 2.0.8-1 is vulnerable to multiple issues including arbitrary command execution and information disclosure. Resolution ========== Upgrade to 2.0.8-1. # pacman -Syu "yaws>=2.0.8-1" The problems have been fixed upstream in version 2.0.8. Workaround ========== None. Description =========== - CVE-2020-12872 (information disclosure) yaws_config.erl in Yaws through 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks. - CVE-2020-24379 (information disclosure) WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. - CVE-2020-24916 (arbitrary command execution) CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection. Impact ====== A remote attacker might be able to execute arbitrary commands, downgrade TLS ciphers, or load foreign entities via crafted content. References ========== https://github.com/erlyaws/yaws/releases/tag/yaws-2.0.8 https://vuln.be/post/yaws-xxe-and-shell-injections/ https://sweet32.info/ https://medium.com/@charlielabs101/cve-2020-12872-df315411aa70 https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Comma… https://github.com/erlyaws/yaws/commit/05a06345012598f5da55dbb4d041c8dc26e8… https://github.com/vulnbe/poc-yaws-dav-xxe https://github.com/erlyaws/yaws/commit/799b3b526d15b7a9bc43ae97165aeb085f18… https://github.com/vulnbe/poc-yaws-cgi-shell-injection https://security.archlinux.org/CVE-2020-12872 https://security.archlinux.org/CVE-2020-24379 https://security.archlinux.org/CVE-2020-24916

1 0

[ASA-202009-13] brotli: denial of service
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-13 ========================================== Severity: Medium Date : 2020-09-26 CVE-ID : CVE-2020-8927 Package : brotli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1230 Summary ======= The package brotli before version 1.0.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.9-1. # pacman -Syu "brotli>=1.0.9-1" The problem has been fixed upstream in version 1.0.9. Workaround ========== None. Description =========== A buffer overflow exists in the Brotli library < 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits. Impact ====== A remote attacker might be able to cause a crash via crafted content. References ========== https://github.com/google/brotli/releases/tag/v1.0.9 https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f… https://security.archlinux.org/CVE-2020-8927

1 0

[ASA-202009-12] lib32-brotli: denial of service
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-12 ========================================== Severity: Medium Date : 2020-09-26 CVE-ID : CVE-2020-8927 Package : lib32-brotli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1231 Summary ======= The package lib32-brotli before version 1.0.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.9-1. # pacman -Syu "lib32-brotli>=1.0.9-1" The problem has been fixed upstream in version 1.0.9. Workaround ========== None. Description =========== A buffer overflow exists in the Brotli library < 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits. Impact ====== A remote attacker might be able to cause a crash via crafted content. References ========== https://github.com/google/brotli/releases/tag/v1.0.9 https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f… https://security.archlinux.org/CVE-2020-8927

1 0