November 2020 - Arch-security - lists.archlinux.org

[ASA-202011-11] chromium: multiple issues
by Remi Gacogne 18 Nov '20

18 Nov '20

Arch Linux Security Advisory ASA-202011-11 ========================================== Severity: High Date : 2020-11-17 CVE-ID : CVE-2020-16012 CVE-2020-16014 CVE-2020-16015 CVE-2020-16018 CVE-2020-16019 CVE-2020-16020 CVE-2020-16021 CVE-2020-16022 CVE-2020-16023 CVE-2020-16024 CVE-2020-16025 CVE-2020-16026 CVE-2020-16027 CVE-2020-16028 CVE-2020-16029 CVE-2020-16030 CVE-2020-16031 CVE-2020-16032 CVE-2020-16033 CVE-2020-16034 CVE-2020-16035 CVE-2020-16036 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1277 Summary ======= The package chromium before version 87.0.4280.66-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, insufficient validation, content spoofing and information disclosure. Resolution ========== Upgrade to 87.0.4280.66-1. # pacman -Syu "chromium>=87.0.4280.66-1" The problems have been fixed upstream in version 87.0.4280.66. Workaround ========== None. Description =========== - CVE-2020-16012 (information disclosure) An information disclosure issue has been found in Firefox before 83.0 and chromium before 87.0.4280.66. When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function took a variable amount of time depending on the content of the underlying image. This resulted in potential cross-origin information exposure of image content through timing side-channel attacks. - CVE-2020-16014 (arbitrary code execution) A use after free security issue has been found in the PPAPI component of the chromium browser before 87.0.4280.66. - CVE-2020-16015 (insufficient validation) An insufficient data validation security issue has been found in the WASM component of the chromium browser before 87.0.4280.66. - CVE-2020-16018 (arbitrary code execution) A use after free security issue has been found in the payments component of the chromium browser before 87.0.4280.66. - CVE-2020-16019 (access restriction bypass) An inappropriate implementation security issue has been found in the filesystem component of the chromium browser before 87.0.4280.66. - CVE-2020-16020 (access restriction bypass) An inappropriate implementation security issue has been found in the cryptohome component of the chromium browser before 87.0.4280.66. - CVE-2020-16021 (arbitrary code execution) A race condition has been found in the ImageBurner component of the chromium browser before 87.0.4280.66, leading to possible memory corruption. - CVE-2020-16022 (access restriction bypass) An insufficient policy enforcement security issue has been found in the networking component of the chromium browser before 87.0.4280.66. - CVE-2020-16023 (arbitrary code execution) A use after free security issue has been found in the WebCodecs component of the chromium browser before 87.0.4280.66. - CVE-2020-16024 (arbitrary code execution) A heap-based buffer overflow has been found in the UI component of the chromium browser before 87.0.4280.66. - CVE-2020-16025 (arbitrary code execution) A heap-based buffer overflow has been found in the clipboard component of the chromium browser before 87.0.4280.66. - CVE-2020-16026 (arbitrary code execution) A use after free security issue has been found in the WebRTC component of the chromium browser before 87.0.4280.66. - CVE-2020-16027 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 87.0.4280.66. - CVE-2020-16028 (arbitrary code execution) A heap-based buffer overflow has been found in the WebRTC component of the chromium browser before 87.0.4280.66. - CVE-2020-16029 (access restriction bypass) An inappropriate implementation security issue has been found in the PDFium component of the chromium browser before 87.0.4280.66. - CVE-2020-16030 (insufficient validation) An insufficient data validation security issue has been found in the Blink component of the chromium browser before 87.0.4280.66. - CVE-2020-16031 (content spoofing) An incorrect security UI issue has been found in the tab preview component of the chromium browser before 87.0.4280.66. - CVE-2020-16032 (content spoofing) An incorrect security UI issue has been found in the sharing component of the chromium browser before 87.0.4280.66. - CVE-2020-16033 (content spoofing) A incorrect security UI issue has been found in the WebUSB component of the chromium browser before 87.0.4280.66. - CVE-2020-16034 (access restriction bypass) An inappropriate implementation security issue has been found in the WebRTC component of the chromium browser before 87.0.4280.66. - CVE-2020-16035 (insufficient validation) An insufficient data validation security issue has been found in the cros-disks component of the chromium browser before 87.0.4280.66. - CVE-2020-16036 (access restriction bypass) An inappropriate implementation security issue has been found in the cookies component of the chromium browser before 87.0.4280.66. Impact ====== A remote attacker might be able to trick a user into wrongly assessing the security of a website, WebUSB connection or a tab preview via UI spoofing. Further, a remote attacker may be able to bypass security restrictions, access sensitive information and execute arbitrary code References ========== https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-des… https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-des… https://www.mozilla.org/en-US/security/advisories/mfsa2020-50/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1642028 https://crbug.com/1146675 https://crbug.com/1146673 https://crbug.com/1136078 https://crbug.com/1139408 https://crbug.com/1139411 https://crbug.com/1139414 https://crbug.com/1145680 https://crbug.com/1146761 https://crbug.com/1147430 https://crbug.com/1147431 https://crbug.com/1139153 https://crbug.com/1116444 https://crbug.com/1138446 https://crbug.com/1134338 https://crbug.com/1141350 https://crbug.com/1133183 https://crbug.com/1136714 https://crbug.com/1143057 https://crbug.com/1137362 https://crbug.com/1139409 https://crbug.com/830808 https://security.archlinux.org/CVE-2020-16012 https://security.archlinux.org/CVE-2020-16014 https://security.archlinux.org/CVE-2020-16015 https://security.archlinux.org/CVE-2020-16018 https://security.archlinux.org/CVE-2020-16019 https://security.archlinux.org/CVE-2020-16020 https://security.archlinux.org/CVE-2020-16021 https://security.archlinux.org/CVE-2020-16022 https://security.archlinux.org/CVE-2020-16023 https://security.archlinux.org/CVE-2020-16024 https://security.archlinux.org/CVE-2020-16025 https://security.archlinux.org/CVE-2020-16026 https://security.archlinux.org/CVE-2020-16027 https://security.archlinux.org/CVE-2020-16028 https://security.archlinux.org/CVE-2020-16029 https://security.archlinux.org/CVE-2020-16030 https://security.archlinux.org/CVE-2020-16031 https://security.archlinux.org/CVE-2020-16032 https://security.archlinux.org/CVE-2020-16033 https://security.archlinux.org/CVE-2020-16034 https://security.archlinux.org/CVE-2020-16035 https://security.archlinux.org/CVE-2020-16036

1 0

[ASA-202011-10] linux-hardened: multiple issues
by Levente Polyak 11 Nov '20

11 Nov '20

Arch Linux Security Advisory ASA-202011-10 ========================================== Severity: Medium Date : 2020-11-10 CVE-ID : CVE-2020-8694 CVE-2020-25704 Package : linux-hardened Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1269 Summary ======= The package linux-hardened before version 5.9.8.a-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 5.9.8.a-1. # pacman -Syu "linux-hardened>=5.9.8.a-1" The problems have been fixed upstream in version 5.9.8.a. Workaround ========== - CVE-2020-8694 A temporary measure would be to remove the ability for non-root users to read the current RAPL energy reporting metrics. This can be done with the command: # sudo chmod 400 /sys/class/powercap/intel_rapl/*/energy_uj This mitigation will only work on the current boot and will need to be reapplied at each system boot to remain in effect. Description =========== - CVE-2020-8694 (information disclosure) An information disclosure flaw was found in the Linux kernel's Intel Running Average Power Limit (RAPL) implementation. A local non- privileged attacker could infer secrets by measuring power usage and also infer private data by observing the power usage of calculations performed on the data. - CVE-2020-25704 (denial of service) A memory leak has been found in the perf_event_parse_addr_filter function of Linux before 5.9.7, leading to a denial of service. Impact ====== A local attacker might be able to exhaust the memory available on the system, causing a denial of service, or access sensitive information by observing the power usage. References ========== https://www.openwall.com/lists/oss-security/2020/11/09/1 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=7bdb… https://www.openwall.com/lists/oss-security/2020/11/10/5 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://platypusattack.com/ https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://github.com/anthraxx/linux-hardened/commit/b72aaa9506b38e68f3476a642… https://security.archlinux.org/CVE-2020-8694 https://security.archlinux.org/CVE-2020-25704

1 0

[ASA-202011-9] chromium: arbitrary code execution
by Remi Gacogne 10 Nov '20

10 Nov '20

Arch Linux Security Advisory ASA-202011-9 ========================================= Severity: High Date : 2020-11-10 CVE-ID : CVE-2020-16016 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1267 Summary ======= The package chromium before version 86.0.4240.193-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 86.0.4240.193-1. # pacman -Syu "chromium>=86.0.4240.193-1" The problem has been fixed upstream in version 86.0.4240.193. Workaround ========== None. Description =========== An inappropriate implementation issue has been found in chromium before 86.0.4240.193. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=1146679 https://security.archlinux.org/CVE-2020-16016

1 0

[ASA-202011-8] sddm: privilege escalation
by Remi Gacogne 10 Nov '20

10 Nov '20

Arch Linux Security Advisory ASA-202011-8 ========================================= Severity: Medium Date : 2020-11-10 CVE-ID : CVE-2020-28049 Package : sddm Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1266 Summary ======= The package sddm before version 0.19.0-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 0.19.0-1. # pacman -Syu "sddm>=0.19.0-1" The problem has been fixed upstream in version 0.19.0. Workaround ========== None. Description =========== A local privilege escalation has been discovered in the sddm display manager < 0.19.0. If the auth file is empty, X allows any local application (= any user on the system) to connect. This is currently the case until X wrote the display number to sddm and sddm used that to write the entry into the file. Impact ====== A local user might be able to escalate privileges. References ========== https://www.openwall.com/lists/oss-security/2020/11/04/2 https://github.com/sddm/sddm/commit/be202f533ab98a684c6a007e8d5b4357846bc222 https://security.archlinux.org/CVE-2020-28049

1 0

[ASA-202011-7] salt: multiple issues
by Remi Gacogne 10 Nov '20

10 Nov '20

Arch Linux Security Advisory ASA-202011-7 ========================================= Severity: Critical Date : 2020-11-10 CVE-ID : CVE-2020-16846 CVE-2020-17490 CVE-2020-25592 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1262 Summary ======= The package salt before version 2019.2.7-1 is vulnerable to multiple issues including arbitrary command execution and access restriction bypass. Resolution ========== Upgrade to 2019.2.7-1. # pacman -Syu "salt>=2019.2.7-1" The problems have been fixed upstream in version 2019.2.7. Workaround ========== None. Description =========== - CVE-2020-16846 (arbitrary command execution) An issue has been found in Salt before 3001.3, 3000.5, 2019.2.7 where an unauthenticated user with network access to the Salt API can use shell injections to run code on the Salt API using the SSH client. - CVE-2020-17490 (access restriction bypass) An issue has been found in Salt before 3001.3, 3000.5, 2019.2.7 where, when using the functions create_ca, create_csr, and create_self_signed_cert in the tls execution module, it will not ensure the key was created with the correct permissions. - CVE-2020-25592 (arbitrary command execution) An issue has been found in Salt before 3001.3, 3000.5, 2019.2.7 where, when using the SSH client, an unauthenticated user can gain access to run commands against targets set in a Salt-SSH roster. Impact ====== A remote, unauthenticated user with network access to the Salt API can execute arbitrary commands. References ========== https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclo… https://gitlab.com/saltstack/open/salt-patches/-/blob/master/patches/2020/0… https://gitlab.com/saltstack/open/salt-patches/-/blob/master/patches/2020/0… https://security.archlinux.org/CVE-2020-16846 https://security.archlinux.org/CVE-2020-17490 https://security.archlinux.org/CVE-2020-25592

1 0

[ASA-202011-6] firefox: arbitrary code execution
by Remi Gacogne 10 Nov '20

10 Nov '20

Arch Linux Security Advisory ASA-202011-6 ========================================= Severity: Critical Date : 2020-11-10 CVE-ID : CVE-2020-26950 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1265 Summary ======= The package firefox before version 82.0.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 82.0.3-1. # pacman -Syu "firefox>=82.0.3-1" The problem has been fixed upstream in version 82.0.3. Workaround ========== None. Description =========== A use-after-free has been found in Firefox before 82.0.3 where, in certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-49/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-49/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1675905 https://security.archlinux.org/CVE-2020-26950

1 0

[ASA-202011-5] gdm: privilege escalation
by Remi Gacogne 10 Nov '20

10 Nov '20

Arch Linux Security Advisory ASA-202011-5 ========================================= Severity: High Date : 2020-11-10 CVE-ID : CVE-2020-16125 Package : gdm Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1264 Summary ======= The package gdm before version 3.38.2-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 3.38.2-1. # pacman -Syu "gdm>=3.38.2-1" The problem has been fixed upstream in version 3.38.2. Workaround ========== None. Description =========== gdm before 3.38.2 can be tricked into launching gnome-initial-setup, enabling an unprivileged user to create a new user account for themselves. The new account is a member of the sudo group, so this enables the unprivileged user to obtain admin privileges. Impact ====== An unprivileged local user might be able to elevate privileges to root. References ========== https://gitlab.gnome.org/GNOME/gdm/-/issues/642 https://security.archlinux.org/CVE-2020-16125

1 0

[ASA-202011-4] matrix-synapse: cross-site scripting
by Remi Gacogne 10 Nov '20

10 Nov '20

Arch Linux Security Advisory ASA-202011-4 ========================================= Severity: High Date : 2020-11-03 CVE-ID : CVE-2020-26891 Package : matrix-synapse Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1252 Summary ======= The package matrix-synapse before version 1.21.0-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.21.0-1. # pacman -Syu "matrix-synapse>=1.21.0-1" The problem has been fixed upstream in version 1.21.0. Workaround ========== None. Description =========== A security issue has been found in matrix-synapse before 1.21.0, where HTML pages served via Synapse were vulnerable to cross-site scripting (XSS) attacks. Impact ====== A remote attacker might be able to spoof content and execute code via a cross-site scripting attack. References ========== https://github.com/matrix-org/synapse/releases/tag/v1.21.2 https://github.com/matrix-org/synapse/pull/8444 https://security.archlinux.org/CVE-2020-26891

1 0

[ASA-202011-3] wordpress: multiple issues
by Remi Gacogne 10 Nov '20

10 Nov '20

Arch Linux Security Advisory ASA-202011-3 ========================================= Severity: Critical Date : 2020-11-03 CVE-ID : CVE-2020-28032 CVE-2020-28033 CVE-2020-28034 CVE-2020-28035 CVE-2020-28036 CVE-2020-28037 CVE-2020-28038 CVE-2020-28039 CVE-2020-28040 Package : wordpress Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1257 Summary ======= The package wordpress before version 5.5.3-1 is vulnerable to multiple issues including arbitrary code execution, cross-site request forgery, cross-site scripting, insufficient validation and privilege escalation. Resolution ========== Upgrade to 5.5.3-1. # pacman -Syu "wordpress>=5.5.3-1" The problems have been fixed upstream in version 5.5.3. Workaround ========== None. Description =========== - CVE-2020-28032 (arbitrary code execution) WordPress before 5.5.2 mishandles deserialization requests in wp- includes/Requests/Utility/FilteredIterator.php. - CVE-2020-28033 (insufficient validation) WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. - CVE-2020-28034 (cross-site scripting) WordPress before 5.5.2 allows XSS associated with global variables. - CVE-2020-28035 (privilege escalation) WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. - CVE-2020-28036 (privilege escalation) wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. - CVE-2020-28037 (arbitrary code execution) is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). - CVE-2020-28038 (cross-site scripting) WordPress before 5.5.2 allows stored XSS via post slugs. - CVE-2020-28039 (insufficient validation) is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. - CVE-2020-28040 (cross-site request forgery) WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. Impact ====== A remote attacker can bypass security restrictions to post spam, spoof content, escalate privileges and execute arbitrary code. References ========== https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance… https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebd… https://github.com/WordPress/wordpress-develop/commit/e2142c20be3c07f7e5931… https://github.com/WordPress/wordpress-develop/commit/2d677cd4b2e24d0b5f17a… https://github.com/WordPress/wordpress-develop/commit/c9e6b98968025b1629015… https://github.com/WordPress/wordpress-develop/commit/2ca15d1e5ce70493c5c0c… https://github.com/WordPress/wordpress-develop/commit/d5ddd6d4be1bc9fd16b77… https://blog.wpscan.com/2020/10/30/wordpress-5.5.2-security-release.html https://github.com/WordPress/wordpress-develop/commit/69e832398254b7f47d137… https://security.archlinux.org/CVE-2020-28032 https://security.archlinux.org/CVE-2020-28033 https://security.archlinux.org/CVE-2020-28034 https://security.archlinux.org/CVE-2020-28035 https://security.archlinux.org/CVE-2020-28036 https://security.archlinux.org/CVE-2020-28037 https://security.archlinux.org/CVE-2020-28038 https://security.archlinux.org/CVE-2020-28039 https://security.archlinux.org/CVE-2020-28040

1 0

[ASA-202011-2] chromium: multiple issues
by Remi Gacogne 03 Nov '20

03 Nov '20

Arch Linux Security Advisory ASA-202011-2 ========================================= Severity: Critical Date : 2020-11-03 CVE-ID : CVE-2020-16004 CVE-2020-16005 CVE-2020-16006 CVE-2020-16007 CVE-2020-16008 CVE-2020-16009 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1261 Summary ======= The package chromium before version 86.0.4240.183-1 is vulnerable to multiple issues including arbitrary code execution and privilege escalation. Resolution ========== Upgrade to 86.0.4240.183-1. # pacman -Syu "chromium>=86.0.4240.183-1" The problems have been fixed upstream in version 86.0.4240.183. Workaround ========== None. Description =========== - CVE-2020-16004 (arbitrary code execution) A use after free security issue has been found in the user interface component of the chromium browser before 86.0.4240.75. - CVE-2020-16005 (arbitrary code execution) An insufficient policy enforcement security issue has been found in the ANGLE component of the chromium browser before 86.0.4240.75, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2020-16006 (arbitrary code execution) An inappropriate implementation security issue has been found in the V8 component of the chromium browser before 86.0.4240.75, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. - CVE-2020-16007 (privilege escalation) An insufficient data validation security issue has been found in the installer component of the chromium browser before 86.0.4240.75, allowing a local attacker to potentially elevate privilege via a crafted filesystem. - CVE-2020-16008 (arbitrary code execution) A stack-based buffer overflow security issue has been found in the WebRTC component of the chromium browser before 86.0.4240.75 - CVE-2020-16009 (arbitrary code execution) An inappropriate implementation security issue has been found in the V8 component of the chromium browser before 86.0.4240.75. Google is aware of reports that an exploit for this issue exists in the wild. Impact ====== A remote attacker can bypass security measures and execute arbitrary code. References ========== https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-des… https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-des… https://crbug.com/1138911 https://crbug.com/1139398 https://crbug.com/1133527 https://crbug.com/1125018 https://crbug.com/1134107 https://crbug.com/1143772 https://security.archlinux.org/CVE-2020-16004 https://security.archlinux.org/CVE-2020-16005 https://security.archlinux.org/CVE-2020-16006 https://security.archlinux.org/CVE-2020-16007 https://security.archlinux.org/CVE-2020-16008 https://security.archlinux.org/CVE-2020-16009

1 0