December 2020 - Arch-security - lists.archlinux.org

[ASA-202012-26] qemu: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-26 ========================================== Severity: Medium Date : 2020-12-16 CVE-ID : CVE-2020-14364 CVE-2020-25624 CVE-2020-25625 CVE-2020-25723 CVE-2020-28916 Package : qemu Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1300 Summary ======= The package qemu before version 5.2.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.2.0-1. # pacman -Syu "qemu>=5.2.0-1" The problems have been fixed upstream in version 5.2.0. Workaround ========== None. Description =========== - CVE-2020-14364 (arbitrary code execution) An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. - CVE-2020-25624 (arbitrary code execution) A flaw was found in QEMU before version 5.2.0. An out-of-bounds read/write access issue was found in the USB OHCI controller emulator. The issue could occur while servicing transfer descriptors (TD), as OHCI controller derives variables 'start_addr', 'end_addr', and 'len' from values supplied by the host controller driver. The host controller driver may supply values such that using these variables leads to an out-of-bounds access issue leading to a guest user/process using this flaw to crash the QEMU process on the host resulting in a denial of service (DoS) scenario. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. - CVE-2020-25625 (denial of service) An infinite loop issue was found in the USB OHCI controller emulator of QEMU before version 5.2.0. It could occur while servicing OHCI isochronous transfer descriptors (TD) in ohci_service_iso_td routine, as it retires a TD if it has passed its time frame. While doing so it does not check if the TD was already processed ones and holds an error code in TD_CC. It may happen if the TD list has a loop. A guest user/process may use this flaw to consume cpu cycles on the host resulting in a DoS scenario. - CVE-2020-25723 (denial of service) A reachable assertion issue was found in the USB EHCI emulation code of QEMU before version 5.2.0. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. - CVE-2020-28916 (denial of service) An infinite loop issue was found in the e1000e device emulator in QEMU before version 5.2.0. The issue could occur while receiving packets via e1000e_write_packet_to_guest() routine, if the receive(RX) descriptor has NULL buffer address. A privileged guest user may use this flaw to induce a DoS scenario on the host. Impact ====== A guest might be able to cause a denial of service or execute arbitrary code on the host. References ========== https://bugs.archlinux.org/task/68356 https://www.openwall.com/lists/oss-security/2020/08/24/2 https://www.openwall.com/lists/oss-security/2020/08/24/3 https://git.qemu.org/?p=qemu.git;a=commitdiff;h=b946434f2659a182afc17e155be… https://git.qemu.org/?p=qemu.git;a=commitdiff;h=1328fe0c32d5474604105b81053… https://www.openwall.com/lists/oss-security/2020/09/17/1 https://git.qemu.org/?p=qemu.git;a=commitdiff;h=1be90ebecc95b09a2ee5af3f60c… https://git.qemu.org/?p=qemu.git;a=commit;h=2fdb42d840400d58f2e706ecca82c14… https://www.openwall.com/lists/oss-security/2020/12/01/2 https://git.qemu.org/?p=qemu.git;a=commitdiff;h=c2cb511634012344e3d0fe49a03… https://security.archlinux.org/CVE-2020-14364 https://security.archlinux.org/CVE-2020-25624 https://security.archlinux.org/CVE-2020-25625 https://security.archlinux.org/CVE-2020-25723 https://security.archlinux.org/CVE-2020-28916

1 0

[ASA-202012-25] firefox: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-25 ========================================== Severity: High Date : 2020-12-16 CVE-ID : CVE-2020-16042 CVE-2020-26971 CVE-2020-26972 CVE-2020-26973 CVE-2020-26974 CVE-2020-26976 CVE-2020-26978 CVE-2020-26979 CVE-2020-35111 CVE-2020-35113 CVE-2020-35114 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1362 Summary ======= The package firefox before version 84.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 84.0-1. # pacman -Syu "firefox>=84.0-1" The problems have been fixed upstream in version 84.0. Workaround ========== None. Description =========== - CVE-2020-16042 (information disclosure) An uninitialized use security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88 and Firefox before 84.0. - CVE-2020-26971 (arbitrary code execution) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6 where certain blit values provided by the user were not properly constrained, leading to a heap buffer overflow on some video drivers. - CVE-2020-26972 (arbitrary code execution) A security issue was found in Firefox before 84.0. The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted in WebGL, resulting in a use-after-free and a potentially exploitable crash. - CVE-2020-26973 (content spoofing) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6 where certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. - CVE-2020-26974 (arbitrary code execution) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6. When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. - CVE-2020-26976 (information disclosure) A security issue was found in Firefox before 84.0. When an HTTPS page was embedded in an HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. - CVE-2020-26978 (information disclosure) A security issue was discovered in Firefox before 84.0 and Thunderbird before 78.6. Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. - CVE-2020-26979 (content spoofing) A security issue was discovered in Firefox before 84.0. When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. - CVE-2020-35111 (information disclosure) A security issue was discovered in Firefox before 84.0 and Thunderbird before 78.6. When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. - CVE-2020-35113 (arbitrary code execution) Mozilla developer Christian Holler reported memory safety bugs present in Firefox 83, Firefox ESR 78.5 and Thunderbird 78.5. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-35114 (arbitrary code execution) Mozilla developers Christian Holler, Jan-Ivar Bruaroey, and Gabriele Svelto reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to spoof content, access sensitive information or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/ https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-des… https://crbug.com/1151890 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1679003 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1663466 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1671382 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1680084 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1681022 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1674343 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1677047 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1641287%2C1673299 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-351… https://bugzilla.mozilla.org/show_bug.cgi?id=1657916 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-351… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1664831%2C1673589 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1607449%2C1640416%2C1656459… https://security.archlinux.org/CVE-2020-16042 https://security.archlinux.org/CVE-2020-26971 https://security.archlinux.org/CVE-2020-26972 https://security.archlinux.org/CVE-2020-26973 https://security.archlinux.org/CVE-2020-26974 https://security.archlinux.org/CVE-2020-26976 https://security.archlinux.org/CVE-2020-26978 https://security.archlinux.org/CVE-2020-26979 https://security.archlinux.org/CVE-2020-35111 https://security.archlinux.org/CVE-2020-35113 https://security.archlinux.org/CVE-2020-35114

1 0

[ASA-202012-24] openssl: denial of service
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-24 ========================================== Severity: High Date : 2020-12-16 CVE-ID : CVE-2020-1971 Package : openssl Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1335 Summary ======= The package openssl before version 1.1.1.i-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.1.1.i-1. # pacman -Syu "openssl>=1.1.1.i-1" The problem has been fixed upstream in version 1.1.1.i. Workaround ========== None. Description =========== A denial of service security issue was discovered in OpenSSL before 1.1.1i. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. Impact ====== A remote attacker might be able to cause a crash by tricking a vulnerable client or server into checking a malicious certificate against a malicious CRL. References ========== https://www.openssl.org/news/secadv/20201208.txt https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f960d81215ebf3… https://security.archlinux.org/CVE-2020-1971

1 0

[ASA-202012-23] thunderbird: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-23 ========================================== Severity: High Date : 2020-12-16 CVE-ID : CVE-2020-16042 CVE-2020-26970 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35113 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1315 Summary ======= The package thunderbird before version 78.6.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 78.6.0-1. # pacman -Syu "thunderbird>=78.6.0-1" The problems have been fixed upstream in version 78.6.0. Workaround ========== None. Description =========== - CVE-2020-16042 (information disclosure) An uninitialized use security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88 and Firefox before 84.0. - CVE-2020-26970 (arbitrary code execution) When reading SMTP server status codes, Thunderbird before 78.5.1 writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable. - CVE-2020-26971 (arbitrary code execution) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6 where certain blit values provided by the user were not properly constrained, leading to a heap buffer overflow on some video drivers. - CVE-2020-26973 (content spoofing) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6 where certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. - CVE-2020-26974 (arbitrary code execution) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6. When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. - CVE-2020-26978 (information disclosure) A security issue was discovered in Firefox before 84.0 and Thunderbird before 78.6. Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. - CVE-2020-35111 (information disclosure) A security issue was discovered in Firefox before 84.0 and Thunderbird before 78.6. When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. - CVE-2020-35113 (arbitrary code execution) Mozilla developer Christian Holler reported memory safety bugs present in Firefox 83, Firefox ESR 78.5 and Thunderbird 78.5. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to access sensitive information, spoof content or execute arbitrary code. Note that in general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. References ========== https://bugs.archlinux.org/task/68853 https://www.mozilla.org/en-US/security/advisories/mfsa2020-53/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/ https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-des… https://crbug.com/1151890 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1679003 https://www.mozilla.org/en-US/security/advisories/mfsa2020-53/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1677338 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1663466 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1680084 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1681022 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1677047 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-351… https://bugzilla.mozilla.org/show_bug.cgi?id=1657916 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-351… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1664831%2C1673589 https://security.archlinux.org/CVE-2020-16042 https://security.archlinux.org/CVE-2020-26970 https://security.archlinux.org/CVE-2020-26971 https://security.archlinux.org/CVE-2020-26973 https://security.archlinux.org/CVE-2020-26974 https://security.archlinux.org/CVE-2020-26978 https://security.archlinux.org/CVE-2020-35111 https://security.archlinux.org/CVE-2020-35113

1 0

[ASA-202012-22] tensorflow: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-22 ========================================== Severity: Critical Date : 2020-12-16 CVE-ID : CVE-2020-26266 CVE-2020-26267 CVE-2020-26268 CVE-2020-26269 CVE-2020-26270 CVE-2020-26271 Package : tensorflow Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1348 Summary ======= The package tensorflow before version 2.4.0-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 2.4.0-1. # pacman -Syu "tensorflow>=2.4.0-1" The problems have been fixed upstream in version 2.4.0. Workaround ========== None. Description =========== - CVE-2020-26266 (information disclosure) In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. - CVE-2020-26267 (information disclosure) In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. - CVE-2020-26268 (denial of service) In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area. If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault. This is because the allocator used to return the buffer data is not marked as returning an opaque handle since the needed virtual method is not overridden. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. - CVE-2020-26269 (information disclosure) In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched. - CVE-2020-26270 (denial of service) In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of- death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. - CVE-2020-26271 (information disclosure) In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src node (given by output_index) and the input slot of the dst node (given by input_index). This is only possible if the types of the tensors on both sides coincide, so the function begins by obtaining the corresponding DataType values and comparing these for equality. However, there is no check that the indices point to inside of the arrays they index into. Thus, this can result in accessing data out of bounds of the corresponding heap allocated arrays. In most scenarios, this can manifest as unitialized data access, but if the index points far away from the boundaries of the arrays this can be used to leak addresses from the library. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Impact ====== An attacker might be able to cause a denial of service or access sensitive information. References ========== https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qhxx-j73r… https://github.com/tensorflow/tensorflow/commit/1b3546b184a42ca69b5d094131a… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c9f3-9wfr… https://github.com/tensorflow/tensorflow/commit/ffea0239373512240bb17101b5a… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hhvc-g5hv… https://github.com/tensorflow/tensorflow/commit/eccdffd4ba5604fd53bcc48a9b2… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9jjw-hf72… https://github.com/tensorflow/tensorflow/commit/18d54d15864eaa8b163183786d0… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m648-33qf… https://github.com/tensorflow/tensorflow/commit/b550171e78e0a085b208d6a3b8b… https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q263-fvxm… https://github.com/tensorflow/tensorflow/commit/7664e65c2c0fcda6b9d833acbb1… https://security.archlinux.org/CVE-2020-26266 https://security.archlinux.org/CVE-2020-26267 https://security.archlinux.org/CVE-2020-26268 https://security.archlinux.org/CVE-2020-26269 https://security.archlinux.org/CVE-2020-26270 https://security.archlinux.org/CVE-2020-26271

1 0

[ASA-202012-21] openjpeg2: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-21 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2019-12973 CVE-2020-6851 CVE-2020-8112 CVE-2020-15389 CVE-2020-27814 CVE-2020-27824 CVE-2020-27841 CVE-2020-27842 CVE-2020-27843 CVE-2020-27845 Package : openjpeg2 Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1339 Summary ======= The package openjpeg2 before version 2.4.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.4.0-1. # pacman -Syu "openjpeg2>=2.4.0-1" The problems have been fixed upstream in version 2.4.0. Workaround ========== None. Description =========== - CVE-2019-12973 (denial of service) In OpenJPEG before version 2.4.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616. - CVE-2020-6851 (arbitrary code execution) OpenJPEG before version 2.4.0 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation. - CVE-2020-8112 (arbitrary code execution) opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG before version 2.4.0 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851. - CVE-2020-15389 (denial of service) jp2/opj_decompress.c in OpenJPEG before version 2.4.0 has a use-after- free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double- free may also be possible. This is related to calling opj_image_destroy twice. - CVE-2020-27814 (arbitrary code execution) A heap-buffer overwrite error was discovered in lib/openjp2/mqc.c in OpenJPEG before version 2.4.0. The vulnerability causes an out-of- bounds write, which may lead to remote denial of service or possibly remote code execution. - CVE-2020-27824 (denial of service) In OpenJPEG before version 2.4.0, if too many decomposition levels are supplied to the encoder, it could cause a global buffer overflow to out-of-bounds read in the opj_dwt_calc_explicit_stepsizes() function. - CVE-2020-27841 (denial of service) An out-of-bounds read was discovered in lib/openjp2/pi.c:623 in OpenJPEG before version 2.4.0. - CVE-2020-27842 (denial of service) A null pointer dereference issue was found in lib/openjp2/tgt.c when a small precincts size, the option "-TP C" and non (0,0) grid offset are given in OpenJPEG before version 2.4.0. - CVE-2020-27843 (denial of service) An out-of-bounds read was found in opj_t2_encode_packet when small precincts and an origin shift are given in OpenJPEG before version 2.4.0. - CVE-2020-27845 (denial of service) An out-of-bounds read was discovered in lib/openjp2/pi.c:312 in OpenJPEG before version 2.4.0. Impact ====== A local attacker might be able to execute arbitrary code or crash the application via crafted JPEG content. References ========== https://bugs.archlinux.org/task/68906 https://github.com/uclouvain/openjpeg/issues/1222 https://github.com/uclouvain/openjpeg/pull/1185 https://github.com/uclouvain/openjpeg/commit/21399f6b7d318fcdf4406d5e88723c… https://github.com/uclouvain/openjpeg/commit/3aef207f90e937d4931daf6d411e09… https://github.com/uclouvain/openjpeg/issues/1228 https://github.com/uclouvain/openjpeg/pull/1229 https://github.com/uclouvain/openjpeg/commit/024b8407392cb0b82b04b58ed25609… https://github.com/uclouvain/openjpeg/issues/1231 https://github.com/uclouvain/openjpeg/pull/1232 https://github.com/uclouvain/openjpeg/commit/05f9b91e60debda0e83977e5e63b2e… https://github.com/uclouvain/openjpeg/issues/1261 https://github.com/uclouvain/openjpeg/pull/1262 https://github.com/uclouvain/openjpeg/commit/e8e258ab049240c2dd1f1051b4e773… https://github.com/uclouvain/openjpeg/issues/1283 https://github.com/uclouvain/openjpeg/pull/1303 https://github.com/uclouvain/openjpeg/commit/4ce7d285a55d29b79880d0566d4b01… https://github.com/uclouvain/openjpeg/issues/1286 https://github.com/uclouvain/openjpeg/pull/1292 https://github.com/uclouvain/openjpeg/commit/6daf5f3e1ec6eff03b7982889874a3… https://github.com/uclouvain/openjpeg/issues/1293 https://github.com/uclouvain/openjpeg/pull/1295 https://github.com/uclouvain/openjpeg/pull/1300 https://github.com/uclouvain/openjpeg/commit/c9380ed0f8cc4794fc71d556ea23ae… https://github.com/uclouvain/openjpeg/commit/00383e162ae2f8fc951f5745bf1011… https://github.com/uclouvain/openjpeg/issues/1294 https://github.com/uclouvain/openjpeg/pull/1296 https://github.com/uclouvain/openjpeg/commit/fbd30b064f8f9607d500437b6fedc4… https://github.com/uclouvain/openjpeg/issues/1297 https://github.com/uclouvain/openjpeg/pull/1298 https://github.com/uclouvain/openjpeg/commit/38d661a3897052c7ff0b39b30c29cb… https://github.com/uclouvain/openjpeg/issues/1302 https://github.com/uclouvain/openjpeg/pull/1304 https://github.com/uclouvain/openjpeg/commit/8f5aff1dff510a964d3901d0fba281… https://security.archlinux.org/CVE-2019-12973 https://security.archlinux.org/CVE-2020-6851 https://security.archlinux.org/CVE-2020-8112 https://security.archlinux.org/CVE-2020-15389 https://security.archlinux.org/CVE-2020-27814 https://security.archlinux.org/CVE-2020-27824 https://security.archlinux.org/CVE-2020-27841 https://security.archlinux.org/CVE-2020-27842 https://security.archlinux.org/CVE-2020-27843 https://security.archlinux.org/CVE-2020-27845

1 0

[ASA-202012-20] lib32-gdk-pixbuf2: denial of service
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-20 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2020-29385 Package : lib32-gdk-pixbuf2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1329 Summary ======= The package lib32-gdk-pixbuf2 before version 2.42.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.42.2-1. # pacman -Syu "lib32-gdk-pixbuf2>=2.42.2-1" The problem has been fixed upstream in version 2.42.2. Workaround ========== None. Description =========== A security issue was found in gdk-pixbuf2 2.40.0 up to 2.42.0. A malformed GIF image could lead to an endless loop in the write_indexes function in gdk-pixbuf/lzw.c, taking full CPU resources and leading to a denial of service. Impact ====== An attacker might be able to cause a denial of service via a crafted GIF image. References ========== https://mail.gnome.org/archives/distributor-list/2020-December/msg00000.html https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/164 https://gitlab.gnome.org/GNOME/gdk-pixbuf/uploads/2838c96bb111a93d845b95c53… https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/92 https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/bdd3acbd48a575d418ba6bf1… https://security.archlinux.org/CVE-2020-29385

1 0

[ASA-202012-19] gdk-pixbuf2: denial of service
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-19 ========================================== Severity: Medium Date : 2020-12-09 CVE-ID : CVE-2020-29385 Package : gdk-pixbuf2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1328 Summary ======= The package gdk-pixbuf2 before version 2.42.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.42.2-1. # pacman -Syu "gdk-pixbuf2>=2.42.2-1" The problem has been fixed upstream in version 2.42.2. Workaround ========== None. Description =========== A security issue was found in gdk-pixbuf2 2.40.0 up to 2.42.0. A malformed GIF image could lead to an endless loop in the write_indexes function in gdk-pixbuf/lzw.c, taking full CPU resources and leading to a denial of service. Impact ====== An attacker might be able to cause a denial of service via a crafted GIF image. References ========== https://mail.gnome.org/archives/distributor-list/2020-December/msg00000.html https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/164 https://gitlab.gnome.org/GNOME/gdk-pixbuf/uploads/2838c96bb111a93d845b95c53… https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/92 https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/bdd3acbd48a575d418ba6bf1… https://security.archlinux.org/CVE-2020-29385

1 0

[ASA-202012-18] nsd: denial of service
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-18 ========================================== Severity: Low Date : 2020-12-09 CVE-ID : CVE-2020-28935 Package : nsd Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1327 Summary ======= The package nsd before version 4.3.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.3.4-1. # pacman -Syu "nsd>=4.3.4-1" The problem has been fixed upstream in version 4.3.4. Workaround ========== None. Description =========== NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system. Impact ====== A local attacker might be able to cause a denial of service of the host. References ========== https://www.nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt https://github.com/NLnetLabs/unbound/issues/303 https://nlnetlabs.nl/downloads/unbound/patch_cve-2020-28935_unbound.diff https://github.com/NLnetLabs/unbound/commit/ad387832979b6ce4c93f64fe706301c… https://github.com/NLnetLabs/unbound/commit/19f8f4d9f99a44906ab9dcc46d44da2… https://nlnetlabs.nl/downloads/nsd/patch_cve-2020-28935_nsd.diff https://github.com/NLnetLabs/nsd/commit/a4caec3137a1bc9eca05d38d66e2bce572c… https://security.archlinux.org/CVE-2020-28935

1 0

[ASA-202012-17] unbound: denial of service
by Morten Linderud 17 Dec '20

17 Dec '20

Arch Linux Security Advisory ASA-202012-17 ========================================== Severity: Low Date : 2020-12-09 CVE-ID : CVE-2020-28935 Package : unbound Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1326 Summary ======= The package unbound before version 1.13.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.13.0-1. # pacman -Syu "unbound>=1.13.0-1" The problem has been fixed upstream in version 1.13.0. Workaround ========== None. Description =========== NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the file if it is not there, or open an existing file for writing. In case the file was already present, they would follow symlinks if the file happened to be a symlink instead of a regular file. An additional chown of the file would then take place after it was written, making the user Unbound/NSD is supposed to run as the new owner of the file. If an attacker has local access to the user Unbound/NSD runs as, she could create a symlink in place of the PID file pointing to a file that she would like to erase. If then Unbound/NSD is killed and the PID file is not cleared, upon restarting with root privileges, Unbound/NSD will rewrite any file pointed at by the symlink. This is a local vulnerability that could create a Denial of Service of the system Unbound/NSD is running on. It requires an attacker having access to the limited permission user Unbound/NSD runs as and point through the symlink to a critical file on the system. Impact ====== A local attacker might be able to cause a denial of service of the host. References ========== https://www.nlnetlabs.nl/downloads/unbound/CVE-2020-28935.txt https://github.com/NLnetLabs/unbound/issues/303 https://nlnetlabs.nl/downloads/unbound/patch_cve-2020-28935_unbound.diff https://github.com/NLnetLabs/unbound/commit/ad387832979b6ce4c93f64fe706301c… https://github.com/NLnetLabs/unbound/commit/19f8f4d9f99a44906ab9dcc46d44da2… https://nlnetlabs.nl/downloads/nsd/patch_cve-2020-28935_nsd.diff https://github.com/NLnetLabs/nsd/commit/a4caec3137a1bc9eca05d38d66e2bce572c… https://security.archlinux.org/CVE-2020-28935

1 0