December 2020 - Arch-security - lists.archlinux.org

[ASA-202012-6] xorg-server: arbitrary code execution
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-6 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-14360 CVE-2020-25712 Package : xorg-server Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1310 Summary ======= The package xorg-server before version 1.20.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.20.10-1. # pacman -Syu "xorg-server>=1.20.10-1" The problems have been fixed upstream in version 1.20.10. Workaround ========== None. Description =========== - CVE-2020-14360 (arbitrary code execution) A security issue was discovered in xorg-server before 1.20.10. Insufficient checks on the lengths of the XkbSetMap request can lead to out of bounds memory accesses in the X server. This issue can lead to privilege escalation for authorized clients on systems where the X server is running privileged. - CVE-2020-25712 (arbitrary code execution) A security issue was discovered in xorg-server before 1.20.10. Insufficient checks on input of the XkbSetDeviceInfo request can lead to a buffer overflow on the head in the X server. This issue can lead to privilege escalation for authorized clients on systems where the X server is running privileged. Impact ====== A local attacker might be able to escalate privileges. References ========== https://www.openwall.com/lists/oss-security/2020/12/01/3 https://gitlab.freedesktop.org/xorg/xserver/-/commit/446ff2d3177087b8173fa7… https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361… https://security.archlinux.org/CVE-2020-14360 https://security.archlinux.org/CVE-2020-25712

1 0

[ASA-202012-3] tomcat9: information disclosure
by Remi Gacogne 09 Dec '20

09 Dec '20

rch Linux Security Advisory ASA-202012-3 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-17527 Package : tomcat9 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1317 Summary ======= The package tomcat9 before version 9.0.40-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 9.0.40-1. # pacman -Syu "tomcat9>=9.0.40-1" The problem has been fixed upstream in version 9.0.40. Workaround ========== None. Description =========== It was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests. Impact ====== A remote attacker might be able to access sensitive information via well-timed HTTP/2 requests. References ========== https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60 https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b18… https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db… https://security.archlinux.org/CVE-2020-17527

1 1

[ASA-202012-5] ant: arbitrary code execution
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-5 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-11979 Package : ant Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1312 Summary ======= The package ant before version 1.10.9-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.10.9-1. # pacman -Syu "ant>=1.10.9-1" The problem has been fixed upstream in version 1.10.9. Workaround ========== The issue can be mitigated by making Ant use a directory that is only readable and writable by the current user. Description =========== As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process. Impact ====== A local attacker might be able to execute arbitrary code by injecting modified source files into the build process at the exact right moment. References ========== https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920ed… https://security.archlinux.org/CVE-2020-11979

1 0

[ASA-202012-4] tomcat8: information disclosure
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-4 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-17527 Package : tomcat8 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1316 Summary ======= The package tomcat8 before version 8.5.60-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 8.5.60-1. # pacman -Syu "tomcat8>=8.5.60-1" The problem has been fixed upstream in version 8.5.60. Workaround ========== None. Description =========== It was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests. Impact ====== A remote attacker might be able to access sensitive information via well-timed HTTP/2 requests. References ========== https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.60 https://github.com/apache/tomcat/commit/21e3408671aac7e0d7e264e720cac8b1b18… https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.40 https://github.com/apache/tomcat/commit/d56293f816d6dc9e2b47107f208fa9e95db… https://security.archlinux.org/CVE-2020-17527

1 0

[ASA-202012-2] cimg: arbitrary code execution
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-2 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-25693 Package : cimg Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1318 Summary ======= The package cimg before version 2.9.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.9.4-1. # pacman -Syu "cimg>=2.9.4-1" The problem has been fixed upstream in version 2.9.4. Workaround ========== None. Description =========== A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() can be triggered by a specially crafted input file processed by CImg, which can lead to an impact to application availability or data integrity. Impact ====== An attacker might be able to execute arbitrary code via a crafted PNM file. References ========== https://github.com/dtschump/CImg/pull/295 https://github.com/dtschump/CImg/commit/7db6d08355d09414d407e26aac10bb58253… https://security.archlinux.org/CVE-2020-25693

1 0

[ASA-202012-1] python-lxml: cross-site scripting
by Remi Gacogne 09 Dec '20

09 Dec '20

Arch Linux Security Advisory ASA-202012-1 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-27783 Package : python-lxml Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1319 Summary ======= The package python-lxml before version 4.6.2-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 4.6.2-1. # pacman -Syu "python-lxml>=4.6.2-1" The problem has been fixed upstream in version 4.6.2. Workaround ========== None. Description =========== A cross-site scripting vulnerability was discovered in python-lxml's clean module before version 4.6.2. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code. Impact ====== A remote attacker might be able to run arbitrary JavaScript code. References ========== https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7 https://security.archlinux.org/CVE-2020-27783

1 0

[ASA-202011-29] musl: arbitrary code execution
by Morten Linderud 05 Dec '20

05 Dec '20

Arch Linux Security Advisory ASA-202011-29 ========================================== Severity: Medium Date : 2020-11-26 CVE-ID : CVE-2020-28928 Package : musl Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1287 Summary ======= The package musl before version 1.2.1-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.2.1-2. # pacman -Syu "musl>=1.2.1-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== The wcsnrtombs function in all musl libc versions up to 1.2.1 has been found to have multiple bugs in the handling of the destination buffer size when limiting the input character count, which can lead to an infinite loop with no progress (no overflow) or to writing past the end of the destination buffer. Impact ====== An attacker might be able to execute arbitrary code via crafted input content. References ========== https://bugs.archlinux.org/task/68685 https://www.openwall.com/lists/musl/2020/11/19/1 https://git.musl-libc.org/cgit/musl/commit/?id=3ab2a4e02682df1382955071919d… https://security.archlinux.org/CVE-2020-28928

1 0

[ASA-202011-28] webkit2gtk: arbitrary code execution
by Morten Linderud 05 Dec '20

05 Dec '20

Arch Linux Security Advisory ASA-202011-28 ========================================== Severity: Medium Date : 2020-11-26 CVE-ID : CVE-2020-9983 CVE-2020-13543 CVE-2020-13584 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1291 Summary ======= The package webkit2gtk before version 2.30.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.30.3-1. # pacman -Syu "webkit2gtk>=2.30.3-1" The problems have been fixed upstream in version 2.30.3. Workaround ========== None. Description =========== - CVE-2020-9983 (arbitrary code execution) An out-of-bounds write issue was found in webkit2gtk before 2.30.3. Processing maliciously crafted web content may have lead to code execution. - CVE-2020-13543 (arbitrary code execution) A use after free issue was found in webkit2gtk before 2.30.3. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-13584 (arbitrary code execution) A use after free issue was found in webkit2gtk before 2.30.3. Processing maliciously crafted web content may have lead to arbitrary code execution. Impact ====== A remote attacker might be able to execute arbitrary code via crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0008.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9983 https://webkitgtk.org/security/WSA-2020-0009.html#CVE-2020-13543 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13584 https://security.archlinux.org/CVE-2020-9983 https://security.archlinux.org/CVE-2020-13543 https://security.archlinux.org/CVE-2020-13584

1 0

[ASA-202011-27] opensc: arbitrary code execution
by Morten Linderud 05 Dec '20

05 Dec '20

Arch Linux Security Advisory ASA-202011-27 ========================================== Severity: Medium Date : 2020-11-26 CVE-ID : CVE-2020-26570 CVE-2020-26571 CVE-2020-26572 Package : opensc Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1298 Summary ======= The package opensc before version 0.21.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.21.0-1. # pacman -Syu "opensc>=0.21.0-1" The problems have been fixed upstream in version 0.21.0. Workaround ========== None. Description =========== - CVE-2020-26570 (arbitrary code execution) The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file. - CVE-2020-26571 (arbitrary code execution) The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init. - CVE-2020-26572 (arbitrary code execution) The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher. Impact ====== An attacker might be able to execute arbitrary code via crafted content or metadata on a card. References ========== https://bugs.archlinux.org/task/68195 https://github.com/OpenSC/OpenSC/releases/tag/0.21.0 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24316 https://github.com/OpenSC/OpenSC/commit/6903aebfddc466d966c7b865fae34572bf3… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20612 https://github.com/OpenSC/OpenSC/commit/ed55fcd2996930bf58b9bb57e9ba7b1f3a7… https://github.com/OpenSC/OpenSC/commit/f49162af0476723a0f72ca66c9ce6dd5bf3… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967 https://github.com/OpenSC/OpenSC/commit/9d294de90d1cc66956389856e60b6944b27… https://security.archlinux.org/CVE-2020-26570 https://security.archlinux.org/CVE-2020-26571 https://security.archlinux.org/CVE-2020-26572

1 0

[ASA-202011-26] gitea: insufficient validation
by Morten Linderud 05 Dec '20

05 Dec '20

Arch Linux Security Advisory ASA-202011-26 ========================================== Severity: Medium Date : 2020-11-26 CVE-ID : CVE-2020-28991 Package : gitea Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1299 Summary ======= The package gitea before version 1.12.6-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.12.6-1. # pacman -Syu "gitea>=1.12.6-1" The problem has been fixed upstream in version 1.12.6. Workaround ========== None. Description =========== Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr in modules/auth/repo_form.go, causing partial SSRF. Impact ====== A remote attacker might be able to trick a user into performing an unwanted action via SSRF. References ========== https://github.com/go-gitea/gitea/releases/tag/v1.12.6 https://github.com/go-gitea/gitea/commit/480efbdb96e4092493ec1e3683b2ab688a… https://security.archlinux.org/CVE-2020-28991

1 0