February 2020 - Arch-security - lists.archlinux.org

[ASA-202002-11] chromium: multiple issues
by Morten Linderud 29 Feb '20

29 Feb '20

Arch Linux Security Advisory ASA-202002-11 ========================================== Severity: High Date : 2020-02-25 CVE-ID : CVE-2020-6407 CVE-2020-6418 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1102 Summary ======= The package chromium before version 80.0.3987.122-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 80.0.3987.122-1. # pacman -Syu "chromium>=80.0.3987.122-1" The problems have been fixed upstream in version 80.0.3987.122. Workaround ========== None. Description =========== - CVE-2020-6407 (information disclosure) An out-of-bounds memory access vulnerability has been found in the streams component of chromium before 80.0.3987.122. - CVE-2020-6418 (arbitrary code execution) A type confusion vulnerability has been found in the V8 component of chromium before 80.0.3987.122. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-des… https://crbug.com/1045931 https://crbug.com/1053604 https://security.archlinux.org/CVE-2020-6407 https://security.archlinux.org/CVE-2020-6418

1 0

[ASA-202002-10] webkit2gtk: multiple issues
by Morten Linderud 29 Feb '20

29 Feb '20

Arch Linux Security Advisory ASA-202002-10 ========================================== Severity: High Date : 2020-02-17 CVE-ID : CVE-2020-3862 CVE-2020-3864 CVE-2020-3865 CVE-2020-3867 CVE-2020-3868 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1100 Summary ======= The package webkit2gtk before version 2.26.4-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, sandbox escape, denial of service and same-origin policy bypass. Resolution ========== Upgrade to 2.26.4-1. # pacman -Syu "webkit2gtk>=2.26.4-1" The problems have been fixed upstream in version 2.26.4. Workaround ========== None. Description =========== - CVE-2020-3862 (denial of service) A malicious website may be able to cause a denial of service. - CVE-2020-3864 (same-origin policy bypass) A DOM object context may not have had a unique security origin. - CVE-2020-3865 (sandbox escape) A top-level DOM object context may have incorrectly been considered secure. - CVE-2020-3867 (cross-site scripting) Processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2020-3868 (arbitrary code execution) Processing maliciously crafted web content may lead to arbitrary code execution. Credit to Marcin Towalski of Cisco Talos. Impact ====== A remote attacker can bypass security restrictions via universal cross- site scripting or execute arbitrary code via crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0002.html https://security.archlinux.org/CVE-2020-3862 https://security.archlinux.org/CVE-2020-3864 https://security.archlinux.org/CVE-2020-3865 https://security.archlinux.org/CVE-2020-3867 https://security.archlinux.org/CVE-2020-3868

1 0

[ASA-202002-9] thunderbird: multiple issues
by Morten Linderud 17 Feb '20

17 Feb '20

Arch Linux Security Advisory ASA-202002-9 ========================================= Severity: Critical Date : 2020-02-13 CVE-ID : CVE-2020-6792 CVE-2020-6793 CVE-2020-6794 CVE-2020-6795 CVE-2020-6798 CVE-2020-6800 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1099 Summary ======= The package thunderbird before version 68.5.0-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, denial of service and information disclosure. Resolution ========== Upgrade to 68.5.0-1. # pacman -Syu "thunderbird>=68.5.0-1" The problems have been fixed upstream in version 68.5.0. Workaround ========== None. Description =========== - CVE-2020-6792 (information disclosure) An information disclosure issue has bee found in Thunderbird before 68.5. When deriving an Message ID identifier for an email message, uninitialized memory was used in addition to the message contents. - CVE-2020-6793 (information disclosure) An out-of-bounds read has been found in Thunderbird before 68.5, when processing an e-mail message with an ill-formed envelope. - CVE-2020-6794 (information disclosure) It has been found that setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords before Thunderbird 68.5. If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. - CVE-2020-6795 (denial of service) A null-pointer dereference has been found in Thunderbird before 68.5, when processing a message that contains multiple S/MIME signatures. - CVE-2020-6798 (cross-site scripting) An incorrect parsing of template could result in Javascript injection in Firefox before 73.0 and Thunderbird before 68.5. If a <template> tag was used in a <select%gt; tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. - CVE-2020-6800 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 73.0 and Thunderbird before 68.5. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker can access sensitive information, bypass security measures, crash the application or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6792 https://bugzilla.mozilla.org/show_bug.cgi?id=1609607 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6793 https://bugzilla.mozilla.org/show_bug.cgi?id=1608539 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6794 https://bugzilla.mozilla.org/show_bug.cgi?id=1606619 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6795 https://bugzilla.mozilla.org/show_bug.cgi?id=1611105 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6798 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6798 https://bugzilla.mozilla.org/show_bug.cgi?id=1602944 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6800 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6800 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595786%2C1596706%2C1598543… https://security.archlinux.org/CVE-2020-6792 https://security.archlinux.org/CVE-2020-6793 https://security.archlinux.org/CVE-2020-6794 https://security.archlinux.org/CVE-2020-6795 https://security.archlinux.org/CVE-2020-6798 https://security.archlinux.org/CVE-2020-6800

1 0

[ASA-202002-8] systemd: privilege escalation
by Morten Linderud 17 Feb '20

17 Feb '20

Arch Linux Security Advisory ASA-202002-8 ========================================= Severity: High Date : 2020-02-12 CVE-ID : CVE-2020-1712 Package : systemd Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1094 Summary ======= The package systemd before version 244.2-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 244.2-1. # pacman -Syu "systemd>=244.2-1" The problem has been fixed upstream in version 244.2. Workaround ========== None. Description =========== A heap use-after-free vulnerability was found in systemd before version 244.2, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages. Impact ====== A local unprivileged attacker is able to crash the system or execute arbitrary code as root by abusing polkit caching mechanisms. References ========== https://github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cccf97e… https://github.com/systemd/systemd-stable/commit/e2d4cb9843c50eff76e9104fec… https://security.archlinux.org/CVE-2020-1712

1 0

[ASA-202002-7] webkit2gtk: arbitrary code execution
by Remi Gacogne 13 Feb '20

13 Feb '20

Arch Linux Security Advisory ASA-202002-7 ========================================= Severity: Critical Date : 2020-02-12 CVE-ID : CVE-2019-8835 CVE-2019-8844 CVE-2019-8846 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1098 Summary ======= The package webkit2gtk before version 2.26.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.26.3-1. # pacman -Syu "webkit2gtk>=2.26.3-1" The problems have been fixed upstream in version 2.26.3. Workaround ========== None. Description =========== - CVE-2019-8835 (arbitrary code execution) Multiple memory corruption issues have been found in WebKitGTK before 2.26.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8844 (arbitrary code execution) Multiple memory corruption issues have been found in WebKitGTK before 2.26.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8846 (arbitrary code execution) Multiple memory corruption issues have been found in WebKitGTK before 2.26.3, where processing maliciously crafted web content may lead to arbitrary code execution. Impact ====== A remote attacker can execute code on the affected host via maliciously crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0001.html https://webkitgtk.org/security/WSA-2020-0001.html#CVE-2019-8835 https://webkitgtk.org/security/WSA-2020-0001.html#CVE-2019-8844 https://webkitgtk.org/security/WSA-2020-0001.html#CVE-2019-8846 https://security.archlinux.org/CVE-2019-8835 https://security.archlinux.org/CVE-2019-8844 https://security.archlinux.org/CVE-2019-8846

1 0

[ASA-202002-6] dovecot: denial of service
by Remi Gacogne 13 Feb '20

13 Feb '20

Arch Linux Security Advisory ASA-202002-6 ========================================= Severity: Medium Date : 2020-02-12 CVE-ID : CVE-2020-7046 CVE-2020-7957 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1097 Summary ======= The package dovecot before version 2.3.9.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.3.9.3-1. # pacman -Syu "dovecot>=2.3.9.3-1" The problems have been fixed upstream in version 2.3.9.3. Workaround ========== None. Description =========== - CVE-2020-7046 (denial of service) A denial of service has been found in Dovecot before 2.3.9.3, where lib-smtp doesn't handle truncated command parameters properly, resulting in infinite loop taking 100% CPU for the process. This happens for LMTP (where it doesn't matter so much) and also for submission-login where unauthenticated users can trigger it. - CVE-2020-7957 (denial of service) A denial of service have been found in Dovecot before 2.3.9.3, where a specially crafted e-mail can cause a mailbox to have permanently inaccessible mail, or the e-mail itself can be stuck in delivery. This happens because the snippet generation crashes if a message is large enough that message-parser returns multiple body blocks, the first block(s) don't contain the full snippet (e.g. full of whitespace) and the input ends with '>'. Impact ====== A remote, unauthenticated user can cause a denial of service via a crafted message. References ========== https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html https://security.archlinux.org/CVE-2020-7046 https://security.archlinux.org/CVE-2020-7957

1 0

[ASA-202002-5] firefox: multiple issues
by Remi Gacogne 13 Feb '20

13 Feb '20

Arch Linux Security Advisory ASA-202002-5 ========================================= Severity: Critical Date : 2020-02-11 CVE-ID : CVE-2020-6796 CVE-2020-6798 CVE-2020-6800 CVE-2020-6801 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1096 Summary ======= The package firefox before version 73.0-1 is vulnerable to multiple issues including arbitrary code execution and cross-site scripting. Resolution ========== Upgrade to 73.0-1. # pacman -Syu "firefox>=73.0-1" The problems have been fixed upstream in version 73.0. Workaround ========== None. Description =========== - CVE-2020-6796 (arbitrary code execution) A missing bounds check on shared memory read in the parent process has been found in Firefox before 73.0. A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable crash. - CVE-2020-6798 (cross-site scripting) An incorrect parsing of template could result in Javascript injection in Firefox before 73.0 and Thunderbird before 68.5. If a <template> tag was used in a <select%gt; tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. - CVE-2020-6800 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 73.0 and Thunderbird before 68.5. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-6801 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 73.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker can inject javascript on a vulnerable site, and execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-05 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6796 https://bugzilla.mozilla.org/show_bug.cgi?id=1610426 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6798 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6798 https://bugzilla.mozilla.org/show_bug.cgi?id=1602944 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6800 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6800 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595786%2C1596706%2C1598543… https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6801 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1601024%2C1601712%2C1604836… https://security.archlinux.org/CVE-2020-6796 https://security.archlinux.org/CVE-2020-6798 https://security.archlinux.org/CVE-2020-6800 https://security.archlinux.org/CVE-2020-6801

1 0

[ASA-202002-4] ksh: arbitrary command execution
by Morten Linderud 12 Feb '20

12 Feb '20

Arch Linux Security Advisory ASA-202002-4 ========================================= Severity: High Date : 2020-02-08 CVE-ID : CVE-2019-14868 Package : ksh Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-1095 Summary ======= The package ksh before version 2020.0.0-2 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2020.0.0-2. # pacman -Syu "ksh>=2020.0.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in ksh version 2020.0.0 in the evaluation of certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely. Impact ====== An attacker is able to execute arbitrary commands that are blacklisted on the affected host. References ========== https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2 https://security.archlinux.org/CVE-2019-14868

1 0

[ASA-202002-3] chromium: multiple issues
by Remi Gacogne 07 Feb '20

07 Feb '20

Arch Linux Security Advisory ASA-202002-3 ========================================= Severity: Critical Date : 2020-02-06 CVE-ID : CVE-2019-18197 CVE-2019-19880 CVE-2019-19923 CVE-2019-19925 CVE-2019-19926 CVE-2020-6381 CVE-2020-6382 CVE-2020-6385 CVE-2020-6387 CVE-2020-6388 CVE-2020-6389 CVE-2020-6390 CVE-2020-6391 CVE-2020-6392 CVE-2020-6393 CVE-2020-6394 CVE-2020-6395 CVE-2020-6396 CVE-2020-6397 CVE-2020-6398 CVE-2020-6399 CVE-2020-6400 CVE-2020-6401 CVE-2020-6402 CVE-2020-6403 CVE-2020-6404 CVE-2020-6405 CVE-2020-6406 CVE-2020-6408 CVE-2020-6409 CVE-2020-6410 CVE-2020-6411 CVE-2020-6412 CVE-2020-6413 CVE-2020-6414 CVE-2020-6415 CVE-2020-6416 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1092 Summary ======= The package chromium before version 80.0.3987.87-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure, insufficient validation and content spoofing. Resolution ========== Upgrade to 80.0.3987.87-1. # pacman -Syu "chromium>=80.0.3987.87-1" The problems have been fixed upstream in version 80.0.3987.87. Workaround ========== None. Description =========== - CVE-2019-18197 (insufficient validation) Multiple vulnerabilities have been found in the xml component of the chromium browser before 80.0.3987.8. - CVE-2019-19880 (insufficient validation) Multiple vulnerabilities have been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2019-19923 (information disclosure) An out of bounds memory access has been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2019-19925 (insufficient validation) Multiple vulnerabilities have been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2019-19926 (insufficient validation) An inappropriate implementation security issue has been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2020-6381 (arbitrary code execution) An integer overflow security issue has been found in the javascript component of the chromium browser before 80.0.3987.8. - CVE-2020-6382 (arbitrary code execution) A type confusion security issue has been found in the javascript component of the chromium browser before 80.0.3987.8. - CVE-2020-6385 (access restriction bypass) An insufficient policy enforcement security issue has been found in the storage component of the chromium browser before 80.0.3987.8. - CVE-2020-6387 (arbitrary code execution) An out of bounds write has been found in the WebRTC component of the chromium browser before 80.0.3987.8. - CVE-2020-6388 (information disclosure) An out of bounds memory access has been found in the WebAudio component of the chromium browser before 80.0.3987.8. - CVE-2020-6389 (arbitrary code execution) An out of bounds write has been found in the WebRTC component of the chromium browser before 80.0.3987.8. - CVE-2020-6390 (information disclosure) An out of bounds memory access has been found in the streams component of the chromium browser before 80.0.3987.8. - CVE-2020-6391 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6392 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Extensions component of the chromium browser before 80.0.3987.8. - CVE-2020-6393 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6394 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6395 (information disclosure) An out of bounds read has been found in the javascript component of the chromium browser before 80.0.3987.8. - CVE-2020-6396 (access restriction bypass) An inappropriate implementation security issue has been found in the Skia component of the chromium browser before 80.0.3987.8. - CVE-2020-6397 (content spoofing) An incorrect security UI issue has been found in the sharing component of the chromium browser before 80.0.3987.8. - CVE-2020-6398 (information disclosure) An uninitialized use has been found in the PDFium component of the chromium browser before 80.0.3987.8. - CVE-2020-6399 (access restriction bypass) An insufficient policy enforcement issue has been found in the AppCache component of the chromium browser before 80.0.3987.8. - CVE-2020-6400 (access restriction bypass) An inappropriate implementation issue has been found in the CORS component of the chromium browser before 80.0.3987.8. - CVE-2020-6401 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6402 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Downloads component of the chromium browser before 80.0.3987.8. - CVE-2020-6403 (content spoofing) A incorrect security UI issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6404 (access restriction bypass) An inappropriate implementation security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6405 (information disclosure) An out of bounds read has been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2020-6406 (arbitrary code execution) A use-after-free security issue has been found in the Audio component of the chromium browser before 80.0.3987.8. - CVE-2020-6408 (access restriction bypass) An insufficient policy enforcement security issue has been found in the CORS component of the chromium browser before 80.0.3987.8. - CVE-2020-6409 (access restriction bypass) An inappropriate implementation security issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6410 (access restriction bypass) An insufficient policy enforcement security issue has been found in the navigation component of the chromium browser before 80.0.3987.8. - CVE-2020-6411 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6412 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6413 (access restriction bypass) An inappropriate implementation security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6414 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Safe Browsing component of the chromium browser before 80.0.3987.8. - CVE-2020-6415 (access restriction bypass) An inappropriate implementation security issue has been found in the javascript component of the chromium browser before 80.0.3987.8. - CVE-2020-6416 (insufficient validation) An insufficient data validation security issue has been found in the streams component of the chromium browser before 80.0.3987.8. Impact ====== A remote attacker can bypass security measures, access sensitive information, spoof the content of parts of the UI or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-des… https://crbug.com/1020745 https://crbug.com/1038863 https://crbug.com/1042578 https://crbug.com/1042700 https://crbug.com/1034394 https://crbug.com/1031909 https://crbug.com/1035399 https://crbug.com/1042535 https://crbug.com/1042879 https://crbug.com/1042933 https://crbug.com/1045874 https://crbug.com/1017871 https://crbug.com/1030411 https://crbug.com/1035058 https://crbug.com/1014371 https://crbug.com/1022855 https://crbug.com/1035271 https://crbug.com/1027408 https://crbug.com/1032090 https://crbug.com/1039869 https://crbug.com/1038036 https://crbug.com/1017707 https://crbug.com/1029375 https://crbug.com/1006012 https://crbug.com/1024256 https://crbug.com/1042145 https://crbug.com/1042254 https://crbug.com/1026546 https://crbug.com/1037889 https://crbug.com/881675 https://crbug.com/929711 https://crbug.com/968505 https://crbug.com/1005713 https://crbug.com/1021855 https://crbug.com/1029576 https://crbug.com/1031895 https://security.archlinux.org/CVE-2019-18197 https://security.archlinux.org/CVE-2019-19880 https://security.archlinux.org/CVE-2019-19923 https://security.archlinux.org/CVE-2019-19925 https://security.archlinux.org/CVE-2019-19926 https://security.archlinux.org/CVE-2020-6381 https://security.archlinux.org/CVE-2020-6382 https://security.archlinux.org/CVE-2020-6385 https://security.archlinux.org/CVE-2020-6387 https://security.archlinux.org/CVE-2020-6388 https://security.archlinux.org/CVE-2020-6389 https://security.archlinux.org/CVE-2020-6390 https://security.archlinux.org/CVE-2020-6391 https://security.archlinux.org/CVE-2020-6392 https://security.archlinux.org/CVE-2020-6393 https://security.archlinux.org/CVE-2020-6394 https://security.archlinux.org/CVE-2020-6395 https://security.archlinux.org/CVE-2020-6396 https://security.archlinux.org/CVE-2020-6397 https://security.archlinux.org/CVE-2020-6398 https://security.archlinux.org/CVE-2020-6399 https://security.archlinux.org/CVE-2020-6400 https://security.archlinux.org/CVE-2020-6401 https://security.archlinux.org/CVE-2020-6402 https://security.archlinux.org/CVE-2020-6403 https://security.archlinux.org/CVE-2020-6404 https://security.archlinux.org/CVE-2020-6405 https://security.archlinux.org/CVE-2020-6406 https://security.archlinux.org/CVE-2020-6408 https://security.archlinux.org/CVE-2020-6409 https://security.archlinux.org/CVE-2020-6410 https://security.archlinux.org/CVE-2020-6411 https://security.archlinux.org/CVE-2020-6412 https://security.archlinux.org/CVE-2020-6413 https://security.archlinux.org/CVE-2020-6414 https://security.archlinux.org/CVE-2020-6415 https://security.archlinux.org/CVE-2020-6416

1 0

[ASA-202002-2] sudo: privilege escalation
by Morten Linderud 06 Feb '20

06 Feb '20

Arch Linux Security Advisory ASA-202002-2 ========================================= Severity: High Date : 2020-02-06 CVE-ID : CVE-2019-18634 Package : sudo Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1093 Summary ======= The package sudo before version 1.8.31-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.8.31-1. # pacman -Syu "sudo>=1.8.31-1" The problem has been fixed upstream in version 1.8.31. Workaround ========== Ensure pwfeedback is disabled in /etc/sshd/sshd_config with: Defaults !pwfeedback Description =========== A flaw was found in the Sudo before version 1.8.31 application when the ’pwfeedback' option is set to true on the sudoers file. An authenticated user can use this vulnerability to trigger a stack-based buffer overflow under certain conditions even without Sudo privileges. The buffer overflow may allow an attacker to expose or corrupt memory information, crash the Sudo application, or possibly inject code to be run as a root user. Impact ====== An authenticated user is capable of escalating to root privileges. References ========== https://www.sudo.ws/alerts/pwfeedback.html https://www.sudo.ws/repos/sudo/rev/84640592b0ff https://security.archlinux.org/CVE-2019-18634

1 1