March 2020 - Arch-security - lists.archlinux.org

[ASA-202003-3] ppp: arbitrary code execution
by Morten Linderud 12 Mar '20

12 Mar '20

Arch Linux Security Advisory ASA-202003-3 ========================================= Severity: Medium Date : 2020-03-07 CVE-ID : CVE-2020-8597 Package : ppp Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1101 Summary ======= The package ppp before version 2.4.7-7 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.4.7-7. # pacman -Syu "ppp>=2.4.7-7" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A buffer overflow flaw was found in the ppp package in versions 2.4.2 through 2.4.8. The bounds check for the rhostname was improperly constructed in the EAP request and response functions which could allow a buffer overflow to occur. Data confidentiality and integrity, as well as system availability, are all at risk with this vulnerability. Impact ====== A remote unauthenticated user can crash or possibly execute code on the host by sending malicious authentication data. References ========== https://lists.debian.org/debian-lts-announce/2020/02/msg00005.html https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787… https://seclists.org/fulldisclosure/2020/Mar/6 https://security.archlinux.org/CVE-2020-8597

1 0

[ASA-202003-2] opensc: denial of service
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202003-2 ========================================= Severity: Medium Date : 2020-03-04 CVE-ID : CVE-2019-6502 CVE-2019-15945 CVE-2019-15946 CVE-2019-19479 CVE-2019-19480 CVE-2019-19481 Package : opensc Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1106 Summary ======= The package opensc before version 0.20.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.20.0-1. # pacman -Syu "opensc>=0.20.0-1" The problems have been fixed upstream in version 0.20.0. Workaround ========== None. Description =========== - CVE-2019-6502 (denial of service) sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. - CVE-2019-15945 (denial of service) OpenSC before 0.20.0 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c. - CVE-2019-15946 (denial of service) OpenSC before 0.20.0 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c. - CVE-2019-19479 (denial of service) An issue was discovered in OpenSC before 0.20.0. libopensc/card- setcos.c has an incorrect read operation during parsing of a SETCOS file attribute. - CVE-2019-19480 (denial of service) An issue was discovered in OpenSC before 0.20.0. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry. - CVE-2019-19481 (denial of service) An issue was discovered in OpenSC before 0.20.0. libopensc/card-cac1.c mishandles buffer limits for CAC certificates, leading to an out-of- bounds read. Impact ====== A local attacker is able to crash the application with a malformed certificate. References ========== https://bugs.archlinux.org/task/65082 https://github.com/OpenSC/OpenSC/issues/1586 https://github.com/OpenSC/OpenSC/commit/0d7967549751b7032f22b437106b41444af… https://github.com/OpenSC/OpenSC/commit/412a6142c27a5973c61ba540e33cdc22d56… https://github.com/OpenSC/OpenSC/compare/f1691fc...12218d4 https://github.com/OpenSC/OpenSC/commit/a3fc7693f3a035a8a7921cffb98432944bb… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18693 https://github.com/OpenSC/OpenSC/commit/c3f23b836e5a1766c36617fe1da30d22f7b… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18478 https://github.com/OpenSC/OpenSC/commit/6ce6152284c47ba9b1d4fe8ff9d2e6a3f5e… https://github.com/OpenSC/OpenSC/commit/b75c002cfb1fd61cd20ec938ff4937d7b1a… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18618 https://security.archlinux.org/CVE-2019-6502 https://security.archlinux.org/CVE-2019-15945 https://security.archlinux.org/CVE-2019-15946 https://security.archlinux.org/CVE-2019-19479 https://security.archlinux.org/CVE-2019-19480 https://security.archlinux.org/CVE-2019-19481

1 0

[ASA-202003-1] chromium: access restriction bypass
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202003-1 ========================================= Severity: High Date : 2020-03-04 CVE-ID : CVE-2020-6420 Package : chromium Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-1107 Summary ======= The package chromium before version 80.0.3987.132-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 80.0.3987.132-1. # pacman -Syu "chromium>=80.0.3987.132-1" The problem has been fixed upstream in version 80.0.3987.132. Workaround ========== None. Description =========== An insufficient policy enforcement issue has been found in the media component of chromium before 80.0.3987.132. Impact ====== A remote attacker can bypass security restrictions. References ========== https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-des… https://crbug.com/1050996 https://security.archlinux.org/CVE-2020-6420

1 0

[ASA-202002-13] opensmtpd: arbitrary command execution
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202002-13 ========================================== Severity: Critical Date : 2020-02-29 CVE-ID : CVE-2020-8794 Package : opensmtpd Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1105 Summary ======= The package opensmtpd before version 6.6.4p1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 6.6.4p1-1. # pacman -Syu "opensmtpd>=6.6.4p1-1" The problem has been fixed upstream in version 6.6.4p1. Workaround ========== None. Description =========== An out-of-bounds read vulnerability has been found in the client-side code of OpenSMTPD <= 6.6.3p1, leading to arbitrary command execution via a crafted SMTP transaction. Impact ====== A remote attacker is able to execute arbitrary commands as root on the affected host. References ========== https://www.qualys.com/2020/02/24/cve-2020-8794/lpe-rce-opensmtpd-default-i… https://security.archlinux.org/CVE-2020-8794

1 0

[ASA-202002-12] weechat: multiple issues
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202002-12 ========================================== Severity: Critical Date : 2020-02-25 CVE-ID : CVE-2020-8955 CVE-2020-9759 CVE-2020-9760 Package : weechat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1103 Summary ======= The package weechat before version 2.7.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.7.1-1. # pacman -Syu "weechat>=2.7.1-1" The problems have been fixed upstream in version 2.7.1. Workaround ========== None. Description =========== - CVE-2020-8955 (arbitrary code execution) A heap-based out-of-bounds write has been found in the IRC plugin of Weechat before 2.7.1, in irc-mode.c, when receiving a malformed IRC message 324 (channel mode). - CVE-2020-9759 (denial of service) A heap-based out-of-bounds read has been found in Weechat before 2.7.1, when receiving a malformed IRC message 352 (WHO). It could lead to a off-by-one read resulting in denial of service (crash). - CVE-2020-9760 (arbitrary code execution) A heap-based out-of-bounds write has been found in Weechat before 2.7.1, when a new IRC message 005 is received with longer nick prefixes. It could lead to writing out of the allocated prefixes array when setting a prefix, resulting in denial of service (crash) or even arbitrary code execution. Impact ====== A remote attacker can crash the client and execute code remotely via a malformed message. References ========== https://weechat.org/news/113/20200220-Version-2.7.1-security-release/ https://github.com/weechat/weechat/commit/51a739df615f8ec66fbe1e9682ec3c321… https://github.com/weechat/weechat/commit/c827d6fa864e2c0b79cea640c45272e83… https://github.com/weechat/weechat/commit/694b5c9f874d7337cd2e03761e0de4352… https://security.archlinux.org/CVE-2020-8955 https://security.archlinux.org/CVE-2020-9759 https://security.archlinux.org/CVE-2020-9760

1 0