April 2020 - Arch-security - lists.archlinux.org

[ASA-202004-23] webkit2gtk: arbitrary code execution
by Remi Gacogne 30 Apr '20

30 Apr '20

Arch Linux Security Advisory ASA-202004-23 ========================================== Severity: Critical Date : 2020-04-28 CVE-ID : CVE-2020-3899 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1144 Summary ======= The package webkit2gtk before version 2.28.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.28.2-1. # pacman -Syu "webkit2gtk>=2.28.2-1" The problem has been fixed upstream in version 2.28.2. Workaround ========== None. Description =========== A memory handling issue has been found in WebKitGTK before 2.28.2 and WPE WebKit before 2.28.2. Impact ====== A remote attacker might be able to execute arbitrary code via crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0005.html https://webkitgtk.org/security/WSA-2020-0005.html#CVE-2020-3899 https://security.archlinux.org/CVE-2020-3899

1 0

[ASA-202004-22] chromium: arbitrary code execution
by Remi Gacogne 30 Apr '20

30 Apr '20

Arch Linux Security Advisory ASA-202004-22 ========================================== Severity: High Date : 2020-04-28 CVE-ID : CVE-2020-6461 CVE-2020-6462 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1143 Summary ======= The package chromium before version 81.0.4044.129-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 81.0.4044.129-1. # pacman -Syu "chromium>=81.0.4044.129-1" The problems have been fixed upstream in version 81.0.4044.129. Workaround ========== None. Description =========== - CVE-2020-6461 (arbitrary code execution) A use-after-free vulnerability has been found in the storage component of the chromium browser before 81.0.4044.129. - CVE-2020-6462 (arbitrary code execution) A use-after-free vulnerability has been found in the task scheduling component of the chromium browser before 81.0.4044.129. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-des… https://crbug.com/1072983 https://crbug.com/1064891 https://security.archlinux.org/CVE-2020-6461 https://security.archlinux.org/CVE-2020-6462

1 0

[ASA-202004-21] git: information disclosure
by Remi Gacogne 30 Apr '20

30 Apr '20

Arch Linux Security Advisory ASA-202004-21 ========================================== Severity: High Date : 2020-04-22 CVE-ID : CVE-2020-11008 Package : git Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1138 Summary ======= The package git before version 2.26.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.26.2-1. # pacman -Syu "git>=2.26.2-1" The problem has been fixed upstream in version 2.26.2. Workaround ========== None. Description =========== A vulnerability has been found in git before 2.26.2. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. Unlike the vulnerability CVE-2020-5260 fixed in v2.26.1, the credentials are not for a host of the attacker's choosing; instead, they are for some unspecified host (based on how the configured credential helper handles an absent "host" parameter). The attack has been made impossible by refusing to work with under- specified credential patterns. Impact ====== A remote attacker might be able to retrieve passwords or other credentials by tricking a user into cloning from a crafted URL, either directly or via Git submodules, or package systems built around Git. References ========== https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7 https://github.com/git/git/compare/v2.17.4...v2.17.5 https://security.archlinux.org/CVE-2020-11008

1 0

[ASA-202004-20] chromium: multiple issues
by Remi Gacogne 24 Apr '20

24 Apr '20

Arch Linux Security Advisory ASA-202004-20 ========================================== Severity: High Date : 2020-04-22 CVE-ID : CVE-2020-6458 CVE-2020-6459 CVE-2020-6460 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1140 Summary ======= The package chromium before version 81.0.4044.122-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 81.0.4044.122-1. # pacman -Syu "chromium>=81.0.4044.122-1" The problems have been fixed upstream in version 81.0.4044.122. Workaround ========== None. Description =========== - CVE-2020-6458 (arbitrary code execution) An out of bounds read and write security issue has been found in the PDFium component of the chromium browser before 81.0.4044.122. - CVE-2020-6459 (arbitrary code execution) A use-after-free security issue has been found in the payments component of the chromium browser before 81.0.4044.122. - CVE-2020-6460 (insufficient validation) An insufficient data validation security issue has been found in the URL formatting component of the chromium browser before 81.0.4044.122. Impact ====== A remote attacker might be able to bypass restrictions, access sensitive information or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-des… https://crbug.com/1067270 https://crbug.com/1065298 https://crbug.com/1063566 https://security.archlinux.org/CVE-2020-6458 https://security.archlinux.org/CVE-2020-6459 https://security.archlinux.org/CVE-2020-6460

1 0

[ASA-202004-19] lib32-openssl: denial of service
by Santiago Torres-Arias 23 Apr '20

23 Apr '20

Arch Linux Security Advisory ASA-202004-19 ========================================== Severity: High Date : 2020-04-22 CVE-ID : CVE-2020-1967 Package : lib32-openssl Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1142 Summary ======= The package lib32-openssl before version 1.1.1.g-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.1.1.g-1. # pacman -Syu "lib32-openssl>=1.1.1.g-1" The problem has been fixed upstream in version 1.1.1.g. Workaround ========== None. Description =========== A NULL pointer dereference has been found in OpenSSL versions 1.1.1d, 1.1.1e and 1.1.1f. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. Impact ====== A malicious server or client may crash an openssl/libssl process by providing a maliciously-crafted SSL handshake References ========== https://www.openssl.org/news/secadv/20200421.txt https://github.com/openssl/openssl/commit/eb563247aef3e83dda7679c43f9649270… https://security.archlinux.org/CVE-2020-1967

1 0

[ASA-202004-18] openssl: denial of service
by Santiago Torres-Arias 22 Apr '20

22 Apr '20

Arch Linux Security Advisory ASA-202004-18 ========================================== Severity: High Date : 2020-04-21 CVE-ID : CVE-2020-1967 Package : openssl Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1139 Summary ======= The package openssl before version 1.1.1.g-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.1.1.g-1. # pacman -Syu "openssl>=1.1.1.g-1" The problem has been fixed upstream in version 1.1.1.g. Workaround ========== None. Description =========== A NULL pointer dereference has been found in OpenSSL versions 1.1.1d, 1.1.1e and 1.1.1f. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. Impact ====== A malicious server or client may crash an openssl/libssl process by providing a maliciously-crafted SSL handshake References ========== https://www.openssl.org/news/secadv/20200421.txt https://github.com/openssl/openssl/commit/eb563247aef3e83dda7679c43f9649270… https://security.archlinux.org/CVE-2020-1967

1 0

[ASA-202004-17] webkit2gtk: arbitrary code execution
by Remi Gacogne 21 Apr '20

21 Apr '20

Arch Linux Security Advisory ASA-202004-17 ========================================== Severity: Critical Date : 2020-04-19 CVE-ID : CVE-2020-11793 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1137 Summary ======= The package webkit2gtk before version 2.28.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.28.1-1. # pacman -Syu "webkit2gtk>=2.28.1-1" The problem has been fixed upstream in version 2.28.1. Workaround ========== None. Description =========== A use-after-free has been found in WebKitGTK before 2.2.8.1, where processing maliciously crafted web content may lead to arbitrary code execution or application crash (denial of service). Impact ====== A remote attacker can execute arbitrary code on the affected host via crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0004.html https://webkitgtk.org/security/WSA-2020-0004.html#CVE-2020-11793 https://security.archlinux.org/CVE-2020-11793

1 0

[ASA-202004-16] openvpn: denial of service
by Remi Gacogne 19 Apr '20

19 Apr '20

Arch Linux Security Advisory ASA-202004-16 ========================================== Severity: Medium Date : 2020-04-17 CVE-ID : CVE-2020-11810 Package : openvpn Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1135 Summary ======= The package openvpn before version 2.4.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.9-1. # pacman -Syu "openvpn>=2.4.9-1" The problem has been fixed upstream in version 2.4.9. Workaround ========== None. Description =========== A security issue has been found in OpenVPN before 2.4.9, where a 'peer- id' check is not performed correctly during a small amount of time after a connection has been established. A rogue client sending a data channel packet during that time, from a different source address and with the same 'peer-id', would cause the client data to float to that new address, effectively sopping the VPN traffic of the first, legitimate client. Impact ====== A remote attacker might be able to cause the legitimate VPN session of another client to stall, by sending a crafted packet right at the beginning of the VPN session. References ========== https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae… https://community.openvpn.net/openvpn/ticket/1272 https://security.archlinux.org/CVE-2020-11810

1 0

[ASA-202004-15] chromium: arbitrary code execution
by Remi Gacogne 17 Apr '20

17 Apr '20

Arch Linux Security Advisory ASA-202004-15 ========================================== Severity: Critical Date : 2020-04-16 CVE-ID : CVE-2020-6457 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1134 Summary ======= The package chromium before version 81.0.4044.113-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 81.0.4044.113-1. # pacman -Syu "chromium>=81.0.4044.113-1" The problem has been fixed upstream in version 81.0.4044.113. Workaround ========== None. Description =========== A use-after-free security issue has been found in the speech recognizer component of chromium before 81.0.4044.113. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-des… https://crbug.com/1067851 https://security.archlinux.org/CVE-2020-6457

1 0

[ASA-202004-14] apache: multiple issues
by Remi Gacogne 17 Apr '20

17 Apr '20

Arch Linux Security Advisory ASA-202004-14 ========================================== Severity: Low Date : 2020-04-15 CVE-ID : CVE-2020-1927 CVE-2020-1934 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1126 Summary ======= The package apache before version 2.4.43-1 is vulnerable to multiple issues including information disclosure and open redirect. Resolution ========== Upgrade to 2.4.43-1. # pacman -Syu "apache>=2.4.43-1" The problems have been fixed upstream in version 2.4.43. Workaround ========== None. Description =========== - CVE-2020-1927 (open redirect) A security issue has been found in Apache HTTP Server from 2.4.0 up to and including 2.4.41, in the mod_rewrite module, where redirects that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. This is the same defect as CVE-2019-10098. The fix for CVE-2019-10098 was ineffective. Possible mitigations are the use of anchor captures as back-references, or prefixing self-referential redirects with / or scheme, host, and port. - CVE-2020-1934 (information disclosure) The use of an uninitialized value has been found in Apache HTTP Server from 2.4.0 up to and including 2.4.41, in the mod_proxy_ftp module, when proxying to a malicious FTP server. Impact ====== A remote attacker is able to cause a redirect via a crafted HTTP request, or disclose information when proxying to an FTP server. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://seclists.org/oss-sec/2020/q2/3 https://seclists.org/oss-sec/2020/q2/4 https://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_ftp… https://security.archlinux.org/CVE-2020-1927 https://security.archlinux.org/CVE-2020-1934

1 0