May 2020 - Arch-security - lists.archlinux.org

[ASA-202005-12] chromium: multiple issues
by Morten Linderud 23 May '20

23 May '20

Arch Linux Security Advisory ASA-202005-12 ========================================== Severity: High Date : 2020-05-20 CVE-ID : CVE-2020-6465 CVE-2020-6466 CVE-2020-6467 CVE-2020-6468 CVE-2020-6469 CVE-2020-6470 CVE-2020-6471 CVE-2020-6472 CVE-2020-6473 CVE-2020-6474 CVE-2020-6475 CVE-2020-6476 CVE-2020-6477 CVE-2020-6478 CVE-2020-6479 CVE-2020-6480 CVE-2020-6481 CVE-2020-6482 CVE-2020-6483 CVE-2020-6484 CVE-2020-6485 CVE-2020-6486 CVE-2020-6487 CVE-2020-6488 CVE-2020-6489 CVE-2020-6490 CVE-2020-6491 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1167 Summary ======= The package chromium before version 83.0.4103.61-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, content spoofing and insufficient validation. Resolution ========== Upgrade to 83.0.4103.61-1. # pacman -Syu "chromium>=83.0.4103.61-1" The problems have been fixed upstream in version 83.0.4103.61. Workaround ========== None. Description =========== - CVE-2020-6465 (arbitrary code execution) A use-after-free security issue has been found in the reader mode of the chromium browser before 83.0.4103.61 - CVE-2020-6466 (arbitrary code execution) A use-after-free security issue has been found in the media component of the chromium browser before 83.0.4103.61. - CVE-2020-6467 (arbitrary code execution) A use-after-free security issue has been found in the WebRTC component of the chromium browser before 83.0.4103.61 - CVE-2020-6468 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the chromium browser before 83.0.4103.61. - CVE-2020-6469 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6470 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the clipboard component of the chromium browser before 83.0.4103.61 - CVE-2020-6471 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6472 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6473 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Blink component of the chromium browser before 83.0.4103.61. - CVE-2020-6474 (arbitrary code execution) A use-after-free security issue has been found in the Blink component of the chromium browser before 83.0.4103.61. - CVE-2020-6475 (content spoofing) An incorrect security UI security issue has been found in the full screen component of the chromium browser before 83.0.4103.61. - CVE-2020-6476 (access restriction bypass) An insufficient policy enforcement security issue has been found in the tab strip component of the chromium browser before 83.0.4103.61. - CVE-2020-6477 (access restriction bypass) An inappropriate implementation security issue has been found in the installer component of the chromium browser before 83.0.4103.61. - CVE-2020-6478 (access restriction bypass) An inappropriate implementation security issue has been found in the full screen component of the chromium browser before 83.0.4103.61. - CVE-2020-6479 (access restriction bypass) An inappropriate implementation security issue has been found in the sharing component of the chromium browser before 83.0.4103.61. - CVE-2020-6480 (access restriction bypass) An insufficient policy enforcement security issue has been found in the enterprise component of the chromium browser before 83.0.4103.61. - CVE-2020-6481 (access restriction bypass) An insufficient policy enforcement security issue has been found in the URL formatting component of the chromium browser before 83.0.4103.61. - CVE-2020-6482 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6483 (access restriction bypass) An insufficient policy enforcement security issue has been found in the payments component of the chromium browser before 83.0.4103.61. - CVE-2020-6484 (insufficient validation) An insufficient data validation security issue has been found in the ChromeDriver component of the chromium browser before 83.0.4103.61. - CVE-2020-6485 (insufficient validation) An insufficient data validation security issue has been found in the media router component of the chromium browser before 83.0.4103.61. - CVE-2020-6486 (access restriction bypass) An insufficient policy enforcement security issue has been found in the navigations component of the chromium browser before 83.0.4103.61. - CVE-2020-6487 (access restriction bypass) A insufficient policy enforcement security issue has been found in the downloads component of the chromium browser before 83.0.4103.61. - CVE-2020-6488 (access restriction bypass) An insufficient policy enforcement security issue has been found in the downloads component of the chromium browser before 83.0.4103.61. - CVE-2020-6489 (access restriction bypass) An inappropriate implementation security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6490 (insufficient validation) An insufficient data validation security issue has been found in the loader component of the chromium browser before 83.0.4103.61. - CVE-2020-6491 (content spoofing) A incorrect security UI security issue has been found in the site information component of the chromium browser before 83.0.4103.61. Impact ====== A remote attacker might be able to spoof content, bypass security restrictions or validations checks, or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-des… https://crbug.com/1073015 https://crbug.com/1074706 https://crbug.com/1068084 https://crbug.com/1076708 https://crbug.com/1067382 https://crbug.com/1065761 https://crbug.com/1059577 https://crbug.com/1064519 https://crbug.com/1049510 https://crbug.com/1059533 https://crbug.com/1020026 https://crbug.com/1035315 https://crbug.com/946156 https://crbug.com/1037730 https://crbug.com/1041749 https://crbug.com/1054966 https://crbug.com/1068531 https://crbug.com/795595 https://crbug.com/966507 https://crbug.com/1045787 https://crbug.com/1047285 https://crbug.com/1055524 https://crbug.com/539938 https://crbug.com/1044277 https://crbug.com/1050756 https://crbug.com/1035887 https://crbug.com/1050011 https://security.archlinux.org/CVE-2020-6465 https://security.archlinux.org/CVE-2020-6466 https://security.archlinux.org/CVE-2020-6467 https://security.archlinux.org/CVE-2020-6468 https://security.archlinux.org/CVE-2020-6469 https://security.archlinux.org/CVE-2020-6470 https://security.archlinux.org/CVE-2020-6471 https://security.archlinux.org/CVE-2020-6472 https://security.archlinux.org/CVE-2020-6473 https://security.archlinux.org/CVE-2020-6474 https://security.archlinux.org/CVE-2020-6475 https://security.archlinux.org/CVE-2020-6476 https://security.archlinux.org/CVE-2020-6477 https://security.archlinux.org/CVE-2020-6478 https://security.archlinux.org/CVE-2020-6479 https://security.archlinux.org/CVE-2020-6480 https://security.archlinux.org/CVE-2020-6481 https://security.archlinux.org/CVE-2020-6482 https://security.archlinux.org/CVE-2020-6483 https://security.archlinux.org/CVE-2020-6484 https://security.archlinux.org/CVE-2020-6485 https://security.archlinux.org/CVE-2020-6486 https://security.archlinux.org/CVE-2020-6487 https://security.archlinux.org/CVE-2020-6488 https://security.archlinux.org/CVE-2020-6489 https://security.archlinux.org/CVE-2020-6490 https://security.archlinux.org/CVE-2020-6491

1 0

[ASA-202005-11] openconnect: arbitrary code execution
by Morten Linderud 23 May '20

23 May '20

Arch Linux Security Advisory ASA-202005-11 ========================================== Severity: Low Date : 2020-05-19 CVE-ID : CVE-2020-12823 Package : openconnect Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1157 Summary ======= The package openconnect before version 1:8.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:8.10-1. # pacman -Syu "openconnect>=1:8.10-1" The problem has been fixed upstream in version 8.10. Workaround ========== None. Description =========== OpenConnect 8.09 has a buffer overflow in get_cert_name in gnutls.c, causing a denial of service (application crash) or possibly unspecified other impact, via crafted data in a local certificate. Impact ====== An attacker can cause the application to crash, or possibly execute arbitrary code, by tricking a user into using a specially crafted certificate. References ========== https://gitlab.com/openconnect/openconnect/-/merge_requests/108 https://security.archlinux.org/CVE-2020-12823

1 0

[ASA-202005-10] powerdns-recursor: multiple issues
by Morten Linderud 23 May '20

23 May '20

Arch Linux Security Advisory ASA-202005-10 ========================================== Severity: Medium Date : 2020-05-19 CVE-ID : CVE-2020-10995 CVE-2020-12244 Package : powerdns-recursor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1163 Summary ======= The package powerdns-recursor before version 4.2.2-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 4.2.2-1. # pacman -Syu "powerdns-recursor>=4.2.2-1" The problems have been fixed upstream in version 4.2.2. Workaround ========== None. Description =========== - CVE-2020-10995 (denial of service) An issue has been found in PowerDNS Recursor before 4.3.1 and 4.2.2. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. The effect was already limited in PowerDNS Recursor because of existing mitigations, but additional mitigations relative to this specific attack have been added. - CVE-2020-12244 (insufficient validation) An issue has been found in PowerDNS Recursor before 4.3.1 and 4.2.2 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer. This would allow an attacker in position of man-in-the-middle to send a NXDOMAIN answer for a name that does exist, bypassing DNSSEC validation. Impact ====== A remote attacker can use the recursor has an amplification vector to cause a denial of service via a crafted reply. In addition, a remote attacker in position of man-in-the-middle can bypass DNSSEC validation via a crafted reply. References ========== https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://github.com/PowerDNS/pdns/commit/86f95f85295696c0b264455472b8e270fcc… http://www.nxnsattack.com/ https://github.com/PowerDNS/pdns/commit/4bba0ec04aacbec08fe585ad790e2e8e0cb… https://security.archlinux.org/CVE-2020-10995 https://security.archlinux.org/CVE-2020-12244

1 0

[ASA-202005-9] dovecot: multiple issues
by Morten Linderud 23 May '20

23 May '20

Arch Linux Security Advisory ASA-202005-9 ========================================= Severity: High Date : 2020-05-19 CVE-ID : CVE-2020-10957 CVE-2020-10958 CVE-2020-10967 Package : dovecot Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1162 Summary ======= The package dovecot before version 2.3.10.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.3.10.1-1. # pacman -Syu "dovecot>=2.3.10.1-1" The problems have been fixed upstream in version 2.3.10.1. Workaround ========== None. Description =========== - CVE-2020-10957 (denial of service) A NULL-pointer dereference issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. A client can crash the server by sending a NOOP command with an invalid string parameter. This occurs particularly for a parameter that doesn't start with a double quote. This applies to all SMTP services, including submission-login, which makes it possible to crash the submission service without authentication. - CVE-2020-10958 (arbitrary code execution) A security issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. Sending many invalid or unknown commands can cause the server to access freed memory, which can lead to a server crash. This happens when the server closes the connection with a "421 Too many invalid commands" error. The bad command limit depends on the service (lmtp or submission) and varies between 10 to 20 bad commands. - CVE-2020-10967 (denial of service) A security issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. An authenticated attacker could send an e-mail via the submission service with empty quoted localpart which would cause the submission or lmtp component to crash. An unauthenticated attacker could send an e-mail with a bad sender or recipient address, causing the e-mail to be passed to LMTP for delivery and then crash the LMTP component unless some kind of filtering has been set up on the MTA level. Impact ====== A remote, unauthenticated attacker can crash the server, causing a denial of service. Under certain circumstances it might be possible for a remote attacker to execute arbitrary code on the affected host. References ========== https://dovecot.org/pipermail/dovecot-news/2020-May/000437.html https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html https://github.com/dovecot/core/commit/d143ca6b7ee1196ae3eafffbf6dee71a95a5… https://github.com/dovecot/core/commit/606724bd528b92347dce580d3ab48fc1e3c2… https://github.com/dovecot/core/commit/aedb205c79395de77127fb7166b29b09319d… https://github.com/dovecot/core/commit/874817b169d19a4ae51d80ad5798a396bfe9… https://github.com/dovecot/core/commit/5efeccc10beccbf8d7700adec1278f97d416… https://github.com/dovecot/core/commit/2b4f1e47a4ca8a192bf3f7e944c0ad07b21b… https://github.com/dovecot/core/commit/563bf21d8228a3c06c63b3f289a90ca3d0c5… https://github.com/dovecot/core/commit/18d5837748d3eafe56e080653d5ed0b3e221… https://github.com/dovecot/core/commit/063462d588eaea6f266596fae5f5470792dc… https://github.com/dovecot/core/commit/b34002a4ca301ed94cd944ee3504287ed7e5… https://github.com/dovecot/core/commit/92d9690da195b6ceaa878ab1df6c7c31a75f… https://github.com/dovecot/core/commit/cbab48f174580bfb8d49321d8d336f96a231… https://security.archlinux.org/CVE-2020-10957 https://security.archlinux.org/CVE-2020-10958 https://security.archlinux.org/CVE-2020-10967

1 0

[ASA-202005-8] keycloak: arbitrary code execution
by Remi Gacogne 20 May '20

20 May '20

Arch Linux Security Advisory ASA-202005-8 ========================================= Severity: High Date : 2020-05-16 CVE-ID : CVE-2020-1714 Package : keycloak Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1158 Summary ======= The package keycloak before version 10.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 10.0.1-1. # pacman -Syu "keycloak>=10.0.1-1" The problem has been fixed upstream in version 10.0.1. Workaround ========== None. Description =========== A flaw was found in Keycloak, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution. Impact ====== An authenticated remote attacker could execute arbitrary code by injecting values into a custom attribute. References ========== https://bugs.archlinux.org/task/66642 https://github.com/keycloak/keycloak/pull/7053 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714 https://security.archlinux.org/CVE-2020-1714

1 0

[ASA-202005-7] thunderbird: multiple issues
by Remi Gacogne 20 May '20

20 May '20

Arch Linux Security Advisory ASA-202005-7 ========================================= Severity: Critical Date : 2020-05-09 CVE-ID : CVE-2020-6831 CVE-2020-12387 CVE-2020-12392 CVE-2020-12395 CVE-2020-12397 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1155 Summary ======= The package thunderbird before version 68.8.0-1 is vulnerable to multiple issues including arbitrary code execution and content spoofing. Resolution ========== Upgrade to 68.8.0-1. # pacman -Syu "thunderbird>=68.8.0-1" The problems have been fixed upstream in version 68.8.0. Workaround ========== None. Description =========== - CVE-2020-6831 (arbitrary code execution) A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC, in Firefox before 76.0, Thunderbird before 68.8.0 and chromium before 81.0.4044.138. This could have led to memory corruption and a potentially exploitable crash. - CVE-2020-12387 (arbitrary code execution) A race condition has been found in Firefox before 76.0 and Thunderbird before 68.8.0, when running shutdown code for Web Worker, leading to a use-after-free vulnerability. This results in a potentially exploitable crash. - CVE-2020-12392 (content spoofing) The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request in Firefox before 76.0 and Thunderbird before 68.8.0, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. - CVE-2020-12395 (arbitrary code execution) Several memory safety bugs has been found in Firefox before 76.0, Firefox ESR before 68.8 and Thunderbird before 68.8.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-12397 (content spoofing) An spoofing email address issue has been found in Thunderbird before 68.8.0. By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. Impact ====== A remote attacker can spoof an e-mail address and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/ https://bugzilla.mozilla.org/show_bug.cgi?id=1632241 https://crbug.com/1073602 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831 https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-6831 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1545345 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1614468 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704… https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1617370 https://security.archlinux.org/CVE-2020-6831 https://security.archlinux.org/CVE-2020-12387 https://security.archlinux.org/CVE-2020-12392 https://security.archlinux.org/CVE-2020-12395 https://security.archlinux.org/CVE-2020-12397

1 0

[ASA-202005-6] qemu: multiple issues
by Remi Gacogne 20 May '20

20 May '20

Arch Linux Security Advisory ASA-202005-6 ========================================= Severity: High Date : 2020-05-07 CVE-ID : CVE-2019-20382 CVE-2020-1711 CVE-2020-7039 Package : qemu Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1110 Summary ======= The package qemu before version 5.0.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.0.0-1. # pacman -Syu "qemu>=5.0.0-1" The problems have been fixed upstream in version 5.0.0. Workaround ========== None. Description =========== - CVE-2019-20382 (denial of service) A memory leak has been found in in the way VNC display driver of QEMU <= 4.2.0 handled connection disconnect, when ZRLE, Tight encoding is enabled. It creates two vncState objects, one of which allocates memory for Zlib's data object. This allocated memory is not free'd upon disconnection resulting in the said memory leakage issue. A user able to connect to the VNC server could use this flaw to leak host memory leading to a potential DoS scenario. - CVE-2020-1711 (arbitrary code execution) An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. - CVE-2020-7039 (arbitrary code execution) A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcp_emu() routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process. Impact ====== A remote attacker can crash the QEMU process, and potentially execute arbitrary code on the host. References ========== https://www.openwall.com/lists/oss-security/2020/03/05/1 https://git.qemu.org/?p=qemu.git;a=commitdiff;h=6bf21f3d83e95bcc4ba35a7a07c… https://www.openwall.com/lists/oss-security/2020/01/23/3 https://www.openwall.com/lists/oss-security/2020/01/16/2 https://security.archlinux.org/CVE-2019-20382 https://security.archlinux.org/CVE-2020-1711 https://security.archlinux.org/CVE-2020-7039

1 0

[ASA-202005-5] qutebrowser: certificate verification bypass
by Morten Linderud 11 May '20

11 May '20

Arch Linux Security Advisory ASA-202005-5 ========================================= Severity: Low Date : 2020-05-07 CVE-ID : CVE-2020-11054 Package : qutebrowser Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-1152 Summary ======= The package qutebrowser before version 1.11.1-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 1.11.1-1. # pacman -Syu "qutebrowser>=1.11.1-1" The problem has been fixed upstream in version 1.11.1. Workaround ========== * Treat any host with a certificate exception as insecure, ignoring the URL color * Or set content.ssl_strict to True (instead of 'ask'), preventing certificate exceptions in the configuration Description =========== In qutebrowser before version 1.11.1 there is an issue where after a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false which is not recommended), this could still provide a false sense of security. Impact ====== The user might think the webpage is secure, when in reality it has an invalid certificate. References ========== https://github.com/qutebrowser/qutebrowser/commit/6821c236f9ae23adf21d46ce0… https://github.com/qutebrowser/qutebrowser/commit/556fe81b3146e5cd2e77df9d8… https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-4rcq-jv… https://security.archlinux.org/CVE-2020-11054

1 0

[ASA-202005-4] a2ps: multiple issues
by Morten Linderud 11 May '20

11 May '20

Arch Linux Security Advisory ASA-202005-4 ========================================= Severity: High Date : 2020-05-06 CVE-ID : CVE-2014-0466 CVE-2015-8107 Package : a2ps Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1150 Summary ======= The package a2ps before version 4.14-9 is vulnerable to multiple issues including arbitrary command execution and arbitrary code execution. Resolution ========== Upgrade to 4.14-9. # pacman -Syu "a2ps>=4.14-9" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-0466 (arbitrary command execution) The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file. - CVE-2015-8107 (arbitrary code execution) A format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code. Impact ====== A remote attacker can send crafted Postscript files which can execute arbitrary commands or delete files from the system. References ========== https://github.com/akimd/a2ps/commit/5ea5ff8bc0094ca1eda0dd0e011d860e994c0a… https://github.com/akimd/a2ps/commit/90b876cb480ca9e092490c825663f23909c617… https://security.archlinux.org/CVE-2014-0466 https://security.archlinux.org/CVE-2015-8107

1 0

[ASA-202005-3] firefox: multiple issues
by Remi Gacogne 09 May '20

09 May '20

Arch Linux Security Advisory ASA-202005-3 ========================================= Severity: Critical Date : 2020-05-06 CVE-ID : CVE-2020-6831 CVE-2020-12387 CVE-2020-12390 CVE-2020-12391 CVE-2020-12392 CVE-2020-12394 CVE-2020-12395 CVE-2020-12396 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1148 Summary ======= The package firefox before version 76.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and insufficient validation. Resolution ========== Upgrade to 76.0-1. # pacman -Syu "firefox>=76.0-1" The problems have been fixed upstream in version 76.0. Workaround ========== None. Description =========== - CVE-2020-6831 (arbitrary code execution) A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC, in Firefox before 76.0 and chromium before 81.0.4044.138. This could have led to memory corruption and a potentially exploitable crash. - CVE-2020-12387 (arbitrary code execution) A race condition has been found in Firefox before 76.0, when running shutdown code for Web Worker, leading to a use-after-free vulnerability. This results in a potentially exploitable crash. - CVE-2020-12390 (insufficient validation) An incorrect origin serialization of URLs with IPv6 addresses issue has been found in Firefox before 76.0, and could lead to incorrect security checks. - CVE-2020-12391 (arbitrary code execution) Documents formed using data: URLs in an object element failed to inherit the CSP of the creating context in Firefox before 76.0. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. - CVE-2020-12392 (content spoofing) The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request in Firefox before 76.0, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. - CVE-2020-12394 (content spoofing) A logic flaw has been found in the location bar implementation of Firefox before 76.0, and could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element. - CVE-2020-12395 (arbitrary code execution) Several memory safety bugs has been found in Firefox before 76.0 and Firefox ESR before 68.8. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-12396 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 76.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to spoof content, bypass security checks and execute arbitrary code on the affected host. References ========== https://bugzilla.mozilla.org/show_bug.cgi?id=1632241 https://crbug.com/1073602 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1545345 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1141959 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1457100 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1614468 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1628288 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704… https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1339601%2C1611938%2C1620488… https://security.archlinux.org/CVE-2020-6831 https://security.archlinux.org/CVE-2020-12387 https://security.archlinux.org/CVE-2020-12390 https://security.archlinux.org/CVE-2020-12391 https://security.archlinux.org/CVE-2020-12392 https://security.archlinux.org/CVE-2020-12394 https://security.archlinux.org/CVE-2020-12395 https://security.archlinux.org/CVE-2020-12396

1 0