May 2020 - Arch-security - lists.archlinux.org

[ASA-202005-2] chromium: arbitrary code execution
by Remi Gacogne 09 May '20

09 May '20

Arch Linux Security Advisory ASA-202005-2 ========================================= Severity: High Date : 2020-05-06 CVE-ID : CVE-2020-6464 CVE-2020-6831 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1149 Summary ======= The package chromium before version 81.0.4044.138-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 81.0.4044.138-1. # pacman -Syu "chromium>=81.0.4044.138-1" The problems have been fixed upstream in version 81.0.4044.138. Workaround ========== None. Description =========== - CVE-2020-6464 (arbitrary code execution) A type confusion issue has been found in the Blink component of the chromium browser before 81.0.4044.138. - CVE-2020-6831 (arbitrary code execution) A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC, in Firefox before 76.0 and chromium before 81.0.4044.138. This could have led to memory corruption and a potentially exploitable crash. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-des… https://crbug.com/1071059 https://bugzilla.mozilla.org/show_bug.cgi?id=1632241 https://crbug.com/1073602 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831 https://security.archlinux.org/CVE-2020-6464 https://security.archlinux.org/CVE-2020-6831

1 0

[ASA-202005-1] salt: multiple issues
by Morten Linderud 05 May '20

05 May '20

Arch Linux Security Advisory ASA-202005-1 ========================================= Severity: Critical Date : 2020-05-05 CVE-ID : CVE-2020-11651 CVE-2020-11652 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1147 Summary ======= The package salt before version 2019.2.4-1 is vulnerable to multiple issues including arbitrary command execution and arbitrary filesystem access. Resolution ========== Upgrade to 2019.2.4-1. # pacman -Syu "salt>=2019.2.4-1" The problems have been fixed upstream in version 2019.2.4. Workaround ========== Do not expose salt-master to the internet. Description =========== - CVE-2020-11651 (arbitrary command execution) An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. - CVE-2020-11652 (arbitrary filesystem access) An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. Impact ====== A remote unauthenticated user can execute arbitrary commands and access files on the affected host. References ========== https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/300… https://github.com/saltstack/salt/commit/a67d76b15615983d467ed81371b38b4a17… https://github.com/saltstack/salt/commit/cce7abad9c22d9d50ccee2813acabff8de… https://security.archlinux.org/CVE-2020-11651 https://security.archlinux.org/CVE-2020-11652

1 0

[ASA-202004-24] libmicrodns: multiple issues
by Morten Linderud 05 May '20

05 May '20

Arch Linux Security Advisory ASA-202004-24 ========================================== Severity: Critical Date : 2020-04-30 CVE-ID : CVE-2020-6071 CVE-2020-6072 CVE-2020-6073 CVE-2020-6077 CVE-2020-6078 CVE-2020-6079 CVE-2020-6080 Package : libmicrodns Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1136 Summary ======= The package libmicrodns before version 0.1.2-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 0.1.2-1. # pacman -Syu "libmicrodns>=0.1.2-1" The problems have been fixed upstream in version 0.1.2. Workaround ========== None. Description =========== - CVE-2020-6071 (denial of service) An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6072 (arbitrary code execution) An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return value is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6073 (information disclosure) An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing the RDATA section in a TXT record in mDNS messages, multiple integer overflows can be triggered, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6077 (information disclosure) An exploitable denial-of-service vulnerability exists in the message- parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages, the implementation does not properly keep track of the available data in the message, possibly leading to an out-of-bounds read that would result in a denial of service. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6078 (denial of service) An exploitable denial-of-service vulnerability exists in the message- parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_recv, the return value of the mdns_read_header function is not checked, leading to an uninitialized variable usage that eventually results in a null pointer dereference, leading to service crash. An attacker can send a series of mDNS messages to trigger this vulnerability. - CVE-2020-6079 (denial of service) Multiple exploitable denial-of-service vulnerabilities exist in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger these vulnerabilities. - CVE-2020-6080 (denial of service) Multiple exploitable denial-of-service vulnerabilities exist in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger these vulnerabilities. Impact ====== A remote attacker can provide crafted DNS responses to crash the service, disclose data or execute arbitrary code. References ========== https://github.com/videolabs/libmicrodns/releases/tag/0.1.1 https://talosintelligence.com/vulnerability_reports/TALOS-2020-0994 https://github.com/videolabs/libmicrodns/commit/0103f40371cd6e5f034d1ea5674… https://talosintelligence.com/vulnerability_reports/TALOS-2020-0995 https://github.com/videolabs/libmicrodns/commit/219b180c3cea9ad674a5512412f… https://talosintelligence.com/vulnerability_reports/TALOS-2020-0996 https://github.com/videolabs/libmicrodns/commit/f0e8a723ef2d0a7ef9e200a8fd7… https://talosintelligence.com/vulnerability_reports/TALOS-2020-1000 https://github.com/videolabs/libmicrodns/commit/80860fad7e046959b730a0e37fd… https://talosintelligence.com/vulnerability_reports/TALOS-2020-1001 https://github.com/videolabs/libmicrodns/commit/4fb18284bea9a4f5eaf7745d729… https://talosintelligence.com/vulnerability_reports/TALOS-2020-1002 https://github.com/videolabs/libmicrodns/commit/9768bdbeb8ea6b7849a97af4362… https://security.archlinux.org/CVE-2020-6071 https://security.archlinux.org/CVE-2020-6072 https://security.archlinux.org/CVE-2020-6073 https://security.archlinux.org/CVE-2020-6077 https://security.archlinux.org/CVE-2020-6078 https://security.archlinux.org/CVE-2020-6079 https://security.archlinux.org/CVE-2020-6080

1 0