June 2020 - Arch-security - lists.archlinux.org

[ASA-202006-16] tomcat8: denial of service
by Morten Linderud 30 Jun '20

30 Jun '20

Arch Linux Security Advisory ASA-202006-16 ========================================== Severity: Medium Date : 2020-06-28 CVE-ID : CVE-2020-11996 Package : tomcat8 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1197 Summary ======= The package tomcat8 before version 8.5.56-1 is vulnerable to denial of service. Resolution ========== Upgrade to 8.5.56-1. # pacman -Syu "tomcat8>=8.5.56-1" The problem has been fixed upstream in version 8.5.56. Workaround ========== None. Description =========== A denial of service has been found in Apache Tomcat before 9.0.36 and 8.5.56, where a specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. Impact ====== A remote attacker might be able to cause a denial of service via a specially crafted sequence of HTTP/2 requests. References ========== https://www.openwall.com/lists/oss-security/2020/06/25/6 https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.36 https://github.com/apache/tomcat/commit/9a0231683a77e2957cea0fdee88b193b30b… https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.56 https://github.com/apache/tomcat/commit/c8acd2ab7371e39aeca7c306f3b5380f00a… https://security.archlinux.org/CVE-2020-11996

1 0

[ASA-202006-15] freerdp: multiple issues
by Morten Linderud 30 Jun '20

30 Jun '20

Arch Linux Security Advisory ASA-202006-15 ========================================== Severity: High Date : 2020-06-28 CVE-ID : CVE-2020-4030 CVE-2020-4031 CVE-2020-4032 CVE-2020-4033 CVE-2020-11095 CVE-2020-11096 CVE-2020-11097 CVE-2020-11098 CVE-2020-11099 Package : freerdp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1193 Summary ======= The package freerdp before version 2:2.1.2-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2:2.1.2-1. # pacman -Syu "freerdp>=2:2.1.2-1" The problems have been fixed upstream in version 2.1.2. Workaround ========== None. Description =========== - CVE-2020-4030 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, where logging might bypass string length checks due to an integer overflow. - CVE-2020-4031 (arbitrary code execution) A use-after-free vulnerability has been found in FreeRDP before 2.1.2, in gdi_SelectObject(). Clients using compatibility mode enabled with /relax-order-checks are affected. - CVE-2020-4032 (information disclosure) An integer casting vulnerability leading to an out-of-bounds read has been found in FreeRDP before 2.1.2, in update_recv_secondary_order(), on clients with +glyph-cache or /relax-order-checks options enabled. - CVE-2020-4033 (information disclosure) An out-of-bounds read of up to 4 bytes has been found in FreeRDP before 2.1.2, affecting all FreeRDP based clients with sessions with color depth < 32. - CVE-2020-11095 (information disclosure) A global out-of-bounds read has been found in FreeRDP before 2.1.2, in update_recv_primary_order. - CVE-2020-11096 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, in update_read_cache_bitmap_v3_order(). - CVE-2020-11097 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, in ntlm_av_pair_get(). - CVE-2020-11098 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, in glyph_cache_put. This issue only exists when glyph-cache is enabled, which is not the case by default. - CVE-2020-11099 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, in license_read_new_or_upgrade_license_packet(). Impact ====== A remote attacker might be able to access sensitive information or crash the application via a crafted RDP session. A malicious server, or an attacker in position of man-in-the-middle might be able to execute arbitrary code on the affected host. References ========== http://www.freerdp.com/2020/06/22/2_1_2-released https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fjr5-97f5-qq98 https://github.com/FreeRDP/FreeRDP/commit/05cd9ea2290d23931f615c1b004d4b2e6… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74g https://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3898-mc89-x2vc https://github.com/FreeRDP/FreeRDP/commit/e7bffa64ef5ed70bac94f823e2b952626… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7rhj-856w-82p8 https://github.com/FreeRDP/FreeRDP/commit/0a98c450c58ec150e44781c89aa6f8e7e… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-563r-pvh7-4fw2 https://github.com/FreeRDP/FreeRDP/commit/733ee3208306b1ea32697b356c0215180… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mjw7-3mq2-996x https://github.com/FreeRDP/FreeRDP/commit/b8beb55913471952f92770c90c372139d… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c8x2-c3c9-9r3f https://github.com/FreeRDP/FreeRDP/commit/58a3122250d54de3a944c487776bcd4d1… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jr57-f58x-hjmv https://github.com/FreeRDP/FreeRDP/commit/c0fd449ec0870b050d350d6d844b1ea6d… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-977w-866x-4v5h https://github.com/FreeRDP/FreeRDP/commit/6ade7b4cbfd71c54b3d724e8f2d6ac76a… https://security.archlinux.org/CVE-2020-4030 https://security.archlinux.org/CVE-2020-4031 https://security.archlinux.org/CVE-2020-4032 https://security.archlinux.org/CVE-2020-4033 https://security.archlinux.org/CVE-2020-11095 https://security.archlinux.org/CVE-2020-11096 https://security.archlinux.org/CVE-2020-11097 https://security.archlinux.org/CVE-2020-11098 https://security.archlinux.org/CVE-2020-11099

1 0

[ASA-202006-14] imagemagick: information disclosure
by Morten Linderud 30 Jun '20

30 Jun '20

Arch Linux Security Advisory ASA-202006-14 ========================================== Severity: Medium Date : 2020-06-28 CVE-ID : CVE-2020-13902 Package : imagemagick Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1181 Summary ======= The package imagemagick before version 7.0.10.20-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.0.10.20-1. # pacman -Syu "imagemagick>=7.0.10.20-1" The problem has been fixed upstream in version 7.0.10.20. Workaround ========== None. Description =========== An out-of-bounds read has been found in the TIFF image decoding part of imagemagick <= 7.0.10-17, in BlobToStringInfo in MagickCore/string.c. Impact ====== A remote attacker might be able to access sensitive information or crash the application via a crafted TIFF file. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20920 https://github.com/ImageMagick/ImageMagick/discussions/2132 https://github.com/ImageMagick/ImageMagick/commit/824f344ceb823e156ad6e8531… https://security.archlinux.org/CVE-2020-13902

1 0

[ASA-202006-13] bind: denial of service
by Morten Linderud 30 Jun '20

30 Jun '20

Arch Linux Security Advisory ASA-202006-13 ========================================== Severity: Medium Date : 2020-06-28 CVE-ID : CVE-2020-8618 CVE-2020-8619 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1191 Summary ======= The package bind before version 9.16.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.16.4-1. # pacman -Syu "bind>=9.16.4-1" The problems have been fixed upstream in version 9.16.4. Workaround ========== None. Description =========== - CVE-2020-8618 (denial of service) An assertion check in BIND before 9.16.4 (that is meant to prevent going beyond the end of a buffer when processing incoming data) can be incorrectly triggered by a large response during zone transfer. An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients. - CVE-2020-8619 (denial of service) An issue has been found in Bind before 9.16.4, where an asterisk character in an empty non-terminal can cause an assertion failure in rbtdb.c. The asterisk character ("*") is allowed in DNS zone files, where it is most commonly present as a wildcard at a terminal node of the Domain Name System graph. However, the RFCs do not require and BIND does not enforce that an asterisk character be present only at a terminal node. A problem can occur when an asterisk is present in an empty non- terminal location within the DNS graph. If such a node exists, after a series of queries, named can reach an inconsistent state that results in the failure of an assertion check in rbtdb.c, followed by the program exiting due to the assertion failure. Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable. Impact ====== A remote attacker with enough privileges to update a zone might be able to crash a server via a crafted zone transfer or by inserting an asterisk at a terminal node of a zone. References ========== https://downloads.isc.org/isc/bind9/9.16.4/doc/arm/html/notes.html#notes-fo… https://kb.isc.org/docs/cve-2020-8618 https://gitlab.isc.org/isc-projects/bind9/-/issues/1850 https://kb.isc.org/docs/cve-2020-8619 https://gitlab.isc.org/isc-projects/bind9/-/issues/1718 https://gitlab.isc.org/isc-projects/bind9/-/commit/569cc155b8680d8ed12db1fa… https://security.archlinux.org/CVE-2020-8618 https://security.archlinux.org/CVE-2020-8619

1 0

[ASA-202006-12] chromium: arbitrary code execution
by Morten Linderud 30 Jun '20

30 Jun '20

Arch Linux Security Advisory ASA-202006-12 ========================================== Severity: High Date : 2020-06-28 CVE-ID : CVE-2020-6509 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1192 Summary ======= The package chromium before version 83.0.4103.116-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 83.0.4103.116-1. # pacman -Syu "chromium>=83.0.4103.116-1" The problem has been fixed upstream in version 83.0.4103.116. Workaround ========== None. Description =========== A use-after-free vulnerability has been found in the extensions component of chromium before 83.0.4103.116. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/06/stable-channel-update-for-des… https://crbug.com/1092308 https://security.archlinux.org/CVE-2020-6509

1 0

[ASA-202006-11] sqlite: arbitrary code execution
by Morten Linderud 30 Jun '20

30 Jun '20

Arch Linux Security Advisory ASA-202006-11 ========================================== Severity: High Date : 2020-06-28 CVE-ID : CVE-2020-13871 Package : sqlite Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1182 Summary ======= The package sqlite before version 3.32.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.32.3-1. # pacman -Syu "sqlite>=3.32.3-1" The problem has been fixed upstream in version 3.32.3. Workaround ========== None. Description =========== SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late. Impact ====== An attacker might be able to crash the application or execute arbitrary code by running a crafted query. References ========== https://www.sqlite.org/src/info/c8d3b9f0a750a529 https://www.sqlite.org/src/info/cd708fa84d2aaaea https://www.sqlite.org/src/info/44a58d6cb135a104 https://security.archlinux.org/CVE-2020-13871

1 0

[ASA-202006-10] intel-ucode: information disclosure
by Remi Gacogne 16 Jun '20

16 Jun '20

Arch Linux Security Advisory ASA-202006-10 ========================================== Severity: High Date : 2020-06-13 CVE-ID : CVE-2020-0543 CVE-2020-0548 CVE-2020-0549 Package : intel-ucode Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1187 Summary ======= The package intel-ucode before version 20200609-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 20200609-1. # pacman -Syu "intel-ucode>=20200609-1" The problems have been fixed upstream in version 20200609. Workaround ========== None. Description =========== - CVE-2020-0543 (information disclosure) A new domain bypass transient execution attack known as Special Register Buffer Data Sampling (SRBDS) has been found. This flaw allows data values from special internal registers to be leaked by an attacker able to execute code on any core of the CPU. An unprivileged, local attacker can use this flaw to infer values returned by affected instructions known to be commonly used during cryptographic operations that rely on uniqueness, secrecy, or both. - CVE-2020-0548 (information disclosure) A flaw was found in Intel processors where a local attacker is able to gain information about registers used for vector calculations by observing register states from other processes running on the system. This results in a race condition where store buffers, which were not cleared, could be read by another process or a CPU sibling. The highest threat from this vulnerability is data confidentiality where an attacker could read arbitrary data as it passes through the processor. - CVE-2020-0549 (information disclosure) A microarchitectural timing flaw was found on some Intel processors. A corner case exists where data in-flight during the eviction process can end up in the “fill buffers” and not properly cleared by the MDS mitigations. The fill buffer contents (which were expected to be blank) can be inferred using MDS or TAA style attack methods to allow a local attacker to infer fill buffer values. Impact ====== A local unprivileged attacker with access to an affected CPU can read protected memory through a shared buffer on an SGX enclave or CPU core. References ========== https://software.intel.com/security-software-guidance/insights/deep-dive-sp… https://blogs.intel.com/technology/2020/06/ipas-security-advisories-for-jun… https://cacheoutattack.com/CacheOut.pdf https://software.intel.com/security-software-guidance/software-guidance/l1d… https://blogs.intel.com/technology/2020/01/ipas-intel-sa-00329/ https://access.redhat.com/solutions/l1d-cache-eviction-and-vector-register-… https://security.archlinux.org/CVE-2020-0543 https://security.archlinux.org/CVE-2020-0548 https://security.archlinux.org/CVE-2020-0549

1 0

[ASA-202006-9] dbus: denial of service
by Remi Gacogne 16 Jun '20

16 Jun '20

Arch Linux Security Advisory ASA-202006-9 ========================================= Severity: Low Date : 2020-06-13 CVE-ID : CVE-2020-12049 Package : dbus Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1183 Summary ======= The package dbus before version 1.12.18-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.12.18-1. # pacman -Syu "dbus>=1.12.18-1" The problem has been fixed upstream in version 1.12.18. Workaround ========== None. Description =========== An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients. Impact ====== A local attacker might be able to cause a denial of service via crafted DBUS messages. References ========== https://www.openwall.com/lists/oss-security/2020/06/04/3 https://gitlab.freedesktop.org/dbus/dbus/-/issues/294 https://gitlab.freedesktop.org/dbus/dbus/-/commit/872b085f12f56da25a2dbd9bd… https://security.archlinux.org/CVE-2020-12049

1 0

[ASA-202006-8] python-django: multiple issues
by Morten Linderud 09 Jun '20

09 Jun '20

Arch Linux Security Advisory ASA-202006-8 ========================================= Severity: Medium Date : 2020-06-06 CVE-ID : CVE-2020-13254 CVE-2020-13596 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1176 Summary ======= The package python-django before version 3.0.7-1 is vulnerable to multiple issues including cross-site scripting and information disclosure. Resolution ========== Upgrade to 3.0.7-1. # pacman -Syu "python-django>=3.0.7-1" The problems have been fixed upstream in version 3.0.7. Workaround ========== None. Description =========== - CVE-2020-13254 (information disclosure) An information disclosure issue has been found in Django before 3.0.7, via malformed memcached keys. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. In order to avoid this vulnerability, key validation is added to the memcached cache backends. - CVE-2020-13596 (cross-site scripting) A possible XSS has been found in Django before 3.0.7, via admin ForeignKeyRawIdWidget. Query parameters for the admin ForeignKeyRawIdWidget were not properly URL encoded, posing an XSS attack vector. Impact ====== A remote attacker can leak data through malformed cache keys. An authenticated user could execute javascript through an admin widget. References ========== https://www.djangoproject.com/weblog/2020/jun/03/security-releases/ https://github.com/django/django/commit/84b2da5552e100ae3294f564f6c862fef8d… https://github.com/django/django/commit/1f2dd37f6fcefdd10ed44cb233b2e62b520… https://security.archlinux.org/CVE-2020-13254 https://security.archlinux.org/CVE-2020-13596

1 0

[ASA-202006-7] tomcat9: arbitrary code execution
by Morten Linderud 09 Jun '20

09 Jun '20

Arch Linux Security Advisory ASA-202006-7 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-9484 Package : tomcat9 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1171 Summary ======= The package tomcat9 before version 9.0.35-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 9.0.35-1. # pacman -Syu "tomcat9>=9.0.35-1" The problem has been fixed upstream in version 9.0.35. Workaround ========== None. Description =========== When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if: a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. Impact ====== A remote attacker can execute code on the affected host if they control the file content and know the path. References ========== https://lists.apache.org/thread.html/r77eae567ed829da9012cadb29af17f2df8fa2… https://security.archlinux.org/CVE-2020-9484

1 0