July 2020 - Arch-security - lists.archlinux.org

[ASA-202007-6] libjcat: insufficient validation
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-6 ========================================= Severity: High Date : 2020-07-31 CVE-ID : CVE-2020-10759 Package : libjcat Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1185 Summary ======= The package libjcat before version 0.1.3-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 0.1.3-1. # pacman -Syu "libjcat>=0.1.3-1" The problem has been fixed upstream in version 0.1.3. Workaround ========== None. Description =========== A PGP signature verification bypass has been found in fwupd prior to 1.4.0, and in libjcat <= 0.1.2. The issue is that if a detached signature is actually a PGP message, gpgme_op_verify() returns the rather perplexing GPG_ERR_NO_ERROR, and then gpgme_op_verify_result() builds an empty list. Impact ====== A local attacker could pass signature validation with a crafted message. References ========== https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_… https://github.com/hughsie/libjcat/commit/839b89f https://security.archlinux.org/CVE-2020-10759

1 0

[ASA-202007-5] mbedtls: private key recovery
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-5 ========================================= Severity: Medium Date : 2020-07-31 CVE-ID : CVE-2020-10932 Package : mbedtls Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-1141 Summary ======= The package mbedtls before version 2.16.7-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 2.16.7-1. # pacman -Syu "mbedtls>=2.16.7-1" The problem has been fixed upstream in version 2.16.7. Workaround ========== None. Description =========== A side channel attack has been found on the ECDSA implementation of Mbed TLS before 2.22.0, 2.16.6 and 2.7.15, allowing a local attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to fully recover an ECDSA private key after observing a number of signature operations. Impact ====== A remote attacker is able to recover an ECDSA private key. References ========== https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://security.archlinux.org/CVE-2020-10932

1 0

[ASA-202007-4] ffmpeg: arbitrary code execution
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-4 ========================================= Severity: High Date : 2020-07-31 CVE-ID : CVE-2020-13904 Package : ffmpeg Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1180 Summary ======= The package ffmpeg before version 2:4.3.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2:4.3.1-1. # pacman -Syu "ffmpeg>=2:4.3.1-1" The problem has been fixed upstream in version 4.3.1. Workaround ========== None. Description =========== A use-after-free via a crafted EXTINF duration in an m3u8 file has been found in ffmpeg <= 4.2.3, because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c Impact ====== An attacker can execute arbitrary code on the affected host via crafted multimedia content. References ========== https://trac.ffmpeg.org/ticket/8673 https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200529033905.41926-1-lq… https://security.archlinux.org/CVE-2020-13904

1 0

[ASA-202007-3] tcpreplay: information disclosure
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-3 ========================================= Severity: Medium Date : 2020-07-31 CVE-ID : CVE-2020-12740 Package : tcpreplay Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1154 Summary ======= The package tcpreplay before version 4.3.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.3.3-1. # pacman -Syu "tcpreplay>=4.3.3-1" The problem has been fixed upstream in version 4.3.3. Workaround ========== None. Description =========== tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ipv6_next() at common/get.c. Impact ====== A remote attacker is able to disclose information on the affected host with a crafted pcap file. References ========== https://github.com/appneta/tcpreplay/issues/576 https://security.archlinux.org/CVE-2020-12740

1 0

[ASA-202007-2] wireshark-cli: denial of service
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-2 ========================================= Severity: Low Date : 2020-07-18 CVE-ID : CVE-2020-15466 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1198 Summary ======= The package wireshark-cli before version 3.2.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.2.5-1. # pacman -Syu "wireshark-cli>=3.2.5-1" The problem has been fixed upstream in version 3.2.5. Workaround ========== None. Description =========== An infinite loop has been found in the GVCP dissector of Wireshark before 3.2.5. It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able use specially crafted packets to perform a denial of service attack. References ========== https://www.wireshark.org/security/wnpa-sec-2020-09 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16029 https://code.wireshark.org/review/#/c/37618/ https://security.archlinux.org/CVE-2020-15466

1 0

[ASA-202007-1] webkit2gtk: multiple issues
by Morten Linderud 29 Jul '20

29 Jul '20

Arch Linux Security Advisory ASA-202007-1 ========================================= Severity: Critical Date : 2020-07-14 CVE-ID : CVE-2020-9802 CVE-2020-9803 CVE-2020-9805 CVE-2020-9806 CVE-2020-9807 CVE-2020-9843 CVE-2020-9850 CVE-2020-13753 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1203 Summary ======= The package webkit2gtk before version 2.28.3-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting and sandbox escape. Resolution ========== Upgrade to 2.28.3-1. # pacman -Syu "webkit2gtk>=2.28.3-1" The problems have been fixed upstream in version 2.28.3. Workaround ========== None. Description =========== - CVE-2020-9802 (arbitrary code execution) A memory corruption issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-9803 (arbitrary code execution) A memory corruption issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-9805 (cross-site scripting) A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2020-9806 (arbitrary code execution) A memory corruption issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-9807 (arbitrary code execution) A memory corruption issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-9843 (cross-site scripting) An issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to a cross site scripting attack. - CVE-2020-9850 (arbitrary code execution) A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, allowing a remote attacker to execute arbitrary code. - CVE-2020-13753 (sandbox escape) The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal’s input buffer, similar to CVE-2017-5226. Impact ====== A remote attacker might be able to trigger cross-site scripting, bypass the sandbox and execute arbitrary code on the affected host. References ========== https://webkitgtk.org/security/WSA-2020-0006.html https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9802 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9803 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9805 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9806 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9807 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9843 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9850 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-13753 https://security.archlinux.org/CVE-2020-9802 https://security.archlinux.org/CVE-2020-9803 https://security.archlinux.org/CVE-2020-9805 https://security.archlinux.org/CVE-2020-9806 https://security.archlinux.org/CVE-2020-9807 https://security.archlinux.org/CVE-2020-9843 https://security.archlinux.org/CVE-2020-9850 https://security.archlinux.org/CVE-2020-13753

1 0