September 2020 - Arch-security - lists.archlinux.org

[ASA-202009-11] podman: information disclosure
by Morten Linderud 30 Sep '20

30 Sep '20

Arch Linux Security Advisory ASA-202009-11 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-14370 Package : podman Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1233 Summary ======= The package podman before version 2.1.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.1.0-1. # pacman -Syu "podman>=2.1.0-1" The problem has been fixed upstream in version 2.1.0. Workaround ========== None. Description =========== A flaw was discovered in Podman before upstream version 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first containers will get leaked into subsequent containers. An attacker who has control over those subsequent containers may get access to secrets shared with previous containers through environment variables. Impact ====== A local privileged user can potentially view secrets in environment variables. References ========== https://github.com/containers/podman/commit/a7e864e6e7de894d4edde4fff00e53d… https://security.archlinux.org/CVE-2020-14370

1 0

[ASA-202009-10] firefox: multiple issues
by Morten Linderud 30 Sep '20

30 Sep '20

Arch Linux Security Advisory ASA-202009-10 ========================================== Severity: High Date : 2020-09-23 CVE-ID : CVE-2020-15673 CVE-2020-15674 CVE-2020-15675 CVE-2020-15676 CVE-2020-15677 CVE-2020-15678 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1235 Summary ======= The package firefox before version 81.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, cross-site scripting and denial of service. Resolution ========== Upgrade to 81.0-1. # pacman -Syu "firefox>=81.0-1" The problems have been fixed upstream in version 81.0. Workaround ========== None. Description =========== - CVE-2020-15673 (arbitrary code execution) Several memory safety issues have been found in Firefox before 81.0 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-15674 (arbitrary code execution) Several memory safety issues have been found in Firefox before 81.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-15675 (arbitrary code execution) A use-after-free issue has been found in the WebGL implementation of Firefox before 81.0 where, when processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. - CVE-2020-15676 (cross-site scripting) Firefox before 81.0 sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a content-editable element. - CVE-2020-15677 (content spoofing) An issue has been found in Firefox before 81.0 where, by exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. - CVE-2020-15678 (denial of service) A use-after-free issue has been found in Firefox before 81.0 where, when recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. Impact ====== A remote attacker might be able to cause a crash, spoof content or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-42 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1648493%2C1660800 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1656063%2C1656064%2C1656067… https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/show_bug.cgi?id=1654211 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/show_bug.cgi?id=1646140 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/show_bug.cgi?id=1641487 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/show_bug.cgi?id=1660211 https://security.archlinux.org/CVE-2020-15673 https://security.archlinux.org/CVE-2020-15674 https://security.archlinux.org/CVE-2020-15675 https://security.archlinux.org/CVE-2020-15676 https://security.archlinux.org/CVE-2020-15677 https://security.archlinux.org/CVE-2020-15678

1 0

[ASA-202009-9] chromium: multiple issues
by Morten Linderud 30 Sep '20

30 Sep '20

Arch Linux Security Advisory ASA-202009-9 ========================================= Severity: High Date : 2020-09-23 CVE-ID : CVE-2020-15960 CVE-2020-15961 CVE-2020-15962 CVE-2020-15963 CVE-2020-15964 CVE-2020-15965 CVE-2020-15966 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1234 Summary ======= The package chromium before version 85.0.4183.121-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, information disclosure and insufficient validation. Resolution ========== Upgrade to 85.0.4183.121-1. # pacman -Syu "chromium>=85.0.4183.121-1" The problems have been fixed upstream in version 85.0.4183.121. Workaround ========== None. Description =========== - CVE-2020-15960 (information disclosure) An out of bounds read security issue has been found in the storage component of the chromium browser before 85.0.4183.121. - CVE-2020-15961 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 85.0.4183.121 - CVE-2020-15962 (access restriction bypass) An insufficient policy enforcement security issue has been found in the serial component of the chromium browser before 85.0.4183.121. - CVE-2020-15963 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 85.0.4183.121. - CVE-2020-15964 (arbitrary code execution) An out of bounds write security issue has been found in the V8 component of the chromium browser before 85.0.4183.121. - CVE-2020-15965 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 85.0.4183.121. - CVE-2020-15966 (insufficient validation) An insufficient data validation security issue has been found in the media component of the chromium browser before 85.0.4183.121. Impact ====== A remote attacker might be able to bypass security restrictions, access sensitive information or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-des… https://crbug.com/1100136 https://crbug.com/1114636 https://crbug.com/1121836 https://crbug.com/1113558 https://crbug.com/1126249 https://crbug.com/1113565 https://crbug.com/1121414 https://security.archlinux.org/CVE-2020-15960 https://security.archlinux.org/CVE-2020-15961 https://security.archlinux.org/CVE-2020-15962 https://security.archlinux.org/CVE-2020-15963 https://security.archlinux.org/CVE-2020-15964 https://security.archlinux.org/CVE-2020-15965 https://security.archlinux.org/CVE-2020-15966

1 0

[ASA-202009-8] libvirt: privilege escalation
by Morten Linderud 30 Sep '20

30 Sep '20

Arch Linux Security Advisory ASA-202009-8 ========================================= Severity: High Date : 2020-09-22 CVE-ID : CVE-2020-14339 Package : libvirt Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1232 Summary ======= The package libvirt before version 6.5.0-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 6.5.0-2. # pacman -Syu "libvirt>=6.5.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== A local user can escalate privileges on the host operating system. References ========== https://bugs.archlinux.org/task/67807 https://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=22494556542c676d1b9e7… https://security.archlinux.org/CVE-2020-14339

1 0

[ASA-202009-7] netbeans: arbitrary code execution
by Morten Linderud 18 Sep '20

18 Sep '20

Arch Linux Security Advisory ASA-202009-7 ========================================= Severity: Critical Date : 2020-09-14 CVE-ID : CVE-2020-11986 Package : netbeans Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1221 Summary ======= The package netbeans before version 12.0_u1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 12.0_u1-1. # pacman -Syu "netbeans>=12.0_u1-1" The problem has been fixed upstream in version 12.0_u1. Workaround ========== None. Description =========== Opening a Gradle project with Apache NetBeans <= 12.0 executes a foreign script immediately. Impact ====== An attacker can trick the user to run code with a malicious gradle project. References ========== https://www.openwall.com/lists/oss-security/2020/09/07/2 https://security.archlinux.org/CVE-2020-11986

1 0

[ASA-202009-6] chromium: multiple issues
by Morten Linderud 18 Sep '20

18 Sep '20

Arch Linux Security Advisory ASA-202009-6 ========================================= Severity: High Date : 2020-09-09 CVE-ID : CVE-2020-6573 CVE-2020-6574 CVE-2020-6575 CVE-2020-6576 CVE-2020-6579 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1225 Summary ======= The package chromium before version 85.0.4183.102-1 is vulnerable to multiple issues including access restriction bypass and arbitrary code execution. Resolution ========== Upgrade to 85.0.4183.102-1. # pacman -Syu "chromium>=85.0.4183.102-1" The problems have been fixed upstream in version 85.0.4183.102. Workaround ========== None. Description =========== - CVE-2020-6573 (arbitrary code execution) A use after free security issue has been found in the video component of the chromium browser before 85.0.4183.102. - CVE-2020-6574 (access restriction bypass) An insufficient policy enforcement security issue has been found in the installer component of the chromium browser before 85.0.4183.102. - CVE-2020-6575 (access restriction bypass) A race security issue has been found in the Mojo component of the chromium browser before 85.0.4183.102. - CVE-2020-6576 (arbitrary code execution) A use after free security issue has been found in the offscreen canvas component of the chromium browser before 85.0.4183.102. - CVE-2020-6579 (access restriction bypass) An insufficient policy enforcement security issue has been found in the networking component of the chromium browser before 85.0.4183.102. Impact ====== A remote attacker might be able to bypass security measures or execute arbitrary code. References ========== https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-des… https://crbug.com/1116304 https://crbug.com/1102196 https://crbug.com/1081874 https://crbug.com/1111737 https://crbug.com/1122684 https://security.archlinux.org/CVE-2020-6573 https://security.archlinux.org/CVE-2020-6574 https://security.archlinux.org/CVE-2020-6575 https://security.archlinux.org/CVE-2020-6576 https://security.archlinux.org/CVE-2020-6579

1 0

[ASA-202009-5] gnupg: arbitrary code execution
by Morten Linderud 10 Sep '20

10 Sep '20

Arch Linux Security Advisory ASA-202009-5 ========================================= Severity: Critical Date : 2020-09-07 CVE-ID : CVE-2020-25125 Package : gnupg Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1218 Summary ======= The package gnupg before version 2.2.23-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.2.23-1. # pacman -Syu "gnupg>=2.2.23-1" The problem has been fixed upstream in version 2.2.23. Workaround ========== None. Description =========== Importing an OpenPGP key having a preference list for AEAD algorithms will lead to an array overflow and thus often to a crash or other undefined behaviour. Importing an arbitrary key can often easily be triggered by an attacker and thus triggering this bug. Exploiting the bug aside from crashes is not trivial but likely possible for a dedicated attacker. The major hurdle for an attacker is that only every second byte is under their control with every first byte having a fixed value of 0x04. Software distribution verification should not be affected by this bug because such a system uses a curated list of keys. Impact ====== A remote attacker might be able to execute arbitrary code by tricking a legitimate user into importing a crafted OpenPGP key. References ========== https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html https://dev.gnupg.org/T5050 https://security.archlinux.org/CVE-2020-25125

1 0

[ASA-202009-4] python-django: multiple issues
by Morten Linderud 10 Sep '20

10 Sep '20

Arch Linux Security Advisory ASA-202009-4 ========================================= Severity: Medium Date : 2020-09-03 CVE-ID : CVE-2020-24583 CVE-2020-24584 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1217 Summary ======= The package python-django before version 3.1.1-1 is vulnerable to multiple issues including access restriction bypass and insufficient validation. Resolution ========== Upgrade to 3.1.1-1. # pacman -Syu "python-django>=3.1.1-1" The problems have been fixed upstream in version 3.1.1. Workaround ========== None. Description =========== - CVE-2020-24583 (access restriction bypass) An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate- level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command. - CVE-2020-24584 (insufficient validation) An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077. Impact ====== A remote attacker is able to upload and overwrite files. References ========== https://bugs.archlinux.org/task/67794 https://www.djangoproject.com/weblog/2020/sep/01/security-releases/ https://github.com/django/django/commit/934430d22aa5d90c2ba33495ff69a6a1d99… https://github.com/django/django/commit/2b099caa5923afa8cfb5f1e8c0d56b6e0e8… https://security.archlinux.org/CVE-2020-24583 https://security.archlinux.org/CVE-2020-24584

1 0

[ASA-202009-3] go: cross-site scripting
by Morten Linderud 10 Sep '20

10 Sep '20

Arch Linux Security Advisory ASA-202009-3 ========================================= Severity: Medium Date : 2020-09-03 CVE-ID : CVE-2020-24553 Package : go Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1215 Summary ======= The package go before version 1.15.1-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.15.1-1. # pacman -Syu "go>=1.15.1-1" The problem has been fixed upstream in version 1.15.1. Workaround ========== None. Description =========== In Go versions before 1.15.1 and 1.14.8 if the Content-Type header of a Handler was not explicitly set the net/http/cgi and net/http/fcgi packages would default to “text/html”, which could cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response. Impact ====== A remote attacker is able to execute javascript or create html content by sending specially crafted web content. References ========== https://github.com/golang/go/issues/40928 https://www.redteam-pentesting.de/advisories/rt-sa-2020-004 https://groups.google.com/g/golang-announce/c/8wqlSbkLdPs/m/UccMwBPUBAAJ https://github.com/golang/go/commit/eb07103a083237414145a45f029c873d57037e06 https://security.archlinux.org/CVE-2020-24553

1 0

[ASA-202009-2] ark: arbitrary filesystem access
by Morten Linderud 10 Sep '20

10 Sep '20

Arch Linux Security Advisory ASA-202009-2 ========================================= Severity: High Date : 2020-09-03 CVE-ID : CVE-2020-24654 Package : ark Type : arbitrary filesystem access Remote : No Link : https://security.archlinux.org/AVG-1216 Summary ======= The package ark before version 20.08.0-2 is vulnerable to arbitrary filesystem access. Resolution ========== Upgrade to 20.08.0-2. # pacman -Syu "ark>=20.08.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory. Impact ====== An attacker can overwrite local files by tricking a legitimate user into extracting a specially crafted TAR archive. References ========== https://kde.org/info/security/advisory-20200827-1.txt https://invent.kde.org/utilities/ark/-/commit/8bf8c5ef07b0ac5e914d752681e47… https://security.archlinux.org/CVE-2020-24654

1 0