January 2021 - Arch-security - lists.archlinux.org

[ASA-202101-45] libgcrypt: arbitrary code execution
by Levente Polyak 29 Jan '21

29 Jan '21

Arch Linux Security Advisory ASA-202101-45 ========================================== Severity: Critical Date : 2021-01-29 CVE-ID : CVE-2021-3345 Package : libgcrypt Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1505 Summary ======= The package libgcrypt before version 1.9.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.9.1-1. # pacman -Syu "libgcrypt>=1.9.1-1" The problem has been fixed upstream in version 1.9.1. Workaround ========== None. Description =========== _gcry_md_block_write in cipher/hash-common.c in libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets a large count value. Just decrypting some data can overflow a heap buffer with attacker controlled data, no verification or signature is validated before the vulnerability occurs. The issue is fixed in version 1.9.1. Impact ====== An attacker is able to execute arbitrary code on the affected host before a given signature has been verified. References ========== https://lists.gnupg.org/pipermail/gnupg-announce/2021q1/000456.html https://dev.gnupg.org/T5275 https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=512… https://security.archlinux.org/CVE-2021-3345

1 0

[ASA-202101-44] home-assistant: information disclosure
by Morten Linderud 29 Jan '21

29 Jan '21

Arch Linux Security Advisory ASA-202101-44 ========================================== Severity: Medium Date : 2021-01-29 CVE-ID : CVE-2021-3152 Package : home-assistant Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1488 Summary ======= The package home-assistant before version 2021.1.4-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2021.1.4-1. # pacman -Syu "home-assistant>=2021.1.4-1" The problem has been fixed upstream in version 2021.1.4. Workaround ========== The issue can be mitigated by disabling all custom integrations. This is achieved by renaming the custom_components folder inside the Home Assistant configuration folder to something else and restarting Home Assistant. Description =========== Home Assistant before 2021.1.3 allows attackers to obtain sensitive information because custom integrations with ../ are mishandled leading to directory-traversal. Impact ====== Some integrations could allow malicious users to read sensitive information. References ========== https://bugs.archlinux.org/task/69398 https://www.home-assistant.io/blog/2021/01/14/security-bulletin/ https://security.archlinux.org/CVE-2021-3152

1 0

[ASA-202101-43] mutt: denial of service
by Morten Linderud 29 Jan '21

29 Jan '21

Arch Linux Security Advisory ASA-202101-43 ========================================== Severity: Low Date : 2021-01-29 CVE-ID : CVE-2021-3181 Package : mutt Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1476 Summary ======= The package mutt before version 2.0.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.0.5-1. # pacman -Syu "mutt>=2.0.5-1" The problem has been fixed upstream in version 2.0.5. Workaround ========== None. Description =========== rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields (aka terminators of empty groups). A small email message from the attacker can cause large memory consumption, and the victim may then be unable to see email messages from other persons. Impact ====== A malicious user could send a malformed email that would crash the application. References ========== https://www.openwall.com/lists/oss-security/2021/01/17/2 https://gitlab.com/muttmua/mutt/-/issues/323 https://gitlab.com/muttmua/mutt/uploads/ecd287245a2d0ac0108797eab2f1a224/rf… https://gitlab.com/muttmua/mutt/-/commit/4a2becbdb4422aaffe3ce314991b9d670b… https://security.archlinux.org/CVE-2021-3181

1 0

[ASA-202101-42] libvirt: arbitrary code execution
by Morten Linderud 29 Jan '21

29 Jan '21

Arch Linux Security Advisory ASA-202101-42 ========================================== Severity: Critical Date : 2021-01-29 CVE-ID : CVE-2020-25637 Package : libvirt Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1240 Summary ======= The package libvirt before version 1:7.0.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:7.0.0-1. # pacman -Syu "libvirt>=1:7.0.0-1" The problem has been fixed upstream in version 7.0.0. Workaround ========== None. Description =========== A double free memory issue was found to occur in the libvirt API responsible for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit access control driver. Specifically, clients connecting to the read-write socket with limited ACL permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or potentially escalate their privileges on the system. Impact ====== A malicious user could query the API in a way that could result in a code execution flaw. References ========== https://www.openwall.com/lists/oss-security/2020/10/02/1 https://libvirt.org/git/?p=libvirt.git;a=commit;h=955029bd0ad7ef96000f529ac… https://libvirt.org/git/?p=libvirt.git;a=commit;h=50864dcda191eb35732dbd80f… https://libvirt.org/git/?p=libvirt.git;a=commit;h=e4116eaa44cb366b59f7fe98f… https://libvirt.org/git/?p=libvirt.git;a=commit;h=a63b48c5ecef077bf0f909a85… https://security.archlinux.org/CVE-2020-25637

1 0

[ASA-202101-41] jenkins: multiple issues
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-41 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2021-21602 CVE-2021-21603 CVE-2021-21604 CVE-2021-21605 CVE-2021-21606 CVE-2021-21607 CVE-2021-21608 CVE-2021-21609 CVE-2021-21610 CVE-2021-21611 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1446 Summary ======= The package jenkins before version 2.275-1 is vulnerable to multiple issues including cross-site scripting, directory traversal, incorrect calculation, arbitrary filesystem access, denial of service, information disclosure and insufficient validation. Resolution ========== Upgrade to 2.275-1. # pacman -Syu "jenkins>=2.275-1" The problems have been fixed upstream in version 2.275. Workaround ========== None. Description =========== - CVE-2021-21602 (arbitrary filesystem access) A security issue was found in Jenkins before version 2.275. The file browser for workspaces, archived artifacts, and $JENKINS_HOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier. This allows attackers with Job/Workspace permission and the ability to control workspace contents (e.g., with Job/Configure permission or the ability to change SCM contents) to create symbolic links that allow them to access files outside workspaces using the workspace browser. - CVE-2021-21603 (cross-site scripting) Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents (typically shown after form submissions via Apply button). This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to influence notification bar contents. Jenkins 2.275, LTS 2.263.2 escapes the content shown in notification bars. - CVE-2021-21604 (incorrect calculation) Jenkins provides XML REST APIs to configure views, jobs, and other items. When deserialization fails because of invalid data, Jenkins 2.274 and earlier, LTS 2.263.1 and earlier stores invalid object references created through these endpoints in the Old Data Monitor. If an administrator discards the old data, some erroneous data submitted to these endpoints may be persisted. This allows attackers with View/Create, Job/Create, Agent/Create, or their respective */Configure permissions to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects when discarded by an administrator. Jenkins 2.275, LTS 2.263.2 does not record submissions from users in Old Data Monitor anymore. - CVE-2021-21605 (directory traversal) Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override unrelated config.xml files. If the global config.xml file is replaced, Jenkins will start up with unsafe legacy defaults after a restart. Jenkins 2.275, LTS 2.263.2 ensures that agent names are considered valid names for items to prevent this problem. - CVE-2021-21606 (information disclosure) Jenkins provides a feature for jobs to store and track fingerprints of files used during a build. Jenkins 2.274 and earlier, LTS 2.263.1 and earlier provides a REST API to check where a given fingerprint was used by which builds. This endpoint does not fully validate that the provided fingerprint ID is properly formatted before checking for the XML metadata for that fingerprint on the controller file system. This allows attackers with Overall/Read permission to check for the existence of XML files on the controller file system where the relative path can be constructed as 32 characters. Jenkins 2.275, LTS 2.263.2 validates that a fingerprint ID is properly formatted before checking for its existence. - CVE-2021-21607 (denial of service) Jenkins renders several different graphs for features like agent and label usage statistics, memory usage, or various plugin-provided statistics. Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit the graph size provided as query parameters. This allows attackers to request or to have legitimate Jenkins users request crafted URLs that rapidly use all available memory in Jenkins, potentially leading to out of memory errors. Jenkins 2.275, LTS 2.263.2 limits the maximum size of graphs to an area of 10 million pixels. If a larger size is requested, the default size for the graph will be rendered instead. - CVE-2021-21608 (cross-site scripting) Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI. This results in a cross-site scripting vulnerability exploitable by attackers with the ability to control button labels. An example of buttons with a user-controlled label are the buttons of the Pipeline input step. Jenkins 2.275, LTS 2.263.2 escapes button labels in the Jenkins UI. - CVE-2021-21609 (insufficient validation) Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check. Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with that list. This allows attackers without Overall/Read permission to access plugin-provided URLs with any of the following prefixes if no other permissions are required: accessDenied, error, instance-identity, login, logout, oops, securityRealm, signup and tcpSlaveAgentListener. For example, a plugin contributing the path loginFoo/ would have URLs in that space accessible without the default Overall/Read permission check. The Jenkins security team is not aware of any affected plugins as of the publication of this advisory. The comparison of requested URLs with the list of always accessible URLs has been fixed to only allow access to the specific listed URLs in Jenkins 2.275, LTS 2.263.2. - CVE-2021-21610 (cross-site scripting) Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered. Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering the formatted preview of markup passed as a query parameter. This results in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup, like Anything Goes Formatter Plugin. Jenkins 2.275, LTS 2.263.2 requires that preview URLs are accessed using POST and sets Content-Security-Policy headers that prevent execution of unsafe elements when the URL is accessed directly. - CVE-2021-21611 (cross-site scripting) Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types. Jenkins 2.275, LTS 2.263.2 escapes display names and IDs of item types shown on the New Item page. Impact ====== An attacker can access sensitive information, influence the contents of varios display items, instantiate unsafe objects, override configuration files, perform a denial of service, execute unsafe elements. References ========== https://www.jenkins.io/security/advisory/2021-01-13/ https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452 https://github.com/jenkinsci/jenkins/commit/71d2ecf1a4e5303e80815eaa3935c4f… https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1889 https://github.com/jenkinsci/jenkins/commit/f5d98421604e44f398e7de9d222b191… https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1923 https://github.com/jenkinsci/jenkins/commit/f1056bd814fc1f19ea241a101d649b8… https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2021 https://github.com/jenkinsci/jenkins/commit/b19b34db4b24b163d4edc53ccb84f41… https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2023 https://github.com/jenkinsci/jenkins/commit/f576b2eb4375f2bb076ce477cee27a9… https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2025 https://github.com/jenkinsci/jenkins/commit/a890d68699ad6ca0c8fbc297a1d4b7e… https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2035 https://github.com/jenkinsci/jenkins/commit/8c451b08886561a914ef0c30cbb9d40… https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2047 https://github.com/jenkinsci/jenkins/commit/fe9091fc74d55a56fd36544f3038d47… https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2153 https://github.com/jenkinsci/jenkins/commit/89ec0c40b68cd1e4e9f9ef5ebcafd87… https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2171 https://security.archlinux.org/CVE-2021-21602 https://security.archlinux.org/CVE-2021-21603 https://security.archlinux.org/CVE-2021-21604 https://security.archlinux.org/CVE-2021-21605 https://security.archlinux.org/CVE-2021-21606 https://security.archlinux.org/CVE-2021-21607 https://security.archlinux.org/CVE-2021-21608 https://security.archlinux.org/CVE-2021-21609 https://security.archlinux.org/CVE-2021-21610 https://security.archlinux.org/CVE-2021-21611

1 0

[ASA-202101-40] flatpak: sandbox escape
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-40 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2021-21261 Package : flatpak Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-1454 Summary ======= The package flatpak before version 1.10.0-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 1.10.0-1. # pacman -Syu "flatpak>=1.10.0-1" The problem has been fixed upstream in version 1.10.0. Workaround ========== None. Description =========== A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before the fixed versions 1.8.5 and 1.10.0. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance, either with the same security settings as the caller or with more restrictive security settings. For example, this is used in Flatpak-packaged web browsers such as Chromium to launch subprocesses that will process untrusted web content, and give those subprocesses a more restrictive sandbox than the browser itself. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non- sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. As a workaround, this vulnerability can be mitigated by preventing the `flatpak-portal` service from starting, but that mitigation will prevent many Flatpak apps from working correctly. This is fixed in versions 1.8.5 and 1.10.0. Impact ====== A malicious application could execute arbitrary code on the host. References ========== https://github.com/flatpak/flatpak/security/advisories/GHSA-4ppf-fxf6-vxg2 https://github.com/flatpak/flatpak/commit/6d1773d2a54dde9b099043f07a2094a4f… https://github.com/flatpak/flatpak/commit/821249844bbb7e52cbf4508b4de18c05e… https://github.com/flatpak/flatpak/commit/6e5ae7a109cdfa9735ea7ccbd8cb79f9e… https://github.com/flatpak/flatpak/commit/aeb6a7ab0abaac4a8f4ad98b3df476d9d… https://github.com/flatpak/flatpak/commit/39a5621e6941b9d27bf89b63e8fb6cad6… https://github.com/flatpak/flatpak/commit/cc1401043c075268ecc652eac557ef807… https://github.com/flatpak/flatpak/commit/d19f6c330aa42e17df6dc36d12b6f4dfa… https://security.archlinux.org/CVE-2021-21261

1 0

[ASA-202101-39] erlang: certificate verification bypass
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-39 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2020-35733 Package : erlang Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-1457 Summary ======= The package erlang before version 23.2.2-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 23.2.2-1. # pacman -Syu "erlang>=23.2.2-1" The problem has been fixed upstream in version 23.2.2. Workaround ========== None. Description =========== An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority. Impact ====== The library would accept invalid certificates. References ========== https://erlang.org/pipermail/erlang-questions/2021-January/100357.html https://github.com/erlang/otp/commit/a59f3c4d2be19343f43c46241d0f4e30dd5563… https://security.archlinux.org/CVE-2020-35733

1 0

[ASA-202101-38] dnsmasq: multiple issues
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-38 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 CVE-2020-25687 Package : dnsmasq Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1470 Summary ======= The package dnsmasq before version 2.83-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and insufficient validation. Resolution ========== Upgrade to 2.83-1. # pacman -Syu "dnsmasq>=2.83-1" The problems have been fixed upstream in version 2.83. Workaround ========== None. Description =========== - CVE-2020-25681 (arbitrary code execution) A heap-based buffer overflow was discovered in dnsmasq before version 2.83 in the way it sorts RRSets before validating them with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. - CVE-2020-25682 (arbitrary code execution) A buffer overflow vulnerability was discovered in the way dnsmasq before version 2.83 extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths it is possible extract_name() gets passed an offset from the base buffer, thus reducing in practice the number of available bytes that can be written in the buffer. - CVE-2020-25683 (denial of service) A heap-based buffer overflow was discovered in dnsmasq before version 2.83 when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a Denial of Service. - CVE-2020-25684 (insufficient validation) A flaw was found when getting a reply from a forwarded query, where dnsmasq before version 2.83 checks in forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. - CVE-2020-25685 (insufficient validation) When getting a reply from a forwarded query, dnsmasq before version 2.83 checks in forward.c:reply_query() which one is the forwarded query that matches the reply by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) an off-path attacker can find several different domains all having the same hash, substantially reducing the number of attempts he would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. - CVE-2020-25686 (insufficient validation) A flaw was found when receiving a query, where dnsmasq before version 2.83 does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that would have to be performed to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. - CVE-2020-25687 (denial of service) A heap-based buffer overflow was discovered in dnsmasq before version 2.83 when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of Service. Impact ====== A remote attacker can execute arbitrary code, bypass validation and crash the application through crafted DNS responses. References ========== https://www.openwall.com/lists/oss-security/2021/01/19/1 https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html https://www.jsof-tech.com/disclosures/dnspooq/ https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=4e96a4be685c… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=257ac0c5f773… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=2d765867c597… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=2024f9729713… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=15b60ddf935a… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=6a6e06fbb0d4… https://security.archlinux.org/CVE-2020-25681 https://security.archlinux.org/CVE-2020-25682 https://security.archlinux.org/CVE-2020-25683 https://security.archlinux.org/CVE-2020-25684 https://security.archlinux.org/CVE-2020-25685 https://security.archlinux.org/CVE-2020-25686 https://security.archlinux.org/CVE-2020-25687

1 0

[ASA-202101-37] virtualbox: multiple issues
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-37 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2021-2073 CVE-2021-2074 CVE-2021-2086 CVE-2021-2111 CVE-2021-2112 CVE-2021-2119 CVE-2021-2120 CVE-2021-2121 CVE-2021-2123 CVE-2021-2124 CVE-2021-2125 CVE-2021-2126 CVE-2021-2127 CVE-2021-2128 CVE-2021-2129 CVE-2021-2130 CVE-2021-2131 Package : virtualbox Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1483 Summary ======= The package virtualbox before version 6.1.18-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation, denial of service and information disclosure. Resolution ========== Upgrade to 6.1.18-1. # pacman -Syu "virtualbox>=6.1.18-1" The problems have been fixed upstream in version 6.1.18. Workaround ========== None. Description =========== - CVE-2021-2073 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2074 (arbitrary code execution) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2021-2086 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2111 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2112 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2119 (information disclosure) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2021-2120 (information disclosure) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2021-2121 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2123 (information disclosure) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2021-2124 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2125 (insufficient validation) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2021-2126 (insufficient validation) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. - CVE-2021-2127 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2128 (information disclosure) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2021-2129 (insufficient validation) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2021-2130 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2131 (insufficient validation) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. Impact ====== Some exploit might crash the application or bypass authorization for resource modification. References ========== https://www.oracle.com/security-alerts/cpujan2021verbose.html#OVIR https://security.archlinux.org/CVE-2021-2073 https://security.archlinux.org/CVE-2021-2074 https://security.archlinux.org/CVE-2021-2086 https://security.archlinux.org/CVE-2021-2111 https://security.archlinux.org/CVE-2021-2112 https://security.archlinux.org/CVE-2021-2119 https://security.archlinux.org/CVE-2021-2120 https://security.archlinux.org/CVE-2021-2121 https://security.archlinux.org/CVE-2021-2123 https://security.archlinux.org/CVE-2021-2124 https://security.archlinux.org/CVE-2021-2125 https://security.archlinux.org/CVE-2021-2126 https://security.archlinux.org/CVE-2021-2127 https://security.archlinux.org/CVE-2021-2128 https://security.archlinux.org/CVE-2021-2129 https://security.archlinux.org/CVE-2021-2130 https://security.archlinux.org/CVE-2021-2131

1 0

[ASA-202101-36] podofo: multiple issues
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-36 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2017-8054 CVE-2018-5783 CVE-2018-11254 CVE-2018-11255 CVE-2018-11256 CVE-2018-12982 CVE-2018-14320 CVE-2018-19532 CVE-2018-20751 CVE-2019-9199 CVE-2019-9687 Package : podofo Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-867 Summary ======= The package podofo before version 0.9.7-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.9.7-1. # pacman -Syu "podofo>=0.9.7-1" The problems have been fixed upstream in version 0.9.7. Workaround ========== None. Description =========== - CVE-2017-8054 (denial of service) The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-5783 (denial of service) In PoDoFo 0.9.6, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-11254 (denial of service) An issue was discovered in PoDoFo 0.9.6. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of PdfPagesTree.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file, a related issue to CVE-2017-8054. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-11255 (denial of service) An issue was discovered in PoDoFo 0.9.6. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-11256 (denial of service) An issue was discovered in PoDoFo 0.9.6. The function PdfDocument::Append() in PdfDocument.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-12982 (denial of service) An invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-14320 (arbitrary code execution) This vulnerability in PoDoFo 0.9.6 allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within PdfEncoding::ParseToUnicode. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-19532 (denial of service) A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, as demonstrated by podofoimpose. It allows an attacker to cause Denial of Service. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-20751 (denial of service) An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be problematic due to the function GetObject() being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which causes a NULL pointer dereference. The issue is fixed in PoDoFo version 0.9.7. - CVE-2019-9199 (denial of service) PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. The issue is fixed in PoDoFo version 0.9.7. - CVE-2019-9687 (arbitrary code execution) PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp. The issue is fixed in PoDoFo version 0.9.7. Impact ====== A maliciously crafted PDF file can crash the application or execute arbitrary code. References ========== https://bugs.archlinux.org/task/61651 https://qwertwwwe.github.io/2017/04/22/PoDoFo-0-9-5-allows-remote-attackers… https://sourceforge.net/p/podofo/code/1941/ https://sourceforge.net/p/podofo/tickets/4/ https://sourceforge.net/p/podofo/code/1949/ https://bugzilla.redhat.com/show_bug.cgi?id=1576174 https://sourceforge.net/p/podofo/tickets/20/ https://bugzilla.redhat.com/show_bug.cgi?id=1575502 https://bugzilla.redhat.com/attachment.cgi?id=1432515 https://sourceforge.net/p/podofo/code/1952/ https://bugzilla.redhat.com/show_bug.cgi?id=1575851 https://sourceforge.net/p/podofo/code/1938/ https://sourceforge.net/p/podofo/tickets/22/ https://bugzilla.redhat.com/show_bug.cgi?id=1595689 https://bugzilla.redhat.com/attachment.cgi?id=1455023 https://sourceforge.net/p/podofo/code/1948/ https://zerodayinitiative.com/advisories/ZDI-18-1046 https://sourceforge.net/p/podofo/code/1953/ https://research.loginsoft.com/vulnerability/null-pointer-dereference-vulne… https://sourceforge.net/p/podofo/tickets/32/ https://sourceforge.net/p/podofo/code/1950/ https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-… https://sourceforge.net/p/podofo/tickets/33/ https://sourceforge.net/p/podofo/code/1954/ https://research.loginsoft.com/vulnerability/null-pointer-dereference-vulne… https://sourceforge.net/p/podofo/tickets/40/ https://sourceforge.net/p/podofo/code/1971/ https://sourceforge.net/p/podofo/mailman/podofo-users/thread/CAD3bFv0VMb1DH… https://sourceforge.net/p/podofo/code/1969/ https://security.archlinux.org/CVE-2017-8054 https://security.archlinux.org/CVE-2018-5783 https://security.archlinux.org/CVE-2018-11254 https://security.archlinux.org/CVE-2018-11255 https://security.archlinux.org/CVE-2018-11256 https://security.archlinux.org/CVE-2018-12982 https://security.archlinux.org/CVE-2018-14320 https://security.archlinux.org/CVE-2018-19532 https://security.archlinux.org/CVE-2018-20751 https://security.archlinux.org/CVE-2019-9199 https://security.archlinux.org/CVE-2019-9687

1 0