January 2021 - Arch-security - lists.archlinux.org

[ASA-202101-35] vlc: arbitrary code execution
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-35 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-26664 Package : vlc Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1423 Summary ======= The package vlc before version 3.0.12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.0.12-1. # pacman -Syu "vlc>=3.0.12-1" The problem has been fixed upstream in version 3.0.12. Workaround ========== None. Description =========== A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file. It is fixed in version 3.0.12. Impact ====== A crafted .mkv file can crash or possibly execute arbitrary code. References ========== https://gist.githubusercontent.com/henices/db11664dd45b9f322f8514d182aef5ea… https://code.videolan.org/videolan/vlc-3.0/-/commit/ec1f55ee9ace5cc675395a1… https://security.archlinux.org/CVE-2020-26664

1 0

[ASA-202101-34] gptfdisk: arbitrary code execution
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-34 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2021-0308 Package : gptfdisk Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1435 Summary ======= The package gptfdisk before version 1.0.6-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.0.6-1. # pacman -Syu "gptfdisk>=1.0.6-1" The problem has been fixed upstream in version 1.0.6. Workaround ========== None. Description =========== A security issue was found in GPT fdisk before version 1.0.6. In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. Impact ====== A badly formatted MBR disk could execute arbitrary code. References ========== https://source.android.com/security/bulletin/2021-01-01#system https://android.googlesource.com/platform/external/gptfdisk/+/6d369451868ce…! https://sourceforge.net/p/gptfdisk/code/ci/f523bbc0c2437fe259aa3aff5e819e24… https://security.archlinux.org/CVE-2021-0308

1 0

[ASA-202101-33] linux: directory traversal
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-33 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-28374 Package : linux Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1442 Summary ======= The package linux before version 5.10.7.arch1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 5.10.7.arch1-1. # pacman -Syu "linux>=5.10.7.arch1-1" The problem has been fixed upstream in version 5.10.7.arch1. Workaround ========== None. Description =========== In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Impact ====== An attacker can traverse directories on the system through malicious operations. References ========== https://www.openwall.com/lists/oss-security/2021/01/12/12 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2020-28374

1 0

[ASA-202101-32] linux-hardened: directory traversal
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-32 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-28374 Package : linux-hardened Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1443 Summary ======= The package linux-hardened before version 5.10.7.a-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 5.10.7.a-1. # pacman -Syu "linux-hardened>=5.10.7.a-1" The problem has been fixed upstream in version 5.10.7.a. Workaround ========== None. Description =========== In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Impact ====== An attacker can traverse directories on the system through malicious operations. References ========== https://www.openwall.com/lists/oss-security/2021/01/12/12 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2020-28374

1 0

[ASA-202101-31] linux-zen: directory traversal
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-31 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-28374 Package : linux-zen Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1444 Summary ======= The package linux-zen before version 5.10.7.zen1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 5.10.7.zen1-1. # pacman -Syu "linux-zen>=5.10.7.zen1-1" The problem has been fixed upstream in version 5.10.7.zen1. Workaround ========== None. Description =========== In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Impact ====== An attacker can traverse directories on the system through malicious operations. References ========== https://www.openwall.com/lists/oss-security/2021/01/12/12 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2020-28374

1 0

[ASA-202101-30] linux-lts: directory traversal
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-30 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-28374 Package : linux-lts Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1445 Summary ======= The package linux-lts before version 5.4.89-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 5.4.89-1. # pacman -Syu "linux-lts>=5.4.89-1" The problem has been fixed upstream in version 5.4.89. Workaround ========== None. Description =========== In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Impact ====== An attacker can traverse directories on the system through malicious operations. References ========== https://www.openwall.com/lists/oss-security/2021/01/12/12 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2020-28374

1 0

[ASA-202101-29] lldpd: information disclosure
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-29 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-27827 Package : lldpd Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1451 Summary ======= The package lldpd before version 1.0.8-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.0.8-1. # pacman -Syu "lldpd>=1.0.8-1" The problem has been fixed upstream in version 1.0.8. Workaround ========== None. Description =========== A security issue was found in lldpd before version 1.0.8. A packet that contains multiple instances of certain TLVs will cause lldpd to continually allocate memory and leak the old memory. As an example, multiple instances of system name TLV will cause old values to be dropped by the decoding routine. Impact ====== A remote attack can leak information through crafted packets. References ========== https://github.com/lldpd/lldpd/blob/master/NEWS https://github.com/lldpd/lldpd/commit/a8d3c90feca548fc0656d95b5d278713db86f… https://mail.openvswitch.org/pipermail/ovs-announce/2021-January/000269.html https://github.com/openvswitch/ovs/pull/337 https://github.com/openvswitch/ovs/commit/f915f32f5667e3b9d460055d8b47fa5d2… https://security.archlinux.org/CVE-2020-27827

1 0

[ASA-202101-28] openvswitch: multiple issues
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-28 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2015-8011 CVE-2020-27827 Package : openvswitch Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1456 Summary ======= The package openvswitch before version 2.14.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2.14.1-1. # pacman -Syu "openvswitch>=2.14.1-1" The problems have been fixed upstream in version 2.14.1. Workaround ========== None. Description =========== - CVE-2015-8011 (arbitrary code execution) A buffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries. - CVE-2020-27827 (information disclosure) A security issue was found in lldpd before version 1.0.8. A packet that contains multiple instances of certain TLVs will cause lldpd to continually allocate memory and leak the old memory. As an example, multiple instances of system name TLV will cause old values to be dropped by the decoding routine. Impact ====== A remote attacker can leak information or possibly execute arbitrary code through crafted packets. References ========== https://www.openwall.com/lists/oss-security/2015/10/16/2 https://github.com/lldpd/lldpd/commit/dd4f16e7e816f2165fba76e3d162cd8d2978d… https://mail.openvswitch.org/pipermail/ovs-announce/2021-January/000268.html https://github.com/openvswitch/ovs/pull/335 https://github.com/openvswitch/ovs/commit/ec51fc90669e5fe1a2096581296d55b3a… https://github.com/lldpd/lldpd/blob/master/NEWS https://github.com/lldpd/lldpd/commit/a8d3c90feca548fc0656d95b5d278713db86f… https://mail.openvswitch.org/pipermail/ovs-announce/2021-January/000269.html https://github.com/openvswitch/ovs/pull/337 https://github.com/openvswitch/ovs/commit/f915f32f5667e3b9d460055d8b47fa5d2… https://security.archlinux.org/CVE-2015-8011 https://security.archlinux.org/CVE-2020-27827

1 0

[ASA-202101-27] go: multiple issues
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-27 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2021-3114 CVE-2021-3115 Package : go Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1481 Summary ======= The package go before version 2:1.15.7-1 is vulnerable to multiple issues including arbitrary command execution and incorrect calculation. Resolution ========== Upgrade to 2:1.15.7-1. # pacman -Syu "go>=2:1.15.7-1" The problems have been fixed upstream in version 1.15.7. Workaround ========== None. Description =========== - CVE-2021-3114 (incorrect calculation) A security issue was found in Go and fixed in versions 1.15.7 and 1.14.14. The P224() Curve implementation can in rare circumstances generate incorrect outputs, including returning invalid points from ScalarMult. The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages support P-224 ECDSA keys, but they are not supported by publicly trusted certificate authorities. No other standard library or golang.org/x/crypto package supports or uses the P-224 curve. - CVE-2021-3115 (arbitrary command execution) A security issue was found in Go and fixed in versions 1.15.7 and 1.14.14. The go command may execute arbitrary code at build time when using cgo on Windows. This can be triggered by running go get for a malicious package, or any other time the code is built. This can be triggered by malicious packages which contain specifically named binaries which are executed when cgo is executed in the context of the malicious package directory. This is due to the path lookup behavior of os/exec.LookPath on Windows. This will also affect Unix users who have “.” listed explicitly in their PATH and are running “go get” outside of a module or with module mode disabled. This has been fixed by altering the usage of os/exec.LookPath by the go command to reject the usage of any binaries that reside in the current directory. Impact ====== The handling of P-224 ECDSA keys could produce incorrect outputs, leading to potentially incorrect results of encryption, decryption, or signature verification operations. Downloading a maliciously crafted binary package using "go get" can execute arbitrary code if the user's $PATH explicitly contains the current directory. References ========== https://groups.google.com/g/golang-announce/c/mperVMGa98w/m/yo5W5wnvAAAJ https://github.com/golang/go/issues/43788 https://github.com/golang/go/commit/5c8fd727c41e31273923c32b33d4f25855f4e123 https://blog.golang.org/path-security https://github.com/golang/go/issues/43785 https://github.com/golang/go/commit/e8e7facfaa47bf21007c0a1c679debba52ec3ea0 https://github.com/golang/go/commit/07e3195293ec510171d7d43ec8ac2bcb9cf00df4 https://security.archlinux.org/CVE-2021-3114 https://security.archlinux.org/CVE-2021-3115

1 0

[ASA-202101-26] gobby: denial of service
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-26 ========================================== Severity: Low Date : 2021-01-20 CVE-ID : CVE-2020-35450 Package : gobby Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1383 Summary ======= The package gobby before version 1:0.5.0+116+g295e697-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1:0.5.0+116+g295e697-1. # pacman -Syu "gobby>=1:0.5.0+116+g295e697-1" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set_language calls. Impact ====== A local attacker can crash the application through a crafted dbus message. References ========== https://bugs.archlinux.org/task/69118 https://github.com/gobby/gobby/issues/183 https://github.com/gobby/gobby/pull/184 https://github.com/gobby/gobby/commit/295e697ac83c6638bc7c6f0498534b1227819… https://security.archlinux.org/CVE-2020-35450

1 0