January 2021 - Arch-security - lists.archlinux.org

[ASA-202101-25] sudo: multiple issues
by Morten Linderud 26 Jan '21

26 Jan '21

Arch Linux Security Advisory ASA-202101-25 ========================================== Severity: Critical Date : 2021-01-20 CVE-ID : CVE-2021-3156 CVE-2021-23239 Package : sudo Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1431 Summary ======= The package sudo before version 1.9.5.p2-1 is vulnerable to multiple issues including privilege escalation and information disclosure. Resolution ========== Upgrade to 1.9.5.p2-1. # pacman -Syu "sudo>=1.9.5.p2-1" The problems have been fixed upstream in version 1.9.5.p2. Workaround ========== None. Description =========== - CVE-2021-3156 (privilege escalation) A serious heap-based buffer overflow has been discovered in sudo before version 1.9.5p2 that is exploitable by any local user. It has been given the name Baron Samedit by its discoverer. The bug can be leveraged to elevate privileges to root, even if the user is not listed in the sudoers file. User authentication is not required to exploit the bug. - CVE-2021-23239 (information disclosure) A security issue was found in sudo before version 1.9.5. A race condition in sudoedit could have allowed an attacker to test for the existence of directories in arbitrary locations in the file system. Impact ====== Any unprivileged user can escalate privileges, and a local attacker could figure out file locations through a race condition. References ========== https://www.openwall.com/lists/oss-security/2021/01/11/2 https://www.sudo.ws/alerts/unescape_overflow.html https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-h… https://www.openwall.com/lists/oss-security/2021/01/26/3 https://www.sudo.ws/repos/sudo/rev/9b97f1787804 https://www.sudo.ws/repos/sudo/rev/a97dc92eae6b https://www.sudo.ws/repos/sudo/rev/049ad90590be https://www.sudo.ws/repos/sudo/rev/09f98816fc89 https://www.sudo.ws/repos/sudo/rev/c125fbe68783 https://www.sudo.ws/repos/sudo/rev/ea19d0073c02 https://security.archlinux.org/CVE-2021-3156 https://security.archlinux.org/CVE-2021-23239

1 0

[ASA-202101-24] atftp: denial of service
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-24 ========================================== Severity: Medium Date : 2021-01-12 CVE-ID : CVE-2020-6097 Package : atftp Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1395 Summary ======= The package atftp before version 0.7.2-3 is vulnerable to denial of service. Resolution ========== Upgrade to 0.7.2-3. # pacman -Syu "atftp>=0.7.2-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.2. A specially crafted sequence of RRQ-Multicast requests trigger an assert() call resulting in denial-of- service. An attacker can send a sequence of malicious packets to trigger this vulnerability. Impact ====== A malicious remote user might crash the application by performing a sequence of crafted queries. References ========== https://bugs.archlinux.org/task/69175 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029 https://sourceforge.net/u/peterkaestle/atftp/ci/96409ef3b9ca061f9527cfaafa7… https://security.archlinux.org/CVE-2020-6097

1 0

[ASA-202101-23] wavpack: arbitrary code execution
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-23 ========================================== Severity: Medium Date : 2021-01-12 CVE-ID : CVE-2020-35738 Package : wavpack Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1387 Summary ======= The package wavpack before version 5.3.0-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.0-2. # pacman -Syu "wavpack>=5.3.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. Impact ====== A local user might execute arbitrary code through a crafted file. References ========== https://bugs.archlinux.org/task/69234 https://github.com/dbry/WavPack/issues/91 https://github.com/dbry/WavPack/files/5745022/crash.wav.tar.gz https://github.com/dbry/WavPack/commit/63f3ec70129843dd64e11aa4c21c4a1cf00c… https://github.com/dbry/WavPack/commit/89df160596132e3bd666322e1c20b2ebd4b9… https://security.archlinux.org/CVE-2020-35738

1 0

[ASA-202101-22] mediawiki: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-22 ========================================== Severity: Medium Date : 2021-01-12 CVE-ID : CVE-2020-35474 CVE-2020-35475 CVE-2020-35477 CVE-2020-35478 CVE-2020-35479 CVE-2020-35480 Package : mediawiki Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1371 Summary ======= The package mediawiki before version 1.35.1-1 is vulnerable to multiple issues including cross-site scripting and information disclosure. Resolution ========== Upgrade to 1.35.1-1. # pacman -Syu "mediawiki>=1.35.1-1" The problems have been fixed upstream in version 1.35.1. Workaround ========== None. Description =========== - CVE-2020-35474 (cross-site scripting) In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki so that the output is raw HTML. - CVE-2020-35475 (cross-site scripting) In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.) - CVE-2020-35477 (information disclosure) MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a revision-deletion form appears). - CVE-2020-35478 (cross-site scripting) MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later. - CVE-2020-35479 (cross-site scripting) MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later. - CVE-2020-35480 (information disclosure) An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths. Impact ====== A malicious remote user might execute code in the browser or disclose sensitive information. References ========== https://bugs.archlinux.org/task/69132 https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/0002… https://phabricator.wikimedia.org/T268894 https://github.com/wikimedia/mediawiki/commit/a8b1d863bccc6b326329d0593f812… https://phabricator.wikimedia.org/T268917 https://github.com/wikimedia/mediawiki/commit/1f9756a4905cf61dbb3a3d742a0e2… https://phabricator.wikimedia.org/T205908 https://github.com/wikimedia/mediawiki/commit/ac7aa53532bab782c7453e302d20e… https://phabricator.wikimedia.org/T268938 https://github.com/wikimedia/mediawiki/commit/3437133440b6d535c25e4ae28020c… https://github.com/wikimedia/mediawiki/commit/78663c50df6b953f4c832e1530515… https://phabricator.wikimedia.org/T120883 https://github.com/wikimedia/mediawiki/commit/15bed1201ea21ce477a16e9d02170… https://github.com/wikimedia/mediawiki/commit/aca0e52f5ce9312a4af4f411c7564… https://security.archlinux.org/CVE-2020-35474 https://security.archlinux.org/CVE-2020-35475 https://security.archlinux.org/CVE-2020-35477 https://security.archlinux.org/CVE-2020-35478 https://security.archlinux.org/CVE-2020-35479 https://security.archlinux.org/CVE-2020-35480

1 0

[ASA-202101-21] coturn: insufficient validation
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-21 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-26262 Package : coturn Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1430 Summary ======= The package coturn before version 4.5.2-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 4.5.2-1. # pacman -Syu "coturn>=4.5.2-1" The problem has been fixed upstream in version 4.5.2. Workaround ========== None. Description =========== A security issue was found in coturn before version 4.5.2. By default coturn does not allow peers to connect and relay packets to loopback addresses in the range of 127.x.x.x. However, it was observed that when sending a CONNECT request with the XOR-PEER-ADDRESS value of 0.0.0.0, a successful response was received and subsequently, CONNECTIONBIND also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either [::1] or [::] as the peer address. Impact ====== A malicious attacker might relay packets to the loopback interface due to insufficient validation of the connection. References ========== https://github.com/coturn/coturn/security/advisories/GHSA-6g6j-r9rf-cm7p https://github.com/coturn/coturn/commit/ff5e5478a3e1b426bad053828099403cfc5… https://github.com/coturn/coturn/commit/af50d63a152cd9505d38f02bc5528487488… https://github.com/coturn/coturn/commit/6c774b9fb8d9d76576ece10a6429172ed38… https://github.com/coturn/coturn/commit/560684c894498285f9e4271f3c924ebf01f… https://github.com/coturn/coturn/commit/649cbf966181846ecdd7847e4543dd287a7… https://github.com/coturn/coturn/commit/9c7deff4b8ed8c323c87b9ede75481bd6bc… https://github.com/coturn/coturn/commit/dd0ffdb51a4cddaf1d6662079fa91f6f32b… https://github.com/coturn/coturn/commit/d84028b6dbc9eb7d3f8828ec37ae02a0963… https://security.archlinux.org/CVE-2020-26262

1 0

[ASA-202101-20] vivaldi: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-20 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-15995 CVE-2020-16043 CVE-2021-21106 CVE-2021-21107 CVE-2021-21108 CVE-2021-21109 CVE-2021-21110 CVE-2021-21111 CVE-2021-21112 CVE-2021-21113 CVE-2021-21114 CVE-2021-21115 CVE-2021-21116 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1424 Summary ======= The package vivaldi before version 3.5.2115.87-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 3.5.2115.87-1. # pacman -Syu "vivaldi>=3.5.2115.87-1" The problems have been fixed upstream in version 3.5.2115.87. Workaround ========== None. Description =========== - CVE-2020-15995 (arbitrary code execution) An out of bounds write security issue has been found in the V8 component of the Chromium browser before version 87.0.4280.141. - CVE-2020-16043 (insufficient validation) An insufficient data validation security issue has been found in the networking component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21106 (arbitrary code execution) A use after free security issue has been found in the autofill component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21107 (arbitrary code execution) A use after free security issue has been found in the drag and drop component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21108 (arbitrary code execution) A use after free security issue has been found in the media component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21109 (arbitrary code execution) A use after free security issue has been found in the payments component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21110 (arbitrary code execution) A use after free security issue has been found in the safe browsing component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21111 (access restriction bypass) An insufficient policy enforcement security issue has been found in the WebUI component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21112 (arbitrary code execution) A use after free security issue has been found in the Blink component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21113 (arbitrary code execution) A heap buffer overflow security issue has been found in the Skia component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21114 (arbitrary code execution) A use after free security issue has been found in the audio component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21115 (arbitrary code execution) A use after free security issue has been found in the safe browsing component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21116 (arbitrary code execution) A heap buffer overflow security issue has been found in the audio component of the Chromium browser before version 87.0.4280.141. Impact ====== A remote attacker might be able to bypass security restrictions and execute arbitrary code. References ========== https://vivaldi.com/blog/desktop/minor-update-for-vivaldi-desktop-browser-3… https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-des… https://crbug.com/1157790 https://crbug.com/1148309 https://crbug.com/1148749 https://crbug.com/1153595 https://crbug.com/1155426 https://crbug.com/1152334 https://crbug.com/1152451 https://crbug.com/1149125 https://crbug.com/1151298 https://crbug.com/1155178 https://crbug.com/1150065 https://crbug.com/1157814 https://crbug.com/1151069 https://security.archlinux.org/CVE-2020-15995 https://security.archlinux.org/CVE-2020-16043 https://security.archlinux.org/CVE-2021-21106 https://security.archlinux.org/CVE-2021-21107 https://security.archlinux.org/CVE-2021-21108 https://security.archlinux.org/CVE-2021-21109 https://security.archlinux.org/CVE-2021-21110 https://security.archlinux.org/CVE-2021-21111 https://security.archlinux.org/CVE-2021-21112 https://security.archlinux.org/CVE-2021-21113 https://security.archlinux.org/CVE-2021-21114 https://security.archlinux.org/CVE-2021-21115 https://security.archlinux.org/CVE-2021-21116

1 0

[ASA-202101-19] nvidia-utils: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-19 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2021-1052 CVE-2021-1053 CVE-2021-1056 Package : nvidia-utils Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1417 Summary ======= The package nvidia-utils before version 460.32.03-1 is vulnerable to multiple issues including privilege escalation, denial of service and information disclosure. Resolution ========== Upgrade to 460.32.03-1. # pacman -Syu "nvidia-utils>=460.32.03-1" The problems have been fixed upstream in version 460.32.03. Workaround ========== None. Description =========== - CVE-2021-1052 (privilege escalation) The NVIDIA GPU Display Driver, all versions of the R460 and R450 driver branches, contains a vulnerability in the kernel mode layer (nvidia.ko) handler for DxgkDdiEscape or IOCTL in which user-mode clients can access legacy privileged APIs, which may lead to denial of service, escalation of privileges, and information disclosure. This issue is fixed in versions 460.32.03 and 450.102.04. - CVE-2021-1053 (denial of service) The NVIDIA GPU Display Driver, all versions of the R460 and R450 driver branches, contains a vulnerability in the kernel mode layer (nvidia.ko) handler for DxgkDdiEscape or IOCTL in which improper validation of a user pointer may lead to denial of service. This issue is fixed in versions 460.32.03 and 450.102.04. - CVE-2021-1056 (information disclosure) The NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not completely honor operating system file system permissions to provide GPU device-level isolation, which may lead to denial of service or information disclosure. This issue is fixed in versions 460.32.03, 450.102.04 and 390.141. Impact ====== A local user might crash the service, escalate privileges or disclose sensitive information. References ========== https://nvidia.custhelp.com/app/answers/detail/a_id/5142 https://security.archlinux.org/CVE-2021-1052 https://security.archlinux.org/CVE-2021-1053 https://security.archlinux.org/CVE-2021-1056

1 0

[ASA-202101-18] opensmtpd: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-18 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-35679 CVE-2020-35680 Package : opensmtpd Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1381 Summary ======= The package opensmtpd before version 6.8.0p2-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 6.8.0p2-1. # pacman -Syu "opensmtpd>=6.8.0p2-1" The problems have been fixed upstream in version 6.8.0p2. Workaround ========== None. Description =========== - CVE-2020-35679 (information disclosure) smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups. - CVE-2020-35680 (denial of service) smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer. Impact ====== A malicious remote user might read memory or crash the service. References ========== https://github.com/openbsd/src/commit/79a034b4aed29e965f45a13409268290c9910… https://github.com/openbsd/src/commit/6c3220444ed06b5796dedfd53a0f4becd903c… https://security.archlinux.org/CVE-2020-35679 https://security.archlinux.org/CVE-2020-35680

1 0

[ASA-202101-17] thunderbird: arbitrary code execution
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-17 ========================================== Severity: Critical Date : 2021-01-12 CVE-ID : CVE-2020-16044 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1440 Summary ======= The package thunderbird before version 78.6.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 78.6.1-1. # pacman -Syu "thunderbird>=78.6.1-1" The problem has been fixed upstream in version 78.6.1. Workaround ========== None. Description =========== A security issue was found in Firefox before 84.0.2 and Thunderbird before 78.6.1-1. A malicious peer could have modified a COOKIE-ECHO chunk in an SCTP packet in a way that potentially resulted in a use- after-free. Mozilla presumes that with enough effort it could have been exploited to run arbitrary code. Impact ====== A malicious remote user could forge an SCTP packet and possibly execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-02/ https://www.mozilla.org/en-US/security/advisories/mfsa2021-01/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1683964 https://hg.mozilla.org/mozilla-central/rev/08ba03dc8d4420e04e7c77fee3013e68… https://hg.mozilla.org/mozilla-central/rev/8c09f4813fc7e8f44605b6092262199b… https://hg.mozilla.org/mozilla-central/rev/5991645a87d2abf289686d09d943229c… https://security.archlinux.org/CVE-2020-16044

1 0

[ASA-202101-16] nodejs: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-16 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1400 Summary ======= The package nodejs before version 15.5.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 15.5.1-1. # pacman -Syu "nodejs>=15.5.1-1" The problems have been fixed upstream in version 15.5.1. Workaround ========== None. Description =========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ====== A malicious user could achieve data exfiltration through HTTP headers or execute arbitrary code through poor API usage. References ========== https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs-private/node-private/issues/227 https://hackerone.com/bugs?subject=nodejs&report_id=988103 https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a712… https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bb… https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268… https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a3… https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4… https://hackerone.com/bugs?report_id=1002188&subject=nodejs https://github.com/nodejs-private/llhttp-private/pull/3 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e6… https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016… https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b… https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419… https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50e… https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36… https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc… https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a7… https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe43… https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287

1 0