January 2021 - Arch-security - lists.archlinux.org

[ASA-202101-15] nodejs-lts-fermium: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-15 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs-lts-fermium Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1401 Summary ======= The package nodejs-lts-fermium before version 14.15.4-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 14.15.4-1. # pacman -Syu "nodejs-lts-fermium>=14.15.4-1" The problems have been fixed upstream in version 14.15.4. Workaround ========== None. Description =========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ====== A malicious user could achieve data exfiltration through HTTP headers or execute arbitrary code through poor API usage. References ========== https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs-private/node-private/issues/227 https://hackerone.com/bugs?subject=nodejs&report_id=988103 https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a712… https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bb… https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268… https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a3… https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4… https://hackerone.com/bugs?report_id=1002188&subject=nodejs https://github.com/nodejs-private/llhttp-private/pull/3 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e6… https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016… https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b… https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419… https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50e… https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36… https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc… https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a7… https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe43… https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287

1 0

[ASA-202101-14] nodejs-lts-erbium: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-14 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs-lts-erbium Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1402 Summary ======= The package nodejs-lts-erbium before version 12.20.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 12.20.1-1. # pacman -Syu "nodejs-lts-erbium>=12.20.1-1" The problems have been fixed upstream in version 12.20.1. Workaround ========== None. Description =========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ====== A malicious user could achieve data exfiltration through HTTP headers or execute arbitrary code through poor API usage. References ========== https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs-private/node-private/issues/227 https://hackerone.com/bugs?subject=nodejs&report_id=988103 https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a712… https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bb… https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268… https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a3… https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4… https://hackerone.com/bugs?report_id=1002188&subject=nodejs https://github.com/nodejs-private/llhttp-private/pull/3 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e6… https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016… https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b… https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419… https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50e… https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36… https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc… https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a7… https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe43… https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287

1 0

[ASA-202101-13] nodejs-lts-dubnium: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-13 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-8265 CVE-2020-8287 Package : nodejs-lts-dubnium Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1403 Summary ======= The package nodejs-lts-dubnium before version 10.23.1-1 is vulnerable to multiple issues including arbitrary code execution and url request injection. Resolution ========== Upgrade to 10.23.1-1. # pacman -Syu "nodejs-lts-dubnium>=10.23.1-1" The problems have been fixed upstream in version 10.23.1. Workaround ========== None. Description =========== - CVE-2020-8265 (arbitrary code execution) The nodejs release lines 15.x, 14.x, 12.x and 10.x are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. - CVE-2020-8287 (url request injection) The nodejs release lines 15.x, 14.x, 12.x and 10.x allow two copies of a header field in an HTTP request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling. The issue is fixed in nodejs versions 15.5.1, 14.15.4, 12.20.1 and 10.23.1. Impact ====== A malicious user could achieve data exfiltration through HTTP headers or execute arbitrary code through poor API usage. References ========== https://groups.google.com/g/nodejs-sec/c/kyzmwvQdUfs/m/7mjPCzY2BAAJ https://github.com/nodejs-private/node-private/issues/227 https://hackerone.com/bugs?subject=nodejs&report_id=988103 https://github.com/nodejs/node/commit/9834ef85a0a549a45a98f04dc51af1782a712… https://github.com/nodejs/node/commit/4f8772f9b731118628256189b73cd202149bb… https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268… https://github.com/nodejs/node/commit/7f178663ebffc82c9f8a5a1b6bf2da0c263a3… https://github.com/nodejs/node/commit/357e2857c8385c303782ced2ac8b568df06d4… https://hackerone.com/bugs?report_id=1002188&subject=nodejs https://github.com/nodejs-private/llhttp-private/pull/3 https://github.com/nodejs/node/commit/e0c9a2285cfe18642d15d5ed9b7122755c6e6… https://github.com/nodejs/node/commit/c5dbe831b714b3a98c59ba2406b791fb27016… https://github.com/nodejs/node/commit/641f786bb1a1f6eb1ff8750782ed939780f2b… https://github.com/nodejs/node/commit/7ecac8143f0a91785ed0bd3b4d9aab5d98419… https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50e… https://github.com/nodejs/node/commit/4a30ac8c755d0701e773831ce22153b66bb36… https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc… https://github.com/nodejs/node/commit/fc70ce08f5818a286fb5899a1bc3aff5965a7… https://github.com/nodejs/node/commit/aa6b97fb99d7528649fadb4c6a894e078fe43… https://security.archlinux.org/CVE-2020-8265 https://security.archlinux.org/CVE-2020-8287

1 0

[ASA-202101-12] python-cairosvg: denial of service
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-12 ========================================== Severity: Low Date : 2021-01-12 CVE-ID : CVE-2021-21236 Package : python-cairosvg Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1412 Summary ======= The package python-cairosvg before version 2.5.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.5.1-1. # pacman -Syu "python-cairosvg>=2.5.1-1" The problem has been fixed upstream in version 2.5.1. Workaround ========== None. Description =========== In python-cairosvg before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to regular expression denial of service (REDoS). If an attacker provides a malicious SVG, it can make python-cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. Impact ====== A malicious user could craft a SVG that takes a very long time to process, resulting in a denial of service. References ========== https://github.com/Kozea/CairoSVG/security/advisories/GHSA-hq37-853p-g5cf https://github.com/Kozea/CairoSVG/commit/063185b60588a41d4df661ad70f9f7b699… https://security.archlinux.org/CVE-2021-21236

1 0

[ASA-202101-11] python-pillow: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-11 ========================================== Severity: Medium Date : 2021-01-12 CVE-ID : CVE-2020-35653 CVE-2020-35654 CVE-2020-35655 Package : python-pillow Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1438 Summary ======= The package python-pillow before version 8.1.0-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 8.1.0-1. # pacman -Syu "python-pillow>=8.1.0-1" The problems have been fixed upstream in version 8.1.0. Workaround ========== None. Description =========== - CVE-2020-35653 (information disclosure) In python-pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations. - CVE-2020-35654 (arbitrary code execution) In python-pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. - CVE-2020-35655 (denial of service) In python-pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over- read when decoding crafted SGI RLE image files because offsets and length tables are mishandled. Impact ====== A local malicious user might craft a malformed file to execute arbitrary code, read from memory or crash the application. References ========== https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security https://github.com/python-pillow/Pillow/pull/5174 https://github.com/python-pillow/Pillow/commit/2f409261eb1228e166868f8f0b5d… https://github.com/python-pillow/Pillow/pull/5175 https://github.com/python-pillow/Pillow/commit/eb8c1206d6b170d4e798a00db743… https://github.com/python-pillow/Pillow/commit/45a62e91b1f72e79989a7919af97… https://github.com/python-pillow/Pillow/pull/5173 https://github.com/python-pillow/Pillow/commit/7e95c63fa7f503f185d3d9eb16b9… https://github.com/python-pillow/Pillow/commit/9a2c9f722f78773e608d44710873… https://security.archlinux.org/CVE-2020-35653 https://security.archlinux.org/CVE-2020-35654 https://security.archlinux.org/CVE-2020-35655

1 0

[ASA-202101-10] gitlab: multiple issues
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-10 ========================================== Severity: High Date : 2021-01-12 CVE-ID : CVE-2020-26414 CVE-2021-22166 CVE-2021-22167 CVE-2021-22168 CVE-2021-22171 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1416 Summary ======= The package gitlab before version 13.7.2-1 is vulnerable to multiple issues including authentication bypass, denial of service and information disclosure. Resolution ========== Upgrade to 13.7.2-1. # pacman -Syu "gitlab>=13.7.2-1" The problems have been fixed upstream in version 13.7.2. Workaround ========== None. Description =========== - CVE-2020-26414 (denial of service) An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string. The issue is mitigated in GitLab version 13.7.2, 13.6.4, and 13.5.6. - CVE-2021-22166 (denial of service) An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method. The issue is mitigated in GitLab version 13.7.2. - CVE-2021-22167 (information disclosure) An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers within a specific project page allow attackers to have temporary read access to a public repository with project features restricted only to members. The issue is mitigated in GitLab version 13.7.2, 13.6.4, and 13.5.6. - CVE-2021-22168 (denial of service) A regular expression denial of service issue has been discovered in the NuGet API affecting all versions of GitLab starting from version 12.8. The issue is mitigated in GitLab version 13.7.2, 13.6.4, and 13.5.6. - CVE-2021-22171 (authentication bypass) Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ would allow stealing a user's API access token. The issue is mitigated in GitLab version 13.7.2, 13.6.4, and 13.5.6. Note: A way to bypass the fix released in GitLab version 13.7.2, 13.6.4, and 13.5.6 has been found and was subsequently fixed in version 13.7.4, 13.6.5, and 13.5.7. Impact ====== A malicious authenticated user might crash the application through a malformed HTTP request or project name, bypass authentication or disclose private information. References ========== https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://about.gitlab.com/releases/2021/01/07/security-release-gitlab-13-7-2… https://gitlab.com/gitlab-org/gitlab-foss/-/commit/fa70ce1068babe592d348497… https://gitlab.com/gitlab-org/gitlab-foss/-/commit/e861919633e0aac16509c041… https://security.archlinux.org/CVE-2020-26414 https://security.archlinux.org/CVE-2021-22166 https://security.archlinux.org/CVE-2021-22167 https://security.archlinux.org/CVE-2021-22168 https://security.archlinux.org/CVE-2021-22171

1 0

[ASA-202101-9] php: insufficient validation
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-9 ========================================= Severity: Medium Date : 2021-01-12 CVE-ID : CVE-2020-7071 Package : php Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-1415 Summary ======= The package php before version 7.4.14-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 7.4.14-1. # pacman -Syu "php>=7.4.14-1" The problem has been fixed upstream in version 7.4.14. Workaround ========== None. Description =========== A security issue was found in the php_url_parse_ex() function in PHP, which leads to FILTER_VALIDATE_URL accepting URLs with invalid userinfo. It is fixed in versions 8.0.1, 7.4.14 and 7.3.26. Impact ====== A malicious remote user might bypass URL validation. References ========== https://bugs.archlinux.org/task/69242 https://bugs.php.net/bug.php?id=77423 https://git.php.net/?p=php-src.git;a=commitdiff;h=b7f837381ef642d7fb369bfd0… https://git.php.net/?p=php-src.git;a=commitdiff;h=5346d0ae69f290c7704a39cd1… https://git.php.net/?p=php-src.git;a=commitdiff;h=d4f5aed22193106271510efd6… https://security.archlinux.org/CVE-2020-7071

1 0

[ASA-202101-8] mdbook: cross-site scripting
by Morten Linderud 15 Jan '21

15 Jan '21

Arch Linux Security Advisory ASA-202101-8 ========================================= Severity: Medium Date : 2021-01-12 CVE-ID : CVE-2020-26297 Package : mdbook Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1399 Summary ======= The package mdbook before version 0.4.5-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 0.4.5-1. # pacman -Syu "mdbook>=0.4.5-1" The problem has been fixed upstream in version 0.4.5. Workaround ========== None. Description =========== The search feature of mdBook (introduced in version 0.1.4) was affected by a cross site scripting vulnerability that allowed an attacker to execute arbitrary JavaScript code on an user's browser by tricking the user into typing a malicious search query, or tricking the user into clicking a link to the search page with the malicious search query prefilled. mdBook 0.4.5 fixes the vulnerability by properly escaping the search query. Impact ====== A malicious user can execute arbitrary code in a user's browser with a malicious search query. References ========== https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0 https://github.com/rust-lang/mdBook/commit/648c9ae772bec83f0a5954d17b4287d5… https://security.archlinux.org/CVE-2020-26297

1 0

[ASA-202101-7] mbedtls: private key recovery
by Morten Linderud 10 Jan '21

10 Jan '21

Arch Linux Security Advisory ASA-202101-7 ========================================= Severity: High Date : 2021-01-08 CVE-ID : CVE-2020-16150 Package : mbedtls Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-1386 Summary ======= The package mbedtls before version 2.25.0-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 2.25.0-1. # pacman -Syu "mbedtls>=2.25.0-1" The problem has been fixed upstream in version 2.25.0. Workaround ========== None. Description =========== A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference based on a padding length. The issue is fixed in Mbed TLS 2.24.0, 2.16.8 and 2.7.17. Impact ====== An attacker might be able to recover secret key information via a side- channel. References ========== https://bugs.archlinux.org/task/69128 https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://security.archlinux.org/CVE-2020-16150

1 0

[ASA-202101-6] chromium: multiple issues
by Morten Linderud 10 Jan '21

10 Jan '21

Arch Linux Security Advisory ASA-202101-6 ========================================= Severity: High Date : 2021-01-08 CVE-ID : CVE-2020-15995 CVE-2020-16043 CVE-2021-21106 CVE-2021-21107 CVE-2021-21108 CVE-2021-21109 CVE-2021-21110 CVE-2021-21111 CVE-2021-21112 CVE-2021-21113 CVE-2021-21114 CVE-2021-21115 CVE-2021-21116 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1414 Summary ======= The package chromium before version 87.0.4280.141-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 87.0.4280.141-1. # pacman -Syu "chromium>=87.0.4280.141-1" The problems have been fixed upstream in version 87.0.4280.141. Workaround ========== None. Description =========== - CVE-2020-15995 (arbitrary code execution) An out of bounds write security issue has been found in the V8 component of the Chromium browser before version 87.0.4280.141. - CVE-2020-16043 (insufficient validation) An insufficient data validation security issue has been found in the networking component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21106 (arbitrary code execution) A use after free security issue has been found in the autofill component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21107 (arbitrary code execution) A use after free security issue has been found in the drag and drop component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21108 (arbitrary code execution) A use after free security issue has been found in the media component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21109 (arbitrary code execution) A use after free security issue has been found in the payments component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21110 (arbitrary code execution) A use after free security issue has been found in the safe browsing component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21111 (access restriction bypass) An insufficient policy enforcement security issue has been found in the WebUI component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21112 (arbitrary code execution) A use after free security issue has been found in the Blink component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21113 (arbitrary code execution) A heap buffer overflow security issue has been found in the Skia component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21114 (arbitrary code execution) A use after free security issue has been found in the audio component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21115 (arbitrary code execution) A use after free security issue has been found in the safe browsing component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21116 (arbitrary code execution) A heap buffer overflow security issue has been found in the audio component of the Chromium browser before version 87.0.4280.141. Impact ====== A remote attacker might be able to bypass security restrictions and execute arbitrary code. References ========== https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-des… https://crbug.com/1157790 https://crbug.com/1148309 https://crbug.com/1148749 https://crbug.com/1153595 https://crbug.com/1155426 https://crbug.com/1152334 https://crbug.com/1152451 https://crbug.com/1149125 https://crbug.com/1151298 https://crbug.com/1155178 https://crbug.com/1150065 https://crbug.com/1157814 https://crbug.com/1151069 https://security.archlinux.org/CVE-2020-15995 https://security.archlinux.org/CVE-2020-16043 https://security.archlinux.org/CVE-2021-21106 https://security.archlinux.org/CVE-2021-21107 https://security.archlinux.org/CVE-2021-21108 https://security.archlinux.org/CVE-2021-21109 https://security.archlinux.org/CVE-2021-21110 https://security.archlinux.org/CVE-2021-21111 https://security.archlinux.org/CVE-2021-21112 https://security.archlinux.org/CVE-2021-21113 https://security.archlinux.org/CVE-2021-21114 https://security.archlinux.org/CVE-2021-21115 https://security.archlinux.org/CVE-2021-21116

1 0