January 2021 - Arch-security - lists.archlinux.org

[ASA-202101-5] firefox: arbitrary code execution
by Morten Linderud 10 Jan '21

10 Jan '21

Arch Linux Security Advisory ASA-202101-5 ========================================= Severity: Critical Date : 2021-01-08 CVE-ID : CVE-2020-16044 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1413 Summary ======= The package firefox before version 84.0.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 84.0.2-1. # pacman -Syu "firefox>=84.0.2-1" The problem has been fixed upstream in version 84.0.2. Workaround ========== None. Description =========== A security issue was found in Firefox before 84.0.2. A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a use-after-free. Mozilla presumes that with enough effort it could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to execute arbitrary code via a crafted SCTP packet. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-01/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1683964 https://hg.mozilla.org/mozilla-central/rev/08ba03dc8d4420e04e7c77fee3013e68… https://hg.mozilla.org/mozilla-central/rev/8c09f4813fc7e8f44605b6092262199b… https://hg.mozilla.org/mozilla-central/rev/5991645a87d2abf289686d09d943229c… https://security.archlinux.org/CVE-2020-16044

1 0

[ASA-202101-4] dovecot: multiple issues
by Remi Gacogne 05 Jan '21

05 Jan '21

Arch Linux Security Advisory ASA-202101-4 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-24386 CVE-2020-25275 Package : dovecot Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1398 Summary ======= The package dovecot before version 2.3.13-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 2.3.13-1. # pacman -Syu "dovecot>=2.3.13-1" The problems have been fixed upstream in version 2.3.13. Workaround ========== Operators can choose to disable IMAP hibernation. IMAP hibernation is not on by default. To ensure imap hibernation is disabled, make sure imap_hibernate_timeout is set to 0 or unset. Description =========== - CVE-2020-24386 (information disclosure) A security issue was discovered in dovecot version 2.2.26 up to 2.3.11.3. When imap hibernation is active, an attacker can cause dovecot to discover the file system directory structure and access other users' emails using a specially crafted command. The attacker must have valid credentials to access the mail server. The issue is fixed in dovecot version 2.3.13. - CVE-2020-25275 (denial of service) A security issue was discovered in dovecot version 2.3.11 up to 2.3.11.3. Mail delivery/parsing crashed when the 10 000th MIME part was message/rfc822 (or if its parent was multipart/digest). This happened due to earlier MIME parsing changes for CVE-2020-12100. Malicious senders could crash dovecot repeatedly by sending/uploading messages with more than 10 000 MIME parts. The issue is fixed in dovecot version 2.3.13. Impact ====== Malicious senders could crash dovecot repeatedly by sending/uploading messages with more than 10 000 MIME parts. In addition, when imap hibernation is active, a remote, authenticated attacker can cause dovecot to discover the file system directory structure and access other users' emails using a specially crafted command. References ========== https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html https://github.com/dovecot/core/commit/00df2308b0733e810824545183d73276c416… https://github.com/dovecot/core/commit/b4a9872b833b7985c7d0e7615f1b7fc812dd… https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html https://github.com/dovecot/core/commit/67f792cb98267ee74c425772e766e7a2525c… https://github.com/dovecot/core/commit/6ae93c3936fc870c313a6fdf44a0999d4129… https://security.archlinux.org/CVE-2020-24386 https://security.archlinux.org/CVE-2020-25275

1 0

[ASA-202101-3] poppler: arbitrary code execution
by Remi Gacogne 05 Jan '21

05 Jan '21

Arch Linux Security Advisory ASA-202101-3 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-35702 Package : poppler Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1382 Summary ======= The package poppler before version 21.01.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 21.01.0-1. # pacman -Syu "poppler>=21.01.0-1" The problem has been fixed upstream in version 21.01.0. Workaround ========== None. Description =========== DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. Impact ====== An attacker might be able to execute arbitrary code via a crafted PDF document. References ========== https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011 https://gitlab.freedesktop.org/poppler/poppler/uploads/8455cee26a313a3a0174… https://gitlab.freedesktop.org/poppler/poppler/-/commit/ae614bf8ab42c9d0c7a… https://security.archlinux.org/CVE-2020-35702

1 0

[ASA-202101-2] roundcubemail: cross-site scripting
by Remi Gacogne 05 Jan '21

05 Jan '21

Arch Linux Security Advisory ASA-202101-2 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-35730 Package : roundcubemail Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1388 Summary ======= The package roundcubemail before version 1.4.10-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.4.10-1. # pacman -Syu "roundcubemail>=1.4.10-1" The problem has been fixed upstream in version 1.4.10. Workaround ========== None. Description =========== A security issue was found in Roundcube Webmail before version 1.4.10, 1.3.16 and 1.2.13. linkref_addindex in rcube_string_replacer.php allowed performing a stored cross-site scripting attack using a crafted HTML or plain text email message. Impact ====== A remote attacker can perform a stored cross-site scripting attack using a crafted HTML or plain text email message. References ========== https://bugs.archlinux.org/task/69131 https://github.com/roundcube/roundcubemail/releases/tag/1.4.10 https://github.com/roundcube/roundcubemail/commit/0bceba301aa621ecc0263eac1… https://security.archlinux.org/CVE-2020-35730

1 0

[ASA-202101-1] rsync: man-in-the-middle
by Remi Gacogne 05 Jan '21

05 Jan '21

Arch Linux Security Advisory ASA-202101-1 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-14387 Package : rsync Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-1374 Summary ======= The package rsync before version 3.2.3-2 is vulnerable to man-in-the- middle. Resolution ========== Upgrade to 3.2.3-2. # pacman -Syu "rsync>=3.2.3-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in rsync version 3.2.0pre1 to 3.2.4. rsync-ssl does not verify the hostname in the server certificate in openssl mode, so a remote, unauthenticated man-in-the-middle attacker with a valid certificate for another hostname could intercept connections. Impact ====== A remote, unauthenticated attacker in position of man-in-the-middle with a valid certificate for another hostname can intercept connections. References ========== https://bugs.archlinux.org/task/69051 https://bugzilla.redhat.com/show_bug.cgi?id=1875549 https://git.samba.org/?p=rsync.git;a=commitdiff;h=c3f7414c450faaf6a8281cc4a… https://security.archlinux.org/CVE-2020-14387

1 0