November 2021 - Arch-security - lists.archlinux.org

[ASA-202110-11] freerdp: arbitrary code execution
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-11 ========================================== Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-41159 CVE-2021-41160 Package : freerdp Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2488 Summary ======= The package freerdp before version 2:2.4.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2:2.4.1-1. # pacman -Syu "freerdp>=2:2.4.1-1" The problems have been fixed upstream in version 2.4.1. Workaround ========== CVE-2021-41159 can be mitigated by using a /gt:http connection or a direct connection without gateway. No known mitigation exists for CVE-2021-41160. Description =========== - CVE-2021-41159 (arbitrary code execution) A security issue has been found in FreeRDP before version 2.4.1. Improper client input validation for gateway connections (/gt:rpc) allows a malicious gateway to overwrite client memory. - CVE-2021-41160 (arbitrary code execution) A security issue has been found in FreeRDP before version 2.4.1. A malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send 0 width/height or out of bound rectangles to trigger out of bound writes. With 0 width or heigth the memory allocation will be 0 but the missing bounds checks allow writing to the pointer at this (not allocated) region. Impact ====== A malicious RDP server or gateway could cause remote code execution on a connected client. References ========== https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vh34-m9h7-95xq https://github.com/FreeRDP/FreeRDP/commit/07b789c88010766c230c8f10ac748523b… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7c9r-6r2q-93qg https://github.com/FreeRDP/FreeRDP/commit/217e0caa181fc1690cf84dd6a3ba1a4f9… https://security.archlinux.org/CVE-2021-41159 https://security.archlinux.org/CVE-2021-41160

1 0

[ASA-202110-10] wpewebkit: multiple issues
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-10 ========================================== Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-30846 CVE-2021-30851 CVE-2021-42762 Package : wpewebkit Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2484 Summary ======= The package wpewebkit before version 2.34.1-1 is vulnerable to multiple issues including arbitrary code execution and sandbox escape. Resolution ========== Upgrade to 2.34.1-1. # pacman -Syu "wpewebkit>=2.34.1-1" The problems have been fixed upstream in version 2.34.1. Workaround ========== None. Description =========== - CVE-2021-30846 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30851 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-42762 (sandbox escape) BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133. Impact ====== A remote attacker could execute arbitrary code or escape the confinements of the security sandbox through crafted web content. References ========== https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30846 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30851 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-42762 https://bugs.webkit.org/show_bug.cgi?id=231479 https://trac.webkit.org/changeset/284451/webkit https://security.archlinux.org/CVE-2021-30846 https://security.archlinux.org/CVE-2021-30851 https://security.archlinux.org/CVE-2021-42762

1 0

[ASA-202110-9] webkit2gtk: multiple issues
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-9 ========================================= Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-30846 CVE-2021-30851 CVE-2021-42762 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2483 Summary ======= The package webkit2gtk before version 2.34.1-1 is vulnerable to multiple issues including arbitrary code execution and sandbox escape. Resolution ========== Upgrade to 2.34.1-1. # pacman -Syu "webkit2gtk>=2.34.1-1" The problems have been fixed upstream in version 2.34.1. Workaround ========== None. Description =========== - CVE-2021-30846 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30851 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.34.0. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-42762 (sandbox escape) BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133. Impact ====== A remote attacker could execute arbitrary code or escape the confinements of the security sandbox through crafted web content. References ========== https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30846 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-30851 https://webkitgtk.org/security/WSA-2021-0006.html#CVE-2021-42762 https://bugs.webkit.org/show_bug.cgi?id=231479 https://trac.webkit.org/changeset/284451/webkit https://security.archlinux.org/CVE-2021-30846 https://security.archlinux.org/CVE-2021-30851 https://security.archlinux.org/CVE-2021-42762

1 0

[ASA-202110-8] opera: multiple issues
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-8 ========================================= Severity: High Date : 2021-10-29 CVE-ID : CVE-2021-37977 CVE-2021-37978 CVE-2021-37979 CVE-2021-37980 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2444 Summary ======= The package opera before version 80.0.4170.63-1 is vulnerable to multiple issues including arbitrary code execution and sandbox escape. Resolution ========== Upgrade to 80.0.4170.63-1. # pacman -Syu "opera>=80.0.4170.63-1" The problems have been fixed upstream in version 80.0.4170.63. Workaround ========== None. Description =========== - CVE-2021-37977 (arbitrary code execution) A use after free security issue has been found in the Garbage Collection component of the Chromium browser engine before version 94.0.4606.81. - CVE-2021-37978 (arbitrary code execution) A heap buffer overflow security issue has been found in the Blink component of the Chromium browser engine before version 94.0.4606.81. - CVE-2021-37979 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebRTC component of the Chromium browser engine before version 94.0.4606.81. - CVE-2021-37980 (sandbox escape) An inappropriate implementation security issue has been found in the Sandbox component of the Chromium browser engine before version 94.0.4606.81. Impact ====== A remote attacker could execute arbitrary code or disclose sensitive information through crafted web content. References ========== https://blogs.opera.com/desktop/changelog-for-80/ https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-des… https://crbug.com/1252878 https://crbug.com/1236318 https://crbug.com/1247260 https://crbug.com/1254631 https://security.archlinux.org/CVE-2021-37977 https://security.archlinux.org/CVE-2021-37978 https://security.archlinux.org/CVE-2021-37979 https://security.archlinux.org/CVE-2021-37980

1 0

[ASA-202110-7] chromium: multiple issues
by Jonas Witschel 01 Nov '21

01 Nov '21

Arch Linux Security Advisory ASA-202110-7 ========================================= Severity: High Date : 2021-10-29 CVE-ID : CVE-2021-37997 CVE-2021-37998 CVE-2021-37999 CVE-2021-38000 CVE-2021-38001 CVE-2021-38002 CVE-2021-38003 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2504 Summary ======= The package chromium before version 95.0.4638.69-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 95.0.4638.69-1. # pacman -Syu "chromium>=95.0.4638.69-1" The problems have been fixed upstream in version 95.0.4638.69. Workaround ========== None. Description =========== - CVE-2021-37997 (arbitrary code execution) A use after free security issue has been found in the Sign-In component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-37998 (arbitrary code execution) A use after free security issue has been found in the Garbage Collection component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-37999 (insufficient validation) An insufficient data validation security issue has been found in the New Tab Page component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38000 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Intents component of the Chromium browser engine before version 95.0.4638.69. Google is aware that an exploit for CVE-2021-38000 exists in the wild. - CVE-2021-38001 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38002 (arbitrary code execution) A use after free security issue has been found in the Web Transport component of the Chromium browser engine before version 95.0.4638.69. - CVE-2021-38003 (arbitrary code execution) An inappropriate implementation security issue has been found in the V8 component of the Chromium browser engine before version 95.0.4638.69. Google is aware that an exploit for CVE-2021-38003 exists in the wild. Impact ====== A remote attacker could execute arbitrary code through crafted web content. Google is aware that exploits for two of the security issues exist in the wild. References ========== https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-des… https://crbug.com/1259864 https://crbug.com/1259587 https://crbug.com/1251541 https://crbug.com/1249962 https://crbug.com/1260577 https://crbug.com/1260940 https://crbug.com/1263462 https://security.archlinux.org/CVE-2021-37997 https://security.archlinux.org/CVE-2021-37998 https://security.archlinux.org/CVE-2021-37999 https://security.archlinux.org/CVE-2021-38000 https://security.archlinux.org/CVE-2021-38001 https://security.archlinux.org/CVE-2021-38002 https://security.archlinux.org/CVE-2021-38003

1 0