December 2021 - Arch-security - lists.archlinux.org

[ASA-202112-12] grafana-agent: information disclosure
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-12 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-41090 Package : grafana-agent Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2614 Summary ======= The package grafana-agent before version 0.21.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 0.21.2-1. # pacman -Syu "grafana-agent>=0.21.2-1" The problem has been fixed upstream in version 0.21.2. Workaround ========== None. Description =========== A security issue has been found in Grafana Agent before version 0.21.2. Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server: - Inline secrets for metrics instance configs in the base YAML file are exposed at /-/config - Inline secrets for integrations are exposed at /-/config - Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at /-/config. - Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at /-/config. - Inline secrets for metrics instance configs loaded from the scraping service are exposed at /agent/api/v1/configs/{name}. Inline secrets will be exposed to anyone being able to reach these endpoints. Secrets found in these sections are used for: - Delivering metrics to a Prometheus Remote Write system - Authenticating against a system for discovering Prometheus targets - Authenticating against a system for collecting metrics (scrape_configs and integrations) - Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode - Authenticating against Kafka for receiving traces Non-inlined secrets, such as *_file-based secrets, are not impacted by this vulnerability. Impact ====== A remote attacker could disclose inline secrets over the Grafana Agent HTTP server. References ========== https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh https://security.archlinux.org/CVE-2021-41090

1 0

[ASA-202112-11] grafana: directory traversal
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-11 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-43798 CVE-2021-43813 CVE-2021-43815 Package : grafana Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2609 Summary ======= The package grafana before version 8.3.1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 8.3.1-1. # pacman -Syu "grafana>=8.3.1-1" The problems have been fixed upstream in version 8.3.1. Workaround ========== None. Description =========== - CVE-2021-43798 (directory traversal) Grafana 8 before version 8.3.1 is vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is <grafana_host_url>/public/plugins/<"plugin-id">, where <"plugin-id"> is the plugin ID for any installed plugin. - CVE-2021-43813 (directory traversal) A security issue has been found in Grafana before version 8.3.2 through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. The vulnerable URL path is: /api/plugins/.*/markdown/.* for .md files. - CVE-2021-43815 (directory traversal) A security issue has been found in Grafana 8 before version 8.3.2 through which authenticated users could read out arbitrary .csv files through directory traversal. The vulnerable URL path is: /api/ds/query. Impact ====== A remote attacker could access arbitrary local files on the server through directory traversal. References ========== https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-rel… https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafan… https://j0vsec.com/post/cve-2021-43798/ https://github.com/grafana/grafana/commit/00e38ba555cfb120361c9623de3285d70… https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-… https://github.com/grafana/grafana/commit/06706efbbe59ad9d3075835cc31e2f734… https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m https://github.com/grafana/grafana/commit/1d7105c0959df2083814237024f7ec098… https://security.archlinux.org/CVE-2021-43798 https://security.archlinux.org/CVE-2021-43813 https://security.archlinux.org/CVE-2021-43815

1 0

[ASA-202112-10] gitlab: multiple issues
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-10 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-39910 CVE-2021-39915 CVE-2021-39917 CVE-2021-39919 CVE-2021-39931 CVE-2021-39932 CVE-2021-39933 CVE-2021-39934 CVE-2021-39935 CVE-2021-39936 CVE-2021-39937 CVE-2021-39938 CVE-2021-39940 CVE-2021-39941 CVE-2021-39944 CVE-2021-39945 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2603 Summary ======= The package gitlab before version 14.5.2-1 is vulnerable to multiple issues including privilege escalation, access restriction bypass, denial of service, information disclosure and content spoofing. Resolution ========== Upgrade to 14.5.2-1. # pacman -Syu "gitlab>=14.5.2-1" The problems have been fixed upstream in version 14.5.2. Workaround ========== None. Description =========== - CVE-2021-39910 (content spoofing) An issue has been discovered in GitLab before version 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature. - CVE-2021-39915 (information disclosure) Improper access control in the GraphQL API in GitLab before version 14.5.2 allows an attacker to see the names of project access tokens on arbitrary projects. - CVE-2021-39917 (denial of service) An issue has been discovered in GitLab before version 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a denial of service attack. - CVE-2021-39919 (information disclosure) In all versions of GitLab before version 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure. - CVE-2021-39931 (access restriction bypass) An issue has been discovered in GitLab before version 14.5.2. Under specific condition an unauthorised project member was allowed to delete a protected branches due to a business logic error. - CVE-2021-39932 (denial of service) An issue has been discovered in GitLab before version 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes. - CVE-2021-39933 (denial of service) An issue has been discovered in GitLab before version 14.5.2. A regular expression used for handling user input (notes, comments, etc) was susceptible to catastrophic backtracking that could cause a denial of service attack. - CVE-2021-39934 (information disclosure) Improper access control allows any project member to retrieve the service desk email address in GitLab before version 14.5.2. - CVE-2021-39935 (access restriction bypass) An issue has been discovered in GitLab before version 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API. - CVE-2021-39936 (access restriction bypass) Improper access control in GitLab before version 14.5.2 allows an attacker in possession of a deploy token to access a project's disabled wiki. - CVE-2021-39937 (privilege escalation) A collision in access memoization logic in all versions of GitLab before version 14.5.2 leads to potential elevated privileges in groups and projects under rare circumstances. - CVE-2021-39938 (denial of service) A vulnerable regular expression pattern in GitLab before version 14.5.2 allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands. - CVE-2021-39940 (denial of service) An issue has been discovered in GitLab before version 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent. - CVE-2021-39941 (information disclosure) An information disclosure vulnerability in GitLab before version 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members. - CVE-2021-39944 (privilege escalation) An issue has been discovered in GitLab before version 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import. - CVE-2021-39945 (access restriction bypass) Improper access control in the GitLab API affecting all versions before version 14.5.2 allows an author of a Merge Request to approve the Merge Request even after having their project access revoked. Impact ====== A remote attacker could elevate their privileges, bypass access restrictions, disclose sensitive information, spoof content or cause high resource consumption leading to denial of service. References ========== https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2… https://security.archlinux.org/CVE-2021-39910 https://security.archlinux.org/CVE-2021-39915 https://security.archlinux.org/CVE-2021-39917 https://security.archlinux.org/CVE-2021-39919 https://security.archlinux.org/CVE-2021-39931 https://security.archlinux.org/CVE-2021-39932 https://security.archlinux.org/CVE-2021-39933 https://security.archlinux.org/CVE-2021-39934 https://security.archlinux.org/CVE-2021-39935 https://security.archlinux.org/CVE-2021-39936 https://security.archlinux.org/CVE-2021-39937 https://security.archlinux.org/CVE-2021-39938 https://security.archlinux.org/CVE-2021-39940 https://security.archlinux.org/CVE-2021-39941 https://security.archlinux.org/CVE-2021-39944 https://security.archlinux.org/CVE-2021-39945

1 0

[ASA-202112-9] thunderbird: multiple issues
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-9 ========================================= Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-43528 CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2608 Summary ======= The package thunderbird before version 91.4.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, information disclosure, incorrect calculation, sandbox escape and denial of service. Resolution ========== Upgrade to 91.4.0-1. # pacman -Syu "thunderbird>=91.4.0-1" The problems have been fixed upstream in version 91.4.0. Workaround ========== None. Description =========== - CVE-2021-43528 (arbitrary code execution) Thunderbird before version 91.4.0 unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. - CVE-2021-43536 (information disclosure) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. - CVE-2021-43537 (arbitrary code execution) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. - CVE-2021-43538 (content spoofing) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. By misusing a race in the notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. - CVE-2021-43539 (arbitrary code execution) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Failure to correctly record the location of live pointers across wasm instance calls resulted in a garbage collection occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. - CVE-2021-43541 (incorrect calculation) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. - CVE-2021-43542 (information disclosure) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. - CVE-2021-43543 (sandbox escape) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. - CVE-2021-43545 (denial of service) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Using the Location API in a loop could have caused severe application hangs and crashes. - CVE-2021-43546 (content spoofing) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, spoof content or crash the application through crafted web content. In general, these flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. References ========== https://www.mozilla.org/security/advisories/mfsa2021-54/ https://bugzilla.mozilla.org/show_bug.cgi?id=1742579 https://www.mozilla.org/security/advisories/mfsa2021-52/ https://bugzilla.mozilla.org/show_bug.cgi?id=1730120 https://bugzilla.mozilla.org/show_bug.cgi?id=1738237 https://bugzilla.mozilla.org/show_bug.cgi?id=1739091 https://bugzilla.mozilla.org/show_bug.cgi?id=1739683 https://bugzilla.mozilla.org/show_bug.cgi?id=1696685 https://bugzilla.mozilla.org/show_bug.cgi?id=1723281 https://bugzilla.mozilla.org/show_bug.cgi?id=1738418 https://bugzilla.mozilla.org/show_bug.cgi?id=1720926 https://bugzilla.mozilla.org/show_bug.cgi?id=1737751 https://security.archlinux.org/CVE-2021-43528 https://security.archlinux.org/CVE-2021-43536 https://security.archlinux.org/CVE-2021-43537 https://security.archlinux.org/CVE-2021-43538 https://security.archlinux.org/CVE-2021-43539 https://security.archlinux.org/CVE-2021-43541 https://security.archlinux.org/CVE-2021-43542 https://security.archlinux.org/CVE-2021-43543 https://security.archlinux.org/CVE-2021-43545 https://security.archlinux.org/CVE-2021-43546

1 0

[ASA-202112-8] firefox: multiple issues
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-8 ========================================= Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43540 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2606 Summary ======= The package firefox before version 95.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, information disclosure, access restriction bypass, incorrect calculation, sandbox escape and denial of service. Resolution ========== Upgrade to 95.0-1. # pacman -Syu "firefox>=95.0-1" The problems have been fixed upstream in version 95.0. Workaround ========== None. Description =========== - CVE-2021-43536 (information disclosure) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. - CVE-2021-43537 (arbitrary code execution) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. - CVE-2021-43538 (content spoofing) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. By misusing a race in the notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. - CVE-2021-43539 (arbitrary code execution) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Failure to correctly record the location of live pointers across wasm instance calls resulted in a garbage collection occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. - CVE-2021-43540 (access restriction bypass) A security issue has been found in Firefox before version 95. WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. - CVE-2021-43541 (incorrect calculation) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. - CVE-2021-43542 (information disclosure) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. - CVE-2021-43543 (sandbox escape) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. - CVE-2021-43545 (denial of service) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Using the Location API in a loop could have caused severe application hangs and crashes. - CVE-2021-43546 (content spoofing) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, spoof content or crash the application through crafted web content. References ========== https://www.mozilla.org/security/advisories/mfsa2021-52/ https://www.mozilla.org/security/advisories/mfsa2021-54/ https://bugzilla.mozilla.org/show_bug.cgi?id=1730120 https://bugzilla.mozilla.org/show_bug.cgi?id=1738237 https://bugzilla.mozilla.org/show_bug.cgi?id=1739091 https://bugzilla.mozilla.org/show_bug.cgi?id=1739683 https://bugzilla.mozilla.org/show_bug.cgi?id=1636629 https://bugzilla.mozilla.org/show_bug.cgi?id=1696685 https://bugzilla.mozilla.org/show_bug.cgi?id=1723281 https://bugzilla.mozilla.org/show_bug.cgi?id=1738418 https://bugzilla.mozilla.org/show_bug.cgi?id=1720926 https://bugzilla.mozilla.org/show_bug.cgi?id=1737751 https://security.archlinux.org/CVE-2021-43536 https://security.archlinux.org/CVE-2021-43537 https://security.archlinux.org/CVE-2021-43538 https://security.archlinux.org/CVE-2021-43539 https://security.archlinux.org/CVE-2021-43540 https://security.archlinux.org/CVE-2021-43541 https://security.archlinux.org/CVE-2021-43542 https://security.archlinux.org/CVE-2021-43543 https://security.archlinux.org/CVE-2021-43545 https://security.archlinux.org/CVE-2021-43546

1 0

[ASA-202112-7] vivaldi: multiple issues
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-7 ========================================= Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-4052 CVE-2021-4053 CVE-2021-4054 CVE-2021-4055 CVE-2021-4056 CVE-2021-4057 CVE-2021-4058 CVE-2021-4059 CVE-2021-4061 CVE-2021-4062 CVE-2021-4063 CVE-2021-4064 CVE-2021-4065 CVE-2021-4066 CVE-2021-4067 CVE-2021-4068 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2601 Summary ======= The package vivaldi before version 5.0.2497.28-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and insufficient validation. Resolution ========== Upgrade to 5.0.2497.28-1. # pacman -Syu "vivaldi>=5.0.2497.28-1" The problems have been fixed upstream in version 5.0.2497.28. Workaround ========== None. Description =========== - CVE-2021-4052 (arbitrary code execution) A use after free security issue has been found in the web apps component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4053 (arbitrary code execution) A use after free security issue has been found in the UI component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4054 (content spoofing) An incorrect security UI security issue has been found in the autofill component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4055 (arbitrary code execution) A heap buffer overflow security issue has been found in the extensions component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4056 (arbitrary code execution) A type confusion security issue has been found in the loader component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4057 (arbitrary code execution) A use after free security issue has been found in the file API component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4058 (arbitrary code execution) A heap buffer overflow security issue has been found in the ANGLE component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4059 (insufficient validation) An insufficient data validation security issue has been found in the loader component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4061 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4062 (arbitrary code execution) A heap buffer overflow security issue has been found in the BFCache component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4063 (arbitrary code execution) A use after free security issue has been found in the developer tools component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4064 (arbitrary code execution) A use after free security issue has been found in the screen capture component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4065 (arbitrary code execution) A use after free security issue has been found in the autofill component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4066 (arbitrary code execution) An integer underflow security issue has been found in the ANGLE component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4067 (arbitrary code execution) A use after free security issue has been found in the window manager component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4068 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the new tab page component of the Chromium browser engine before version 96.0.4664.93. Impact ====== A remote attacker could execute arbitrary code or spoof content through crafted web content. References ========== https://vivaldi.com/blog/desktop/further-updates-to-theme-sharing-vivaldi-b… https://vivaldi.com/blog/desktop/minor-update-5-0/ https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-des… https://crbug.com/1267661 https://crbug.com/1267791 https://crbug.com/1239760 https://crbug.com/1266510 https://crbug.com/1260939 https://crbug.com/1262183 https://crbug.com/1267496 https://crbug.com/1270990 https://crbug.com/1271456 https://crbug.com/1272403 https://crbug.com/1273176 https://crbug.com/1273197 https://crbug.com/1273674 https://crbug.com/1274499 https://crbug.com/1274641 https://crbug.com/1265197 https://security.archlinux.org/CVE-2021-4052 https://security.archlinux.org/CVE-2021-4053 https://security.archlinux.org/CVE-2021-4054 https://security.archlinux.org/CVE-2021-4055 https://security.archlinux.org/CVE-2021-4056 https://security.archlinux.org/CVE-2021-4057 https://security.archlinux.org/CVE-2021-4058 https://security.archlinux.org/CVE-2021-4059 https://security.archlinux.org/CVE-2021-4061 https://security.archlinux.org/CVE-2021-4062 https://security.archlinux.org/CVE-2021-4063 https://security.archlinux.org/CVE-2021-4064 https://security.archlinux.org/CVE-2021-4065 https://security.archlinux.org/CVE-2021-4066 https://security.archlinux.org/CVE-2021-4067 https://security.archlinux.org/CVE-2021-4068

1 0

[ASA-202112-6] chromium: multiple issues
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-6 ========================================= Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-4052 CVE-2021-4053 CVE-2021-4054 CVE-2021-4055 CVE-2021-4056 CVE-2021-4057 CVE-2021-4058 CVE-2021-4059 CVE-2021-4061 CVE-2021-4062 CVE-2021-4063 CVE-2021-4064 CVE-2021-4065 CVE-2021-4066 CVE-2021-4067 CVE-2021-4068 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2600 Summary ======= The package chromium before version 96.0.4664.93-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and insufficient validation. Resolution ========== Upgrade to 96.0.4664.93-1. # pacman -Syu "chromium>=96.0.4664.93-1" The problems have been fixed upstream in version 96.0.4664.93. Workaround ========== None. Description =========== - CVE-2021-4052 (arbitrary code execution) A use after free security issue has been found in the web apps component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4053 (arbitrary code execution) A use after free security issue has been found in the UI component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4054 (content spoofing) An incorrect security UI security issue has been found in the autofill component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4055 (arbitrary code execution) A heap buffer overflow security issue has been found in the extensions component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4056 (arbitrary code execution) A type confusion security issue has been found in the loader component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4057 (arbitrary code execution) A use after free security issue has been found in the file API component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4058 (arbitrary code execution) A heap buffer overflow security issue has been found in the ANGLE component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4059 (insufficient validation) An insufficient data validation security issue has been found in the loader component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4061 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4062 (arbitrary code execution) A heap buffer overflow security issue has been found in the BFCache component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4063 (arbitrary code execution) A use after free security issue has been found in the developer tools component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4064 (arbitrary code execution) A use after free security issue has been found in the screen capture component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4065 (arbitrary code execution) A use after free security issue has been found in the autofill component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4066 (arbitrary code execution) An integer underflow security issue has been found in the ANGLE component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4067 (arbitrary code execution) A use after free security issue has been found in the window manager component of the Chromium browser engine before version 96.0.4664.93. - CVE-2021-4068 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the new tab page component of the Chromium browser engine before version 96.0.4664.93. Impact ====== A remote attacker could execute arbitrary code or spoof content through crafted web content. References ========== https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-des… https://crbug.com/1267661 https://crbug.com/1267791 https://crbug.com/1239760 https://crbug.com/1266510 https://crbug.com/1260939 https://crbug.com/1262183 https://crbug.com/1267496 https://crbug.com/1270990 https://crbug.com/1271456 https://crbug.com/1272403 https://crbug.com/1273176 https://crbug.com/1273197 https://crbug.com/1273674 https://crbug.com/1274499 https://crbug.com/1274641 https://crbug.com/1265197 https://security.archlinux.org/CVE-2021-4052 https://security.archlinux.org/CVE-2021-4053 https://security.archlinux.org/CVE-2021-4054 https://security.archlinux.org/CVE-2021-4055 https://security.archlinux.org/CVE-2021-4056 https://security.archlinux.org/CVE-2021-4057 https://security.archlinux.org/CVE-2021-4058 https://security.archlinux.org/CVE-2021-4059 https://security.archlinux.org/CVE-2021-4061 https://security.archlinux.org/CVE-2021-4062 https://security.archlinux.org/CVE-2021-4063 https://security.archlinux.org/CVE-2021-4064 https://security.archlinux.org/CVE-2021-4065 https://security.archlinux.org/CVE-2021-4066 https://security.archlinux.org/CVE-2021-4067 https://security.archlinux.org/CVE-2021-4068

1 0

[ASA-202112-5] isync: arbitrary code execution
by Jonas Witschel 06 Dec '21

06 Dec '21

Arch Linux Security Advisory ASA-202112-5 ========================================= Severity: Medium Date : 2021-12-03 CVE-ID : CVE-2021-3657 CVE-2021-44143 Package : isync Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2579 Summary ======= The package isync before version 1.4.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.4.4-1. # pacman -Syu "isync>=1.4.4-1" The problems have been fixed upstream in version 1.4.4. Workaround ========== None. Description =========== - CVE-2021-3657 (arbitrary code execution) A security issue was found in mbsync in isync versions before 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution. - CVE-2021-44143 (arbitrary code execution) A security issue was found in mbsync in isync 1.4.0 before version 1.4.4. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e., one that starts with an empty line) to provoke a heap overflow, which could conceivably be exploited for remote code execution. Impact ====== A remote attacker could execute arbitrary code on the mbsync client through crafted email messages. References ========== https://www.openwall.com/lists/oss-security/2021/12/03/1 https://www.openwall.com/lists/oss-security/2021/12/03/1/1 https://sourceforge.net/p/isync/isync/ci/463272eab866a36162fe51813327ca7af2… https://sourceforge.net/p/isync/isync/ci/ba13362a52d8749731ba645e5e50e47862… https://sourceforge.net/p/isync/isync/ci/bc15e571b650270b87e9758916f93eab04… https://sourceforge.net/p/isync/isync/ci/127003ee37e3eb6d914782be43097338ba… https://www.openwall.com/lists/oss-security/2021/12/03/2 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=999804 https://www.openwall.com/lists/oss-security/2021/12/03/2/1 https://sourceforge.net/p/isync/isync/ci/87065c12b477ee7239dd907f352dda5289… https://security.archlinux.org/CVE-2021-3657 https://security.archlinux.org/CVE-2021-44143

1 0

[ASA-202112-4] lib32-nss: arbitrary code execution
by Jonas Witschel 06 Dec '21

06 Dec '21

Arch Linux Security Advisory ASA-202112-4 ========================================= Severity: High Date : 2021-12-03 CVE-ID : CVE-2021-43527 Package : lib32-nss Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2597 Summary ======= The package lib32-nss before version 3.73-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.73-1. # pacman -Syu "lib32-nss>=3.73-1" The problem has been fixed upstream in version 3.73. Workaround ========== None. Description =========== NSS (Network Security Services) versions prior to 3.73 are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. Impact ====== A remote attacker could execute arbitrary code through crafted signatures. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/#CVE-2021-435… https://bugs.chromium.org/p/project-zero/issues/detail?id=2237 https://bugzilla.mozilla.org/show_bug.cgi?id=1737470 https://hg.mozilla.org/projects/nss/rev/6b3dc97a8767d9dc5c4c181597d1341d089… https://security.archlinux.org/CVE-2021-43527

1 0

[ASA-202112-3] nss: arbitrary code execution
by Jonas Witschel 06 Dec '21

06 Dec '21

Arch Linux Security Advisory ASA-202112-3 ========================================= Severity: High Date : 2021-12-03 CVE-ID : CVE-2021-43527 Package : nss Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2596 Summary ======= The package nss before version 3.73-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.73-1. # pacman -Syu "nss>=3.73-1" The problem has been fixed upstream in version 3.73. Workaround ========== None. Description =========== NSS (Network Security Services) versions prior to 3.73 are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. Impact ====== A remote attacker could execute arbitrary code through crafted signatures. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/#CVE-2021-435… https://bugs.chromium.org/p/project-zero/issues/detail?id=2237 https://bugzilla.mozilla.org/show_bug.cgi?id=1737470 https://hg.mozilla.org/projects/nss/rev/6b3dc97a8767d9dc5c4c181597d1341d089… https://security.archlinux.org/CVE-2021-43527

1 0