March 2021 - Arch-security - lists.archlinux.org

[ASA-202103-27] python2: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-27 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2019-20907 CVE-2020-8492 CVE-2020-26116 CVE-2020-27619 CVE-2021-3177 CVE-2021-23336 Package : python2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1597 Summary ======= The package python2 before version 2.7.18-3 is vulnerable to multiple issues including arbitrary code execution, url request injection and denial of service. Resolution ========== Upgrade to 2.7.18-3. # pacman -Syu "python2>=2.7.18-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2019-20907 (denial of service) In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. - CVE-2020-8492 (denial of service) Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. - CVE-2020-26116 (url request injection) http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. - CVE-2020-27619 (arbitrary code execution) In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. - CVE-2021-3177 (arbitrary code execution) Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. - CVE-2021-23336 (url request injection) The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. The package python-django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes. A further security fix has been issued in versions 3.1.7, 3.0.13 and 2.2.19 such that parse_qsl() no longer allows using ; as a query parameter separator by default. Impact ====== A remote attacker could execute code or crash the application through crafted files or HTTP requests. Furthermore, a remote attacker could inject arbitrary headers or poison web caches through crafted HTTP requests. References ========== https://bugs.archlinux.org/task/68063 https://bugs.python.org/issue39017 https://github.com/python/cpython/pull/21454 https://github.com/python/cpython/commit/5a8d121a1f3ef5ad7c105ee378cc79a3ea… https://bugs.python.org/issue39503 https://github.com/python/cpython/pull/18284 https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4b… https://python-security.readthedocs.io/vuln/http-header-injection-method.ht… https://bugs.python.org/issue39603 https://github.com/python/cpython/pull/18485 https://github.com/python/cpython/commit/8ca8a2e8fb068863c1138f07e3098478ef… https://python-security.readthedocs.io/vuln/cjk-codec-download-eval.html https://bugs.python.org/issue41944 https://github.com/python/cpython/pull/22575 https://github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b1099708… https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_r… https://bugs.python.org/issue42938 https://github.com/python/cpython/pull/24239 https://github.com/python/cpython/commit/c347cbe694743cee120457aa6626712f77… https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933 https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/ https://bugs.python.org/issue42967 https://github.com/python/cpython/pull/24297 https://github.com/python/cpython/commit/c9f07813ab8e664d8c34413c4fc2d4f86c… https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ https://github.com/django/django/commit/8f6d431b08cbb418d9144b976e7b9725466… https://security.archlinux.org/CVE-2019-20907 https://security.archlinux.org/CVE-2020-8492 https://security.archlinux.org/CVE-2020-26116 https://security.archlinux.org/CVE-2020-27619 https://security.archlinux.org/CVE-2021-3177 https://security.archlinux.org/CVE-2021-23336

1 0

[ASA-202103-26] godot: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-26 ========================================== Severity: Medium Date : 2021-03-25 CVE-ID : CVE-2021-26825 CVE-2021-26826 Package : godot Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1544 Summary ======= The package godot before version 3.2.3-2 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.2.3-2. # pacman -Syu "godot>=3.2.3-2" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2021-26825 (arbitrary code execution) An integer overflow issue exists in Godot Engine version 3.2.3 that can be triggered when loading specially crafted TGA image files. The vulnerability exists in the ImageLoaderTGA::load_image() function in the line "const size_t buffer_size = (tga_header.image_width * tga_header.image_height) * pixel_size;" The bug leads to a dynamic stack buffer overflow. Depending on the context of the application, the attack vector can be local or remote, and can lead to code execution and/or a system crash. - CVE-2021-26826 (arbitrary code execution) A stack overflow issue exists in Godot Engine version 3.2.3 and is caused by improper boundary checks when loading TGA image files. Depending on the context of the application, the attack vector can be local or remote, and can lead to code execution and/or a system crash. Impact ====== A remote attacker who is able to supply a crafted TGA file to a client which subsequently gets loaded by the engine is able to execute arbitrary code on the affected host. References ========== https://bugs.archlinux.org/task/70057 https://github.com/godotengine/godot/pull/45702 https://github.com/godotengine/godot/commit/113b5ab1c45c01b8e6d54d13ac8876d… https://security.archlinux.org/CVE-2021-26825 https://security.archlinux.org/CVE-2021-26826

1 0

[ASA-202103-25] wpewebkit: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-25 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-27918 CVE-2020-29623 CVE-2021-1765 CVE-2021-1789 CVE-2021-1799 CVE-2021-1801 CVE-2021-1870 Package : wpewebkit Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1722 Summary ======= The package wpewebkit before version 2.30.6-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure and sandbox escape. Resolution ========== Upgrade to 2.30.6-1. # pacman -Syu "wpewebkit>=2.30.6-1" The problems have been fixed upstream in version 2.30.6. Workaround ========== None. Description =========== - CVE-2020-27918 (arbitrary code execution) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-29623 (information disclosure) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. “Clear History and Website Data” did not clear the history in some circumstances. - CVE-2021-1765 (sandbox escape) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. Maliciously crafted web content may violate iframe sandboxing policy. - CVE-2021-1789 (arbitrary code execution) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-1799 (access restriction bypass) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. A malicious website may be able to access restricted ports on arbitrary servers. - CVE-2021-1801 (sandbox escape) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. Maliciously crafted web content may violate iframe sandboxing policy. - CVE-2021-1870 (arbitrary code execution) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Impact ====== A remote attacker is able to use maliciously crafted web content to execute arbitrary code or violate the iframe policy. A malicious server could access restricted ports. References ========== https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2020-27918 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2020-29623 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1765 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1789 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1799 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1801 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1870 https://security.archlinux.org/CVE-2020-27918 https://security.archlinux.org/CVE-2020-29623 https://security.archlinux.org/CVE-2021-1765 https://security.archlinux.org/CVE-2021-1789 https://security.archlinux.org/CVE-2021-1799 https://security.archlinux.org/CVE-2021-1801 https://security.archlinux.org/CVE-2021-1870

1 0

[ASA-202103-24] webkit2gtk: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-24 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-27918 CVE-2020-29623 CVE-2021-1765 CVE-2021-1789 CVE-2021-1799 CVE-2021-1801 CVE-2021-1870 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1721 Summary ======= The package webkit2gtk before version 2.30.6-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure and sandbox escape. Resolution ========== Upgrade to 2.30.6-1. # pacman -Syu "webkit2gtk>=2.30.6-1" The problems have been fixed upstream in version 2.30.6. Workaround ========== None. Description =========== - CVE-2020-27918 (arbitrary code execution) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-29623 (information disclosure) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. “Clear History and Website Data” did not clear the history in some circumstances. - CVE-2021-1765 (sandbox escape) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. Maliciously crafted web content may violate iframe sandboxing policy. - CVE-2021-1789 (arbitrary code execution) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-1799 (access restriction bypass) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. A malicious website may be able to access restricted ports on arbitrary servers. - CVE-2021-1801 (sandbox escape) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. Maliciously crafted web content may violate iframe sandboxing policy. - CVE-2021-1870 (arbitrary code execution) A security issue was discovered in WebKitGTK before 2.30.6 and WPE WebKit before 2.30.6. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Impact ====== A remote attacker is able to use maliciously crafted web content to execute arbitrary code or violate the iframe policy. A malicious server could access restricted ports. References ========== https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2020-27918 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2020-29623 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1765 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1789 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1799 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1801 https://webkitgtk.org/security/WSA-2021-0002.html#CVE-2021-1870 https://security.archlinux.org/CVE-2020-27918 https://security.archlinux.org/CVE-2020-29623 https://security.archlinux.org/CVE-2021-1765 https://security.archlinux.org/CVE-2021-1789 https://security.archlinux.org/CVE-2021-1799 https://security.archlinux.org/CVE-2021-1801 https://security.archlinux.org/CVE-2021-1870

1 0

[ASA-202103-23] dotnet-sdk-3.1: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-23 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-26701 Package : dotnet-sdk-3.1 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1701 Summary ======= The package dotnet-sdk-3.1 before version 3.1.13.sdk113-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.1.13.sdk113-1. # pacman -Syu "dotnet-sdk-3.1>=3.1.13.sdk113-1" The problem has been fixed upstream in version 3.1.13.sdk113. Workaround ========== None. Description =========== A remote code execution vulnerability exists in .NET 5.0 before Runtime 5.0.4 and SDK 5.0.104 as well as .NET Core 3.1 before Runtime 3.1.13 and SDK 3.1.113 due to how text encoding is performed in the System.Text.Encodings.Web package, caused by a buffer overrun. Impact ====== An attacker can execute arbitrary code by abusing the text encoding. References ========== https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701 https://github.com/dotnet/announcements/issues/178 https://security.archlinux.org/CVE-2021-26701

1 0

[ASA-202103-22] dotnet-runtime-3.1: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-22 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-26701 Package : dotnet-runtime-3.1 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1701 Summary ======= The package dotnet-runtime-3.1 before version 3.1.13.sdk113-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.1.13.sdk113-1. # pacman -Syu "dotnet-runtime-3.1>=3.1.13.sdk113-1" The problem has been fixed upstream in version 3.1.13.sdk113. Workaround ========== None. Description =========== A remote code execution vulnerability exists in .NET 5.0 before Runtime 5.0.4 and SDK 5.0.104 as well as .NET Core 3.1 before Runtime 3.1.13 and SDK 3.1.113 due to how text encoding is performed in the System.Text.Encodings.Web package, caused by a buffer overrun. Impact ====== An attacker can execute arbitrary code by abusing the text encoding. References ========== https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701 https://github.com/dotnet/announcements/issues/178 https://security.archlinux.org/CVE-2021-26701

1 0

[ASA-202103-21] dotnet-sdk: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-21 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-26701 Package : dotnet-sdk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1698 Summary ======= The package dotnet-sdk before version 5.0.4.sdk104-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.0.4.sdk104-1. # pacman -Syu "dotnet-sdk>=5.0.4.sdk104-1" The problem has been fixed upstream in version 5.0.4.sdk104. Workaround ========== None. Description =========== A remote code execution vulnerability exists in .NET 5.0 before Runtime 5.0.4 and SDK 5.0.104 as well as .NET Core 3.1 before Runtime 3.1.13 and SDK 3.1.113 due to how text encoding is performed in the System.Text.Encodings.Web package, caused by a buffer overrun. Impact ====== An attacker can execute arbitrary code by abusing the text encoding. References ========== https://bugs.archlinux.org/task/69317 https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701 https://github.com/dotnet/announcements/issues/178 https://security.archlinux.org/CVE-2021-26701

1 0

[ASA-202103-20] dotnet-runtime: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-20 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-26701 Package : dotnet-runtime Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1698 Summary ======= The package dotnet-runtime before version 5.0.4.sdk104-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.0.4.sdk104-1. # pacman -Syu "dotnet-runtime>=5.0.4.sdk104-1" The problem has been fixed upstream in version 5.0.4.sdk104. Workaround ========== None. Description =========== A remote code execution vulnerability exists in .NET 5.0 before Runtime 5.0.4 and SDK 5.0.104 as well as .NET Core 3.1 before Runtime 3.1.13 and SDK 3.1.113 due to how text encoding is performed in the System.Text.Encodings.Web package, caused by a buffer overrun. Impact ====== An attacker can execute arbitrary code by abusing the text encoding. References ========== https://bugs.archlinux.org/task/69317 https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701 https://github.com/dotnet/announcements/issues/178 https://security.archlinux.org/CVE-2021-26701

1 0

[ASA-202103-19] vivaldi: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-19 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-27844 CVE-2021-21159 CVE-2021-21160 CVE-2021-21161 CVE-2021-21162 CVE-2021-21163 CVE-2021-21165 CVE-2021-21166 CVE-2021-21167 CVE-2021-21168 CVE-2021-21169 CVE-2021-21170 CVE-2021-21171 CVE-2021-21172 CVE-2021-21173 CVE-2021-21174 CVE-2021-21175 CVE-2021-21176 CVE-2021-21177 CVE-2021-21178 CVE-2021-21179 CVE-2021-21180 CVE-2021-21181 CVE-2021-21182 CVE-2021-21183 CVE-2021-21184 CVE-2021-21185 CVE-2021-21186 CVE-2021-21187 CVE-2021-21188 CVE-2021-21189 CVE-2021-21190 CVE-2021-21191 CVE-2021-21192 CVE-2021-21193 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1633 Summary ======= The package vivaldi before version 3.7.2218.45-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation, access restriction bypass, content spoofing, incorrect calculation and information disclosure. Resolution ========== Upgrade to 3.7.2218.45-1. # pacman -Syu "vivaldi>=3.7.2218.45-1" The problems have been fixed upstream in version 3.7.2218.45. Workaround ========== None. Description =========== - CVE-2020-27844 (arbitrary code execution) A heap-based buffer overflow was discovered in lib/openjp2/t2.c:973 in the current master (commit 18b1138fbe3bb0ae4aa2bf1369f9430a8ec6fa00) of OpenJPEG. - CVE-2021-21159 (arbitrary code execution) A heap buffer overflow security issue was found in the TabStrip component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21160 (arbitrary code execution) A heap buffer overflow security issue was found in the WebAudio component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21161 (arbitrary code execution) A heap buffer overflow security issue was found in the TabStrip component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21162 (arbitrary code execution) A use after free security issue was found in the WebRTC component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21163 (insufficient validation) An insufficient data validation security issue was found in the Reader Mode component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21165 (arbitrary code execution) An object lifecycle security issue was found in the audio component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21166 (arbitrary code execution) An object lifecycle security issue was found in the audio component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21167 (arbitrary code execution) A use after free security issue was found in the bookmarks component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21168 (access restriction bypass) An insufficient policy enforcement security issue was found in the appcache component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21169 (information disclosure) An out of bounds memory access security issue was found in the V8 component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21170 (content spoofing) An incorrect security UI security issue was found in the Loader component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21171 (content spoofing) An incorrect security UI security issue was found in the TabStrip and Navigation components of the Chromium browser before version 89.0.4389.72. - CVE-2021-21172 (access restriction bypass) An insufficient policy enforcement security issue was found in the File System API component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21173 (information disclosure) A side-channel information leakage security issue was found in the Network Internals component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21174 (incorrect calculation) An inappropriate implementation security issue was found in the Referrer component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21175 (incorrect calculation) An inappropriate implementation security issue was found in the Site isolation component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21176 (incorrect calculation) An inappropriate implementation security issue was found in the full screen mode component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21177 (access restriction bypass) An insufficient policy enforcement security issue was found in the Autofill component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21178 (incorrect calculation) An inappropriate implementation security issue was found in the Compositing component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21179 (arbitrary code execution) A use after free security issue was found in the Network Internals component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21180 (arbitrary code execution) A use after free security issue was found in the tab search component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21181 (information disclosure) A side-channel information leakage security issue was found in the autofill component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21182 (access restriction bypass) An insufficient policy enforcement security issue was found in the navigations component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21183 (incorrect calculation) An inappropriate implementation security issue was found in the performance APIs component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21184 (incorrect calculation) An inappropriate implementation security issue was found in the performance APIs component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21185 (access restriction bypass) An insufficient policy enforcement security issue was found in the extensions component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21186 (access restriction bypass) An insufficient policy enforcement security issue was found in the QR scanning component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21187 (insufficient validation) An insufficient data validation security issue was found in the URL formatting component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21188 (arbitrary code execution) A use after free security issue was found in the Blink component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21189 (access restriction bypass) An insufficient policy enforcement security issue was found in the payments component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21190 (arbitrary code execution) An uninitialized use security issue was found in the PDFium component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21191 (arbitrary code execution) A use after free security issue was found in the WebRTC component of the Chromium browser before version 89.0.4389.90. - CVE-2021-21192 (arbitrary code execution) A heap buffer overflow security issue was found in the tab groups component of the Chromium browser before version 89.0.4389.90. - CVE-2021-21193 (arbitrary code execution) A use after free security issue was found in the Blink component of the Chromium browser before version 89.0.4389.90. Google is aware of reports that an exploit for this issue exists in the wild. Impact ====== A remote attacker might be able to bypass security measures, trick the user into performing unwanted actions or execute arbitrary code. References ========== https://vivaldi.com/blog/desktop/minor-update-2-for-vivaldi-desktop-3-6/ https://vivaldi.com/blog/vivaldi-fires-up-performance-2/ https://github.com/uclouvain/openjpeg/issues/1299 https://github.com/uclouvain/openjpeg/pull/1301 https://github.com/uclouvain/openjpeg/commit/73fdf28342e4594019af26eb6a347a… https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-des… https://crbug.com/1171049 https://crbug.com/1170531 https://crbug.com/1173702 https://crbug.com/1172054 https://crbug.com/1111239 https://crbug.com/1174582 https://crbug.com/1177465 https://crbug.com/1161144 https://crbug.com/1152226 https://crbug.com/1166138 https://crbug.com/1111646 https://crbug.com/1152894 https://crbug.com/1150810 https://crbug.com/1154250 https://crbug.com/1158010 https://crbug.com/1146651 https://crbug.com/1170584 https://crbug.com/1173879 https://crbug.com/1174186 https://crbug.com/1174943 https://crbug.com/1175507 https://crbug.com/1182767 https://crbug.com/1049265 https://crbug.com/1105875 https://crbug.com/1131929 https://crbug.com/1100748 https://crbug.com/1153445 https://crbug.com/1155516 https://crbug.com/1161739 https://crbug.com/1165392 https://crbug.com/1166091 https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-des… https://crbug.com/1167357 https://crbug.com/1181387 https://crbug.com/1186287 https://security.archlinux.org/CVE-2020-27844 https://security.archlinux.org/CVE-2021-21159 https://security.archlinux.org/CVE-2021-21160 https://security.archlinux.org/CVE-2021-21161 https://security.archlinux.org/CVE-2021-21162 https://security.archlinux.org/CVE-2021-21163 https://security.archlinux.org/CVE-2021-21165 https://security.archlinux.org/CVE-2021-21166 https://security.archlinux.org/CVE-2021-21167 https://security.archlinux.org/CVE-2021-21168 https://security.archlinux.org/CVE-2021-21169 https://security.archlinux.org/CVE-2021-21170 https://security.archlinux.org/CVE-2021-21171 https://security.archlinux.org/CVE-2021-21172 https://security.archlinux.org/CVE-2021-21173 https://security.archlinux.org/CVE-2021-21174 https://security.archlinux.org/CVE-2021-21175 https://security.archlinux.org/CVE-2021-21176 https://security.archlinux.org/CVE-2021-21177 https://security.archlinux.org/CVE-2021-21178 https://security.archlinux.org/CVE-2021-21179 https://security.archlinux.org/CVE-2021-21180 https://security.archlinux.org/CVE-2021-21181 https://security.archlinux.org/CVE-2021-21182 https://security.archlinux.org/CVE-2021-21183 https://security.archlinux.org/CVE-2021-21184 https://security.archlinux.org/CVE-2021-21185 https://security.archlinux.org/CVE-2021-21186 https://security.archlinux.org/CVE-2021-21187 https://security.archlinux.org/CVE-2021-21188 https://security.archlinux.org/CVE-2021-21189 https://security.archlinux.org/CVE-2021-21190 https://security.archlinux.org/CVE-2021-21191 https://security.archlinux.org/CVE-2021-21192 https://security.archlinux.org/CVE-2021-21193

1 0

[ASA-202103-18] libebml: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-18 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-3405 Package : libebml Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1554 Summary ======= The package libebml before version 1.4.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.4.2-1. # pacman -Syu "libebml>=1.4.2-1" The problem has been fixed upstream in version 1.4.2. Workaround ========== None. Description =========== A security issue was found in libebml before version 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml. Impact ====== A crafted file could execute arbitrary code. References ========== https://bugs.archlinux.org/task/70039 https://bugzilla.redhat.com/show_bug.cgi?id=1926990 https://github.com/Matroska-Org/libebml/issues/74 https://github.com/Matroska-Org/libebml/pull/76 https://github.com/Matroska-Org/libebml/commit/3d3d2cff9b012059fa7cb536399b… https://security.archlinux.org/CVE-2021-3405

1 0