June 2021 - Arch-security - lists.archlinux.org

[ASA-202106-47] vivaldi: arbitrary code execution
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-47 ========================================== Severity: High Date : 2021-06-22 CVE-ID : CVE-2021-30554 CVE-2021-30555 CVE-2021-30556 CVE-2021-30557 Package : vivaldi Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2082 Summary ======= The package vivaldi before version 4.0.2312.33-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.0.2312.33-1. # pacman -Syu "vivaldi>=4.0.2312.33-1" The problems have been fixed upstream in version 4.0.2312.33. Workaround ========== None. Description =========== - CVE-2021-30554 (arbitrary code execution) A use after free security issue has been found in the WebGL component of the Chromium browser engine before version 91.0.4472.114. Google is aware that an exploit for CVE-2021-30554 exists in the wild. - CVE-2021-30555 (arbitrary code execution) A use after free security issue has been found in the Sharing component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30556 (arbitrary code execution) A use after free security issue has been found in the WebAudio component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30557 (arbitrary code execution) A use after free security issue has been found in the TabGroups component of the Chromium browser engine before version 91.0.4472.114. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://vivaldi.com/blog/desktop/minor-update-for-vivaldi-desktop-browser-4… https://vivaldi.com/blog/desktop/minor-update-3-for-vivaldi-desktop-browser… https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1219857 https://crbug.com/1215029 https://crbug.com/1212599 https://crbug.com/1202102 https://security.archlinux.org/CVE-2021-30554 https://security.archlinux.org/CVE-2021-30555 https://security.archlinux.org/CVE-2021-30556 https://security.archlinux.org/CVE-2021-30557

1 0

[ASA-202106-46] chromium: arbitrary code execution
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-46 ========================================== Severity: High Date : 2021-06-22 CVE-ID : CVE-2021-30554 CVE-2021-30555 CVE-2021-30556 CVE-2021-30557 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2081 Summary ======= The package chromium before version 91.0.4472.114-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 91.0.4472.114-1. # pacman -Syu "chromium>=91.0.4472.114-1" The problems have been fixed upstream in version 91.0.4472.114. Workaround ========== None. Description =========== - CVE-2021-30554 (arbitrary code execution) A use after free security issue has been found in the WebGL component of the Chromium browser engine before version 91.0.4472.114. Google is aware that an exploit for CVE-2021-30554 exists in the wild. - CVE-2021-30555 (arbitrary code execution) A use after free security issue has been found in the Sharing component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30556 (arbitrary code execution) A use after free security issue has been found in the WebAudio component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30557 (arbitrary code execution) A use after free security issue has been found in the TabGroups component of the Chromium browser engine before version 91.0.4472.114. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1219857 https://crbug.com/1215029 https://crbug.com/1212599 https://crbug.com/1202102 https://security.archlinux.org/CVE-2021-30554 https://security.archlinux.org/CVE-2021-30555 https://security.archlinux.org/CVE-2021-30556 https://security.archlinux.org/CVE-2021-30557

1 0

[ASA-202106-45] opera: multiple issues
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-45 ========================================== Severity: Critical Date : 2021-06-22 CVE-ID : CVE-2021-30544 CVE-2021-30545 CVE-2021-30546 CVE-2021-30547 CVE-2021-30548 CVE-2021-30549 CVE-2021-30550 CVE-2021-30551 CVE-2021-30552 CVE-2021-30553 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2059 Summary ======= The package opera before version 77.0.4054.90-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 77.0.4054.90-1. # pacman -Syu "opera>=77.0.4054.90-1" The problems have been fixed upstream in version 77.0.4054.90. Workaround ========== None. Description =========== - CVE-2021-30544 (arbitrary code execution) A use after free security issue has been found in the BFCache component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30545 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30546 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30547 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30548 (arbitrary code execution) A use after free security issue has been found in the Loader component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30549 (arbitrary code execution) A use after free security issue has been found in the Spell check component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30550 (arbitrary code execution) A use after free security issue has been found in the Accessibility component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30551 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.101. Google is aware that an exploit for CVE-2021-30551 exists in the wild. - CVE-2021-30552 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30553 (arbitrary code execution) A use after free security issue has been found in the Network service component of the Chromium browser before version 91.0.4472.101. Impact ====== A remote attacker could execute arbitrary code through a crafted web page or extension. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://blogs.opera.com/desktop/changelog-for-77/ https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1212618 https://crbug.com/1201031 https://crbug.com/1206911 https://crbug.com/1210414 https://crbug.com/1210487 https://crbug.com/1212498 https://crbug.com/1212500 https://crbug.com/1216437 https://crbug.com/1200679 https://crbug.com/1209769 https://security.archlinux.org/CVE-2021-30544 https://security.archlinux.org/CVE-2021-30545 https://security.archlinux.org/CVE-2021-30546 https://security.archlinux.org/CVE-2021-30547 https://security.archlinux.org/CVE-2021-30548 https://security.archlinux.org/CVE-2021-30549 https://security.archlinux.org/CVE-2021-30550 https://security.archlinux.org/CVE-2021-30551 https://security.archlinux.org/CVE-2021-30552 https://security.archlinux.org/CVE-2021-30553

1 0

[ASA-202106-44] connman: arbitrary code execution
by Jonas Witschel 18 Jun '21

18 Jun '21

Arch Linux Security Advisory ASA-202106-44 ========================================== Severity: High Date : 2021-06-16 CVE-ID : CVE-2021-33833 Package : connman Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2055 Summary ======= The package connman before version 1.40-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.40-1. # pacman -Syu "connman>=1.40-1" The problem has been fixed upstream in version 1.40. Workaround ========== None. Description =========== A security issue has been found in the dnsproxy component of connman in releases 1.32 to 1.39. Unpacking of NAME and RDATA/RDLENGTH fields with TYPE A/AAAA in the uncompress function uses a memcpy with insufficient bounds checking, which can overflow a stack buffer. Impact ====== A remote attacker might be able to execute arbitrary code on the victim's host. References ========== https://www.openwall.com/lists/oss-security/2021/06/09/1 https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=eceb2… https://security.archlinux.org/CVE-2021-33833

1 0

[ASA-202106-43] grub: multiple issues
by Jonas Witschel 18 Jun '21

18 Jun '21

Arch Linux Security Advisory ASA-202106-43 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 CVE-2021-20233 Package : grub Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1629 Summary ======= The package grub before version 2:2.06-1 is vulnerable to multiple issues including access restriction bypass and arbitrary code execution. Resolution ========== Upgrade to 2:2.06-1. # pacman -Syu "grub>=2:2.06-1" The problems have been fixed upstream in version 2.06. Workaround ========== None. Description =========== - CVE-2020-14372 (arbitrary code execution) GRUB2 enables the use of the command acpi even when secure boot is signaled by the firmware. An attacker with local root privileges can drop a small SSDT in /boot/efi and modify grub.cfg to instruct grub to load said SSDT. The SSDT then gets run by the kernel and it overwrites the kernel lockdown configuration enabling the attacker to load unsigned kernel modules and kexec unsigned code. - CVE-2020-25632 (arbitrary code execution) The rmmod implementation for grub2 is flawed, allowing an attacker to unload a module used as a dependency without checking if any other dependent module is still loaded. This leads to a use-after-free scenario possibly allowing an attacker to execute arbitrary code and by-pass Secure Boot protections. - CVE-2020-25647 (arbitrary code execution) grub_usb_device_initialize() is called to handle USB device initialization. It reads out the descriptors it needs from the USB device and uses that data to fill in some USB data structures. grub_usb_device_initialize() performs very little bounds checking and simply assumes the USB device provides sane values. This behavior can trigger memory corruption. If properly exploited, this would lead to arbitrary code execution allowing the attacker to bypass the Secure Boot mechanism. - CVE-2020-27749 (arbitrary code execution) grub_parser_split_cmdline() expands variable names present in the supplied command line in to their corresponding variable contents and uses a 1kB stack buffer for temporary storage without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution. An attacker may use this to circumvent Secure Boot protections. - CVE-2020-27779 (access restriction bypass) The GRUB2's cutmem command does not honor Secure Boot locking. This allows an privileged attacker to remove address ranges from memory creating an opportunity to circumvent Secure Boot protections after proper triage of grub's memory layout. - CVE-2021-20225 (arbitrary code execution) The option parser in GRUB2 allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. - CVE-2021-20233 (arbitrary code execution) There's a flaw in GRUB2 menu rendering code setparam_prefix() in the menu rendering code. It performs a length calculation under the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters. This allow an attacker to corrupt memory by one byte for each quote in the input. Impact ====== When secure boot is enabled, complete subversion of the integrity prospects can be achieved through malicious use of existing commands, side-loaded modules, command acpi, rmmod, variable referencing and option parsers. References ========== https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=3e8e4c0549240fa2… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=7630ec5397fe4182… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=128c16a682034263… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=4ea7bae51f97e49c… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=d298b41f90cbf1f2… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=2a330dba93ff11bc… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=2f533a89a8dfcacb… https://security.archlinux.org/CVE-2020-14372 https://security.archlinux.org/CVE-2020-25632 https://security.archlinux.org/CVE-2020-25647 https://security.archlinux.org/CVE-2020-27749 https://security.archlinux.org/CVE-2020-27779 https://security.archlinux.org/CVE-2021-20225 https://security.archlinux.org/CVE-2021-20233

1 0

[ASA-202106-42] go: multiple issues
by Jonas Witschel 18 Jun '21

18 Jun '21

Arch Linux Security Advisory ASA-202106-42 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-33195 CVE-2021-33196 CVE-2021-33197 CVE-2021-33198 Package : go Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2006 Summary ======= The package go before version 2:1.16.5-1 is vulnerable to multiple issues including insufficient validation, url request injection and denial of service. Resolution ========== Upgrade to 2:1.16.5-1. # pacman -Syu "go>=2:1.16.5-1" The problems have been fixed upstream in version 1.16.5. Workaround ========== None. Description =========== - CVE-2021-33195 (insufficient validation) A security issue has been found in Go before version 1.16.5. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in net, and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for instance unsafely included in HTML, they may allow for injection of unexpected content. Note that LookupTXT may still return arbitrary values that could require sanitization before further use. - CVE-2021-33196 (denial of service) A security issue has been found in Go before version 1.16.5. Due to a pre-allocation optimization in zip.NewReader, a malformed archive which indicates it has a significant number of files can cause either a panic or memory exhaustion. - CVE-2021-33197 (url request injection) A security issue has been found in Go before version 1.16.5. ReverseProxy in net/http/httputil could be made to forward certain hop- by-hop headers, including Connection. In case the target of the ReverseProxy was itself a reverse proxy, this would let an attacker drop arbitrary headers, including those set by the ReverseProxy.Director. - CVE-2021-33198 (denial of service) A security issue has been found in Go before version 1.16.5. The SetString and UnmarshalText methods of math/big.Rat may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents. Impact ====== An attacker could crash an application with crafted input, inject malicious and unexpected content or drop HTTP headers by posing as a reverse proxy. References ========== https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI/m/r_EP-NlKBgAJ https://github.com/golang/go/issues/46241 https://github.com/golang/go/commit/df6a737cc899507d3090e995abd1e1ed1a30cee3 https://github.com/golang/go/issues/46242 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33912 https://github.com/golang/go/commit/895fb1bb6fc0d3c01c5ef7c8cbaf033d1fff9ad7 https://github.com/golang/go/issues/46313 https://github.com/golang/go/commit/0410005dc458f23fb15f64354f9a24ca8f2fe044 https://github.com/golang/go/issues/45910 https://github.com/golang/go/commit/9210eaf7dc704612a6eda97c482012f779fd833b https://security.archlinux.org/CVE-2021-33195 https://security.archlinux.org/CVE-2021-33196 https://security.archlinux.org/CVE-2021-33197 https://security.archlinux.org/CVE-2021-33198

1 0

[ASA-202106-41] python-django: multiple issues
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-41 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-33203 CVE-2021-33571 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2026 Summary ======= The package python-django before version 3.2.4-1 is vulnerable to multiple issues including insufficient validation and directory traversal. Resolution ========== Upgrade to 3.2.4-1. # pacman -Syu "python-django>=3.2.4-1" The problems have been fixed upstream in version 3.2.4. Workaround ========== None. Description =========== - CVE-2021-33203 (directory traversal) A security issue has been found in Django before version 3.2.4. Staff members could use the admindocs TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by the developers to also expose the file contents, then not only the existence but also the file contents would have been exposed. - CVE-2021-33571 (insufficient validation) A security issue has been found in Django before version 3.2.4. URLValidator, validate_ipv4_address(), and validate_ipv46_address() didn't prohibit leading zeros in octal literals. If you used such values you could suffer from indeterminate SSRF, RFI, and LFI attacks. validate_ipv4_address() and validate_ipv46_address() validators were not affected on Python 3.9.5+. Impact ====== User accounts with staff privileges could check for the existence of arbitrary files, and possibly disclose their contents. Additionally, leading zeros in IPv4 addresses could be used to bypass IP-based access restrictions. References ========== https://www.djangoproject.com/weblog/2021/jun/02/security-releases/#s-cve-2… https://github.com/django/django/commit/dfaba12cda060b8b292ae1d271b44bf810b… https://www.djangoproject.com/weblog/2021/jun/02/security-releases/#s-cve-2… https://github.com/django/django/commit/9f75e2e562fa0c0482f3dde6fc7399a9070… https://security.archlinux.org/CVE-2021-33203 https://security.archlinux.org/CVE-2021-33571

1 0

[ASA-202106-40] radare2: denial of service
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-40 ========================================== Severity: Low Date : 2021-06-15 CVE-ID : CVE-2021-32613 Package : radare2 Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1950 Summary ======= The package radare2 before version 5.3.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.3.1-1. # pacman -Syu "radare2>=5.3.1-1" The problem has been fixed upstream in version 5.3.1. Workaround ========== None. Description =========== In radare2 through 5.3.0 there is a double free vulnerability in the pyc parser via a crafted file which can lead to denial of service. Impact ====== A crafted Python bytecode file could crash the parser. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1959939 https://github.com/radareorg/radare2/issues/18679 https://github.com/radareorg/radare2/commit/049de62730f4954ef9a642f2eeebbca… https://security.archlinux.org/CVE-2021-32613

1 0

[ASA-202106-39] thefuck: arbitrary file overwrite
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-39 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-34363 Package : thefuck Type : arbitrary file overwrite Remote : No Link : https://security.archlinux.org/AVG-2062 Summary ======= The package thefuck before version 3.31-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 3.31-1. # pacman -Syu "thefuck>=3.31-1" The problem has been fixed upstream in version 3.31. Workaround ========== None. Description =========== The thefuck package before 3.31 allows path traversal that leads to arbitrary file deletion via the "undo archive operation" feature. Impact ====== An attacker could delete arbitrary files by tricking a user to use the "undo archive operation" feature on a crafted archive file. References ========== https://vuln.ryotak.me/advisories/48 https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e02… https://security.archlinux.org/CVE-2021-34363

1 0

[ASA-202106-38] aspnet-runtime-3.1: denial of service
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-38 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-31957 Package : aspnet-runtime-3.1 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2047 Summary ======= The package aspnet-runtime-3.1 before version 3.1.16.sdk116-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.1.16.sdk116-1. # pacman -Syu "aspnet-runtime-3.1>=3.1.16.sdk116-1" The problem has been fixed upstream in version 3.1.16.sdk116. Workaround ========== None. Description =========== A denial of service vulnerability exists in .NET 5.0 before Runtime 5.0.7 and SDK 5.0.204 as well as .NET Core 3.1 before Runtime 3.1.16 and SDK 3.1.116 in ASP.NET. Impact ====== A remote attacker could crash an ASP.NET application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31957 https://github.com/dotnet/announcements/issues/189 https://security.archlinux.org/CVE-2021-31957

1 0