June 2021 - Arch-security - lists.archlinux.org

[ASA-202106-37] aspnet-runtime: denial of service
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-37 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-31957 Package : aspnet-runtime Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2046 Summary ======= The package aspnet-runtime before version 5.0.7.sdk204-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.0.7.sdk204-1. # pacman -Syu "aspnet-runtime>=5.0.7.sdk204-1" The problem has been fixed upstream in version 5.0.7.sdk204. Workaround ========== None. Description =========== A denial of service vulnerability exists in .NET 5.0 before Runtime 5.0.7 and SDK 5.0.204 as well as .NET Core 3.1 before Runtime 3.1.16 and SDK 3.1.116 in ASP.NET. Impact ====== A remote attacker could crash an ASP.NET application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31957 https://github.com/dotnet/announcements/issues/189 https://security.archlinux.org/CVE-2021-31957

1 0

[ASA-202106-36] nginx: arbitrary code execution
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-36 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2021-23017 Package : nginx Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1988 Summary ======= The package nginx before version 1.20.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.20.1-1. # pacman -Syu "nginx>=1.20.1-1" The problem has been fixed upstream in version 1.20.1. Workaround ========== The issue can be mitigated by removing the "resolver" directive from the configuration file. Description =========== A security issue in nginx resolver was identified, which might allow an attacker to cause 1-byte memory overwrite by using a specially crafted DNS response, resulting in worker process crash or, potentially, in arbitrary code execution. The issue only affects nginx if the "resolver" directive is used in the configuration file. Further, the attack is only possible if an attacker is able to forge UDP packets from the DNS server. Impact ====== A remote attacker could crash the nginx server, or potentially execute arbitrary code, using a crafted DNS server response. References ========== https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html http://nginx.org/download/patch.2021.resolver.txt https://github.com/nginx/nginx/commit/7199ebc203f74fd9e44595474de6bdc41740c… https://security.archlinux.org/CVE-2021-23017

1 0

[ASA-202106-35] drupal: cross-site scripting
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-35 ========================================== Severity: High Date : 2021-06-15 CVE-ID : CVE-2021-33829 Package : drupal Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2069 Summary ======= The package drupal before version 9.1.10-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 9.1.10-1. # pacman -Syu "drupal>=9.1.10-1" The problem has been fixed upstream in version 9.1.10. Workaround ========== None. Description =========== Drupal core uses the third-party CKEditor library. This library has an error in parsing HTML that could lead to a cross-site scripting (XSS) attack. CKEditor 4.16.1 and later, as bundled with Drupal 9.1.9, include the fix. Impact ====== A remote attacker could execute arbitrary JavaScript code through cross-site scripting using crafted HTML code. References ========== https://www.drupal.org/sa-core-2021-003 https://ckeditor.com/blog/ckeditor-4.16.1-with-accessibility-enhancements/#… https://security.archlinux.org/CVE-2021-33829

1 0

[ASA-202106-34] intel-ucode: multiple issues
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-34 ========================================== Severity: High Date : 2021-06-15 CVE-ID : CVE-2020-24511 CVE-2020-24512 CVE-2020-24513 CVE-2021-24489 Package : intel-ucode Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2051 Summary ======= The package intel-ucode before version 20210608-1 is vulnerable to multiple issues including privilege escalation and information disclosure. Resolution ========== Upgrade to 20210608-1. # pacman -Syu "intel-ucode>=20210608-1" The problems have been fixed upstream in version 20210608. Workaround ========== None. Description =========== - CVE-2020-24511 (information disclosure) Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2020-24512 (information disclosure) Observable timing discrepancy in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2020-24513 (information disclosure) Domain-bypass transient execution vulnerability in some Intel Atom(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. - CVE-2021-24489 (privilege escalation) Incomplete cleanup in some Intel(R) VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access. Impact ====== A local attacker could escalate privileges or disclose sensitive information about the processor state using a side-channel attack. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/release… https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://security.archlinux.org/CVE-2020-24511 https://security.archlinux.org/CVE-2020-24512 https://security.archlinux.org/CVE-2020-24513 https://security.archlinux.org/CVE-2021-24489

1 0

[ASA-202106-33] opera: multiple issues
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-33 ========================================== Severity: High Date : 2021-06-15 CVE-ID : CVE-2021-30522 CVE-2021-30523 CVE-2021-30524 CVE-2021-30525 CVE-2021-30526 CVE-2021-30527 CVE-2021-30529 CVE-2021-30530 CVE-2021-30531 CVE-2021-30532 CVE-2021-30533 CVE-2021-30534 CVE-2021-30535 CVE-2021-30536 CVE-2021-30537 CVE-2021-30538 CVE-2021-30539 CVE-2021-30542 CVE-2021-30543 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1992 Summary ======= The package opera before version 77.0.4054.60-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and insufficient validation. Resolution ========== Upgrade to 77.0.4054.60-1. # pacman -Syu "opera>=77.0.4054.60-1" The problems have been fixed upstream in version 77.0.4054.60. Workaround ========== None. Description =========== - CVE-2021-30522 (arbitrary code execution) A use after free security issue has been found in the WebAudio component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30523 (arbitrary code execution) A use after free security issue has been found in the WebRTC component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30524 (arbitrary code execution) A use after free security issue has been found in the TabStrip component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30525 (arbitrary code execution) A use after free security issue has been found in the TabGroups component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30526 (arbitrary code execution) An out of bounds write security issue has been found in the TabStrip component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30527 (arbitrary code execution) A use after free security issue has been found in the WebUI component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30529 (arbitrary code execution) A use after free security issue has been found in the Bookmarks component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30530 (information disclosure) An out of bounds memory access security issue has been found in the WebAudio component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30531 (insufficient validation) An insufficient policy enforcement security issue has been found in the Content Security Policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30532 (insufficient validation) An insufficient policy enforcement security issue has been found in the Content Security Policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30533 (insufficient validation) An insufficient policy enforcement security issue has been found in the PopupBlocker component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30534 (insufficient validation) An insufficient policy enforcement security issue has been found in the iFrameSandbox component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30535 (arbitrary code execution) A double free security issue has been found in the ICU component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30536 (information disclosure) An out of bounds read security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30537 (insufficient validation) An insufficient policy enforcement security issue has been found in the cookies component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30538 (insufficient validation) An insufficient policy enforcement security issue has been found in the content security policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30539 (insufficient validation) An insufficient policy enforcement security issue has been found in the content security policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30542 (arbitrary code execution) A use after free security issue has been found in the Tab Strip component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30543 (arbitrary code execution) A use after free security issue has been found in the Tab Strip component of the Chromium browser before version 91.0.4472.77. Impact ====== A remote attacker could spoof content, disclose sensitive information, or execute arbitrary code through crafted web pages. References ========== https://blogs.opera.com/desktop/changelog-for-76/ https://blogs.opera.com/desktop/changelog-for-77/ https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-des… https://crbug.com/1176218 https://crbug.com/1187797 https://crbug.com/1197146 https://crbug.com/1197888 https://crbug.com/1198717 https://crbug.com/1199198 https://crbug.com/1195278 https://crbug.com/1201033 https://crbug.com/1115628 https://crbug.com/1117687 https://crbug.com/1145553 https://crbug.com/1151507 https://crbug.com/1194899 https://crbug.com/1194358 https://crbug.com/830101 https://crbug.com/1115045 https://crbug.com/971231 https://crbug.com/1184954 https://crbug.com/1203607 https://security.archlinux.org/CVE-2021-30522 https://security.archlinux.org/CVE-2021-30523 https://security.archlinux.org/CVE-2021-30524 https://security.archlinux.org/CVE-2021-30525 https://security.archlinux.org/CVE-2021-30526 https://security.archlinux.org/CVE-2021-30527 https://security.archlinux.org/CVE-2021-30529 https://security.archlinux.org/CVE-2021-30530 https://security.archlinux.org/CVE-2021-30531 https://security.archlinux.org/CVE-2021-30532 https://security.archlinux.org/CVE-2021-30533 https://security.archlinux.org/CVE-2021-30534 https://security.archlinux.org/CVE-2021-30535 https://security.archlinux.org/CVE-2021-30536 https://security.archlinux.org/CVE-2021-30537 https://security.archlinux.org/CVE-2021-30538 https://security.archlinux.org/CVE-2021-30539 https://security.archlinux.org/CVE-2021-30542 https://security.archlinux.org/CVE-2021-30543

1 0

[ASA-202106-32] vivaldi: multiple issues
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-32 ========================================== Severity: Critical Date : 2021-06-15 CVE-ID : CVE-2021-30544 CVE-2021-30545 CVE-2021-30546 CVE-2021-30547 CVE-2021-30548 CVE-2021-30549 CVE-2021-30550 CVE-2021-30551 CVE-2021-30552 CVE-2021-30553 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2058 Summary ======= The package vivaldi before version 4.0.2312.25-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 4.0.2312.25-1. # pacman -Syu "vivaldi>=4.0.2312.25-1" The problems have been fixed upstream in version 4.0.2312.25. Workaround ========== None. Description =========== - CVE-2021-30544 (arbitrary code execution) A use after free security issue has been found in the BFCache component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30545 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30546 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30547 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30548 (arbitrary code execution) A use after free security issue has been found in the Loader component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30549 (arbitrary code execution) A use after free security issue has been found in the Spell check component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30550 (arbitrary code execution) A use after free security issue has been found in the Accessibility component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30551 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.101. Google is aware that an exploit for CVE-2021-30551 exists in the wild. - CVE-2021-30552 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30553 (arbitrary code execution) A use after free security issue has been found in the Network service component of the Chromium browser before version 91.0.4472.101. Impact ====== A remote attacker could execute arbitrary code through a crafted web page or extension. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://vivaldi.com/blog/desktop/minor-update-for-vivaldi-desktop-browser-4… https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1212618 https://crbug.com/1201031 https://crbug.com/1206911 https://crbug.com/1210414 https://crbug.com/1210487 https://crbug.com/1212498 https://crbug.com/1212500 https://crbug.com/1216437 https://crbug.com/1200679 https://crbug.com/1209769 https://security.archlinux.org/CVE-2021-30544 https://security.archlinux.org/CVE-2021-30545 https://security.archlinux.org/CVE-2021-30546 https://security.archlinux.org/CVE-2021-30547 https://security.archlinux.org/CVE-2021-30548 https://security.archlinux.org/CVE-2021-30549 https://security.archlinux.org/CVE-2021-30550 https://security.archlinux.org/CVE-2021-30551 https://security.archlinux.org/CVE-2021-30552 https://security.archlinux.org/CVE-2021-30553

1 0

[ASA-202106-31] chromium: multiple issues
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-31 ========================================== Severity: Critical Date : 2021-06-15 CVE-ID : CVE-2021-30544 CVE-2021-30545 CVE-2021-30546 CVE-2021-30547 CVE-2021-30548 CVE-2021-30549 CVE-2021-30550 CVE-2021-30551 CVE-2021-30552 CVE-2021-30553 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2057 Summary ======= The package chromium before version 91.0.4472.101-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 91.0.4472.101-1. # pacman -Syu "chromium>=91.0.4472.101-1" The problems have been fixed upstream in version 91.0.4472.101. Workaround ========== None. Description =========== - CVE-2021-30544 (arbitrary code execution) A use after free security issue has been found in the BFCache component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30545 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30546 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30547 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30548 (arbitrary code execution) A use after free security issue has been found in the Loader component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30549 (arbitrary code execution) A use after free security issue has been found in the Spell check component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30550 (arbitrary code execution) A use after free security issue has been found in the Accessibility component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30551 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.101. Google is aware that an exploit for CVE-2021-30551 exists in the wild. - CVE-2021-30552 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30553 (arbitrary code execution) A use after free security issue has been found in the Network service component of the Chromium browser before version 91.0.4472.101. Impact ====== A remote attacker could execute arbitrary code through a crafted web page or extension. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1212618 https://crbug.com/1201031 https://crbug.com/1206911 https://crbug.com/1210414 https://crbug.com/1210487 https://crbug.com/1212498 https://crbug.com/1212500 https://crbug.com/1216437 https://crbug.com/1200679 https://crbug.com/1209769 https://security.archlinux.org/CVE-2021-30544 https://security.archlinux.org/CVE-2021-30545 https://security.archlinux.org/CVE-2021-30546 https://security.archlinux.org/CVE-2021-30547 https://security.archlinux.org/CVE-2021-30548 https://security.archlinux.org/CVE-2021-30549 https://security.archlinux.org/CVE-2021-30550 https://security.archlinux.org/CVE-2021-30551 https://security.archlinux.org/CVE-2021-30552 https://security.archlinux.org/CVE-2021-30553

1 0

[ASA-202106-30] wireshark-cli: denial of service
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-30 ========================================== Severity: Low Date : 2021-06-09 CVE-ID : CVE-2021-22222 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2037 Summary ======= The package wireshark-cli before version 3.4.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.4.6-1. # pacman -Syu "wireshark-cli>=3.4.6-1" The problem has been fixed upstream in version 3.4.6. Workaround ========== None. Description =========== An infinite loop in the DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows a denial of service via packet injection or a crafted capture file. Impact ====== A remote attacker could crash Wireshark with crafted DVB-S2 packets via packet injection or a crafted capture file. References ========== https://www.wireshark.org/security/wnpa-sec-2021-05 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22222.json https://gitlab.com/wireshark/wireshark/-/merge_requests/3130 https://gitlab.com/wireshark/wireshark/-/commit/0d8be1fb797b3d65f1c2c204da7… https://security.archlinux.org/CVE-2021-22222

1 0

[ASA-202106-29] kube-apiserver: insufficient validation
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-29 ========================================== Severity: Low Date : 2021-06-09 CVE-ID : CVE-2021-25737 Package : kube-apiserver Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1970 Summary ======= The package kube-apiserver before version 1.21.1-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.21.1-1. # pacman -Syu "kube-apiserver>=1.21.1-1" The problem has been fixed upstream in version 1.21.1. Workaround ========== To mitigate this vulnerability without upgrading kube-apiserver, you can create a validating admission webhook that prevents EndpointSlices with endpoint addresses in the 127.0.0.0/8 and 169.254.0.0/16 ranges. If you have an existing admission policy mechanism (like OPA Gatekeeper) you can create a policy that enforces this restriction. Description =========== A security issue was discovered in kube-apiserver before version 1.21.1 where a user may be able to redirect pod traffic to private networks on a node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs. Impact ====== A user could redirect pod traffic to private networks on a node. References ========== https://github.com/kubernetes/kubernetes/issues/102106 https://github.com/kubernetes/kubernetes/pull/101084 https://github.com/kubernetes/kubernetes/commit/233c8d6eeef9e7a259c39dd1db0… https://security.archlinux.org/CVE-2021-25737

1 0

[ASA-202106-28] nettle: denial of service
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-28 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-3580 Package : nettle Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2052 Summary ======= The package nettle before version 3.7.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.7.3-1. # pacman -Syu "nettle>=3.7.3-1" The problem has been fixed upstream in version 3.7.3. Workaround ========== None. Description =========== Multiple issues were found with Nettle's RSA decryption functions before version 3.7.3. These can be triggered by providing manipulated ciphertext and could lead to application crash and denial of service. Since nettle is used with gnuTLS, there is a possibility that a remote client could crash a server compiled with gnuTLS when RSA is used for the initial key exchange. Impact ====== A remote attacker could crash an application using Nettle with a crafted RSA ciphertext. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1967983 https://git.lysator.liu.se/nettle/nettle/-/commit/0ad0b5df315665250dfdaa4a1… https://git.lysator.liu.se/nettle/nettle/-/commit/485b5e2820a057e873b1ba812… https://security.archlinux.org/CVE-2021-3580

1 0