June 2021 - Arch-security - lists.archlinux.org

[ASA-202106-7] lib32-libcurl-compat: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-7 ========================================= Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-22898 CVE-2021-22901 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1998 Summary ======= The package lib32-libcurl-compat before version 7.77.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 7.77.0-1. # pacman -Syu "lib32-libcurl-compat>=7.77.0-1" The problems have been fixed upstream in version 7.77.0. Workaround ========== - CVE-2021-22898 can be mitigated by avoiding to use the -t command line option and CURLOPT_TELNETOPTIONS. - No known workaround exists for CVE-2021-22901. Description =========== - CVE-2021-22898 (information disclosure) A security issue has been found in curl before version 7.77.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. - CVE-2021-22901 (arbitrary code execution) libcurl before version 7.77.0 can be tricked into using already freed memory when a new TLS session is negotiated or a client certificate is requested on an existing connection. For example, this can happen when a TLS server requests a client certificate on a connection that was established without one. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. The flaw can only happen in libcurl built to use OpenSSL. Impact ====== curl could disclose potentially sensitive memory information to a remote server over Telnet when an uncommon option is used. Additionally, a remote attacker could cause arbitrary code execution through a crafted TLS handshake. References ========== https://curl.se/docs/CVE-2021-22898.html https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde https://curl.se/docs/CVE-2021-22901.html https://github.com/curl/curl/commit/7f4a9a9b2a49547eae24d2e19bc5c346e9026479 https://security.archlinux.org/CVE-2021-22898 https://security.archlinux.org/CVE-2021-22901

1 0

[ASA-202106-6] libcurl-compat: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-6 ========================================= Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-22898 CVE-2021-22901 Package : libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1997 Summary ======= The package libcurl-compat before version 7.77.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 7.77.0-1. # pacman -Syu "libcurl-compat>=7.77.0-1" The problems have been fixed upstream in version 7.77.0. Workaround ========== - CVE-2021-22898 can be mitigated by avoiding to use the -t command line option and CURLOPT_TELNETOPTIONS. - No known workaround exists for CVE-2021-22901. Description =========== - CVE-2021-22898 (information disclosure) A security issue has been found in curl before version 7.77.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. - CVE-2021-22901 (arbitrary code execution) libcurl before version 7.77.0 can be tricked into using already freed memory when a new TLS session is negotiated or a client certificate is requested on an existing connection. For example, this can happen when a TLS server requests a client certificate on a connection that was established without one. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. The flaw can only happen in libcurl built to use OpenSSL. Impact ====== curl could disclose potentially sensitive memory information to a remote server over Telnet when an uncommon option is used. Additionally, a remote attacker could cause arbitrary code execution through a crafted TLS handshake. References ========== https://curl.se/docs/CVE-2021-22898.html https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde https://curl.se/docs/CVE-2021-22901.html https://github.com/curl/curl/commit/7f4a9a9b2a49547eae24d2e19bc5c346e9026479 https://security.archlinux.org/CVE-2021-22898 https://security.archlinux.org/CVE-2021-22901

1 0

[ASA-202106-5] lib32-curl: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-5 ========================================= Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-22898 CVE-2021-22901 Package : lib32-curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1996 Summary ======= The package lib32-curl before version 7.77.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 7.77.0-1. # pacman -Syu "lib32-curl>=7.77.0-1" The problems have been fixed upstream in version 7.77.0. Workaround ========== - CVE-2021-22898 can be mitigated by avoiding to use the -t command line option and CURLOPT_TELNETOPTIONS. - No known workaround exists for CVE-2021-22901. Description =========== - CVE-2021-22898 (information disclosure) A security issue has been found in curl before version 7.77.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. - CVE-2021-22901 (arbitrary code execution) libcurl before version 7.77.0 can be tricked into using already freed memory when a new TLS session is negotiated or a client certificate is requested on an existing connection. For example, this can happen when a TLS server requests a client certificate on a connection that was established without one. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. The flaw can only happen in libcurl built to use OpenSSL. Impact ====== curl could disclose potentially sensitive memory information to a remote server over Telnet when an uncommon option is used. Additionally, a remote attacker could cause arbitrary code execution through a crafted TLS handshake. References ========== https://curl.se/docs/CVE-2021-22898.html https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde https://curl.se/docs/CVE-2021-22901.html https://github.com/curl/curl/commit/7f4a9a9b2a49547eae24d2e19bc5c346e9026479 https://security.archlinux.org/CVE-2021-22898 https://security.archlinux.org/CVE-2021-22901

1 0

[ASA-202106-4] curl: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-4 ========================================= Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-22898 CVE-2021-22901 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1995 Summary ======= The package curl before version 7.77.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 7.77.0-1. # pacman -Syu "curl>=7.77.0-1" The problems have been fixed upstream in version 7.77.0. Workaround ========== - CVE-2021-22898 can be mitigated by avoiding to use the -t command line option and CURLOPT_TELNETOPTIONS. - No known workaround exists for CVE-2021-22901. Description =========== - CVE-2021-22898 (information disclosure) A security issue has been found in curl before version 7.77.0. curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. - CVE-2021-22901 (arbitrary code execution) libcurl before version 7.77.0 can be tricked into using already freed memory when a new TLS session is negotiated or a client certificate is requested on an existing connection. For example, this can happen when a TLS server requests a client certificate on a connection that was established without one. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client. The flaw can only happen in libcurl built to use OpenSSL. Impact ====== curl could disclose potentially sensitive memory information to a remote server over Telnet when an uncommon option is used. Additionally, a remote attacker could cause arbitrary code execution through a crafted TLS handshake. References ========== https://curl.se/docs/CVE-2021-22898.html https://github.com/curl/curl/commit/39ce47f219b09c380b81f89fe54ac586c8db6bde https://curl.se/docs/CVE-2021-22901.html https://github.com/curl/curl/commit/7f4a9a9b2a49547eae24d2e19bc5c346e9026479 https://security.archlinux.org/CVE-2021-22898 https://security.archlinux.org/CVE-2021-22901

1 0

[ASA-202106-3] firefox: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-3 ========================================= Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-29959 CVE-2021-29960 CVE-2021-29961 CVE-2021-29966 CVE-2021-29967 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2018 Summary ======= The package firefox before version 89.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, information disclosure and access restriction bypass. Resolution ========== Upgrade to 89.0-1. # pacman -Syu "firefox>=89.0-1" The problems have been fixed upstream in version 89.0. Workaround ========== None. Description =========== - CVE-2021-29959 (access restriction bypass) When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt. This was only possible if the website kept recording with the microphone until re- enabling the camera. - CVE-2021-29960 (information disclosure) Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk. - CVE-2021-29961 (content spoofing) When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface. - CVE-2021-29966 (arbitrary code execution) Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2021-29967 (arbitrary code execution) Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker could spoof the user interface, record audio and video without an additional prompt, or execute arbitrary code through crafted web pages. A local attacker could learn the title of a website visited during private browsing mode. References ========== https://www.mozilla.org/security/advisories/mfsa2021-23/ https://bugzilla.mozilla.org/show_bug.cgi?id=1395819 https://bugzilla.mozilla.org/show_bug.cgi?id=1675965 https://bugzilla.mozilla.org/show_bug.cgi?id=1700235 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1660307%2C1686154%2C1702948… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1602862%2C1703191%2C1703760… https://security.archlinux.org/CVE-2021-29959 https://security.archlinux.org/CVE-2021-29960 https://security.archlinux.org/CVE-2021-29961 https://security.archlinux.org/CVE-2021-29966 https://security.archlinux.org/CVE-2021-29967

1 0

[ASA-202106-2] chromium: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-2 ========================================= Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-30521 CVE-2021-30522 CVE-2021-30523 CVE-2021-30524 CVE-2021-30525 CVE-2021-30526 CVE-2021-30527 CVE-2021-30528 CVE-2021-30529 CVE-2021-30530 CVE-2021-30531 CVE-2021-30532 CVE-2021-30533 CVE-2021-30534 CVE-2021-30535 CVE-2021-30536 CVE-2021-30537 CVE-2021-30538 CVE-2021-30539 CVE-2021-30540 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1990 Summary ======= The package chromium before version 91.0.4472.77-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, insufficient validation and content spoofing. Resolution ========== Upgrade to 91.0.4472.77-1. # pacman -Syu "chromium>=91.0.4472.77-1" The problems have been fixed upstream in version 91.0.4472.77. Workaround ========== None. Description =========== - CVE-2021-30521 (arbitrary code execution) A heap buffer overflow security issue has been found in the Autofill component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30522 (arbitrary code execution) A use after free security issue has been found in the WebAudio component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30523 (arbitrary code execution) A use after free security issue has been found in the WebRTC component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30524 (arbitrary code execution) A use after free security issue has been found in the TabStrip component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30525 (arbitrary code execution) A use after free security issue has been found in the TabGroups component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30526 (arbitrary code execution) An out of bounds write security issue has been found in the TabStrip component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30527 (arbitrary code execution) A use after free security issue has been found in the WebUI component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30528 (arbitrary code execution) A use after free security issue has been found in the WebAuthentication component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30529 (arbitrary code execution) A use after free security issue has been found in the Bookmarks component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30530 (information disclosure) An out of bounds memory access security issue has been found in the WebAudio component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30531 (insufficient validation) An insufficient policy enforcement security issue has been found in the Content Security Policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30532 (insufficient validation) An insufficient policy enforcement security issue has been found in the Content Security Policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30533 (insufficient validation) An insufficient policy enforcement security issue has been found in the PopupBlocker component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30534 (insufficient validation) An insufficient policy enforcement security issue has been found in the iFrameSandbox component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30535 (arbitrary code execution) A double free security issue has been found in the ICU component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30536 (information disclosure) An out of bounds read security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30537 (insufficient validation) An insufficient policy enforcement security issue has been found in the cookies component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30538 (insufficient validation) An insufficient policy enforcement security issue has been found in the content security policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30539 (insufficient validation) An insufficient policy enforcement security issue has been found in the content security policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30540 (content spoofing) An incorrect security UI security issue has been found in the payments component of the Chromium browser before version 91.0.4472.77. Impact ====== A remote attacker could spoof content, disclose sensitive information, or execute arbitrary code through crafted web pages. References ========== https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-des… https://crbug.com/1208721 https://crbug.com/1176218 https://crbug.com/1187797 https://crbug.com/1197146 https://crbug.com/1197888 https://crbug.com/1198717 https://crbug.com/1199198 https://crbug.com/1206329 https://crbug.com/1195278 https://crbug.com/1201033 https://crbug.com/1115628 https://crbug.com/1117687 https://crbug.com/1145553 https://crbug.com/1151507 https://crbug.com/1194899 https://crbug.com/1194358 https://crbug.com/830101 https://crbug.com/1115045 https://crbug.com/971231 https://crbug.com/1184147 https://security.archlinux.org/CVE-2021-30521 https://security.archlinux.org/CVE-2021-30522 https://security.archlinux.org/CVE-2021-30523 https://security.archlinux.org/CVE-2021-30524 https://security.archlinux.org/CVE-2021-30525 https://security.archlinux.org/CVE-2021-30526 https://security.archlinux.org/CVE-2021-30527 https://security.archlinux.org/CVE-2021-30528 https://security.archlinux.org/CVE-2021-30529 https://security.archlinux.org/CVE-2021-30530 https://security.archlinux.org/CVE-2021-30531 https://security.archlinux.org/CVE-2021-30532 https://security.archlinux.org/CVE-2021-30533 https://security.archlinux.org/CVE-2021-30534 https://security.archlinux.org/CVE-2021-30535 https://security.archlinux.org/CVE-2021-30536 https://security.archlinux.org/CVE-2021-30537 https://security.archlinux.org/CVE-2021-30538 https://security.archlinux.org/CVE-2021-30539 https://security.archlinux.org/CVE-2021-30540

1 0

[ASA-202106-1] opera: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-1 ========================================= Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513 CVE-2021-30514 CVE-2021-30515 CVE-2021-30516 CVE-2021-30517 CVE-2021-30518 CVE-2021-30519 CVE-2021-30520 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1938 Summary ======= The package opera before version 76.0.4017.154-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, incorrect calculation and information disclosure. Resolution ========== Upgrade to 76.0.4017.154-1. # pacman -Syu "opera>=76.0.4017.154-1" The problems have been fixed upstream in version 76.0.4017.154. Workaround ========== None. Description =========== - CVE-2021-30506 (content spoofing) An incorrect security UI security issue has been found in the Web App Installs component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30507 (incorrect calculation) An inappropriate implementation security issue has been found in the Offline component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30508 (arbitrary code execution) A heap buffer overflow security issue has been found in the Media Feeds component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30509 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Strip component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30510 (arbitrary code execution) A race condition security issue has been found in the Aura component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30511 (information disclosure) An out of bounds read security issue has been found in the Tab Groups component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30512 (arbitrary code execution) A use after free security issue has been found in the Notifications component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30513 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30514 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30515 (arbitrary code execution) A use after free security issue has been found in the File API component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30516 (arbitrary code execution) A heap buffer overflow security issue has been found in the History component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30517 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30518 (arbitrary code execution) A heap buffer overflow security issue has been found in the Reader Mode component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30519 (arbitrary code execution) A use after free security issue has been found in the Payments component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30520 (arbitrary code execution) A use after free security issue has been found in the Tab Strip component of the Chromium browser before version 90.0.4430.212. Impact ====== A remote attacker could spoof content, disclose sensitive information, or execute arbitrary code through crafted web pages. References ========== https://blogs.opera.com/desktop/changelog-for-76/ https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-des… https://crbug.com/1180126 https://crbug.com/1178202 https://crbug.com/1195340 https://crbug.com/1196309 https://crbug.com/1197436 https://crbug.com/1197875 https://crbug.com/1200019 https://crbug.com/1200490 https://crbug.com/1200766 https://crbug.com/1201073 https://crbug.com/1201446 https://crbug.com/1203122 https://crbug.com/1203590 https://crbug.com/1194058 https://crbug.com/1193362 https://security.archlinux.org/CVE-2021-30506 https://security.archlinux.org/CVE-2021-30507 https://security.archlinux.org/CVE-2021-30508 https://security.archlinux.org/CVE-2021-30509 https://security.archlinux.org/CVE-2021-30510 https://security.archlinux.org/CVE-2021-30511 https://security.archlinux.org/CVE-2021-30512 https://security.archlinux.org/CVE-2021-30513 https://security.archlinux.org/CVE-2021-30514 https://security.archlinux.org/CVE-2021-30515 https://security.archlinux.org/CVE-2021-30516 https://security.archlinux.org/CVE-2021-30517 https://security.archlinux.org/CVE-2021-30518 https://security.archlinux.org/CVE-2021-30519 https://security.archlinux.org/CVE-2021-30520

1 0