July 2021 - Arch-security - lists.archlinux.org

[ASA-202107-54] jre11-openjdk-headless: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-54 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-2341 CVE-2021-2369 CVE-2021-2388 Package : jre11-openjdk-headless Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2189 Summary ======= The package jre11-openjdk-headless before version 11.0.12.u7-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 11.0.12.u7-1. # pacman -Syu "jre11-openjdk-headless>=11.0.12.u7-1" The problems have been fixed upstream in version 11.0.12.u7. Workaround ========== None. Description =========== - CVE-2021-2341 (information disclosure) A security issue has been found in the Networking component of OpenJDK versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise OpenJDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of OpenJDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). - CVE-2021-2369 (arbitrary code execution) A security issue has been found in the Library component of OpenJDK versions 7u301, 8u291, 11.0.11 and 16.0.1. An easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise OpenJDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of the OpenJDK accessible data. Note : This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). - CVE-2021-2388 (arbitrary code execution) A security issue has been found in the Hotspot component of OpenJDK versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise OpenJDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of OpenJDK. Note : This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). Impact ====== A malicious Java application could bypass security restrictions to run arbitrary code or disclose sensitive information. References ========== https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-July/006954.ht… https://openjdk.java.net/groups/vulnerability/advisories/2021-07-20 https://www.oracle.com/security-alerts/cpujul2021verbose.html#JAVA https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8258432 https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/ca23657dc7da https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8260967 https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/e23ebe923867 https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8264066 https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/3588c0c6655e https://security.archlinux.org/CVE-2021-2341 https://security.archlinux.org/CVE-2021-2369 https://security.archlinux.org/CVE-2021-2388

1 0

[ASA-202107-53] jdk11-openjdk: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-53 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-2341 CVE-2021-2369 CVE-2021-2388 Package : jdk11-openjdk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2189 Summary ======= The package jdk11-openjdk before version 11.0.12.u7-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 11.0.12.u7-1. # pacman -Syu "jdk11-openjdk>=11.0.12.u7-1" The problems have been fixed upstream in version 11.0.12.u7. Workaround ========== None. Description =========== - CVE-2021-2341 (information disclosure) A security issue has been found in the Networking component of OpenJDK versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise OpenJDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of OpenJDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). - CVE-2021-2369 (arbitrary code execution) A security issue has been found in the Library component of OpenJDK versions 7u301, 8u291, 11.0.11 and 16.0.1. An easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise OpenJDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of the OpenJDK accessible data. Note : This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). - CVE-2021-2388 (arbitrary code execution) A security issue has been found in the Hotspot component of OpenJDK versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise OpenJDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of OpenJDK. Note : This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). Impact ====== A malicious Java application could bypass security restrictions to run arbitrary code or disclose sensitive information. References ========== https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-July/006954.ht… https://openjdk.java.net/groups/vulnerability/advisories/2021-07-20 https://www.oracle.com/security-alerts/cpujul2021verbose.html#JAVA https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8258432 https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/ca23657dc7da https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8260967 https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/e23ebe923867 https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8264066 https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/3588c0c6655e https://security.archlinux.org/CVE-2021-2341 https://security.archlinux.org/CVE-2021-2369 https://security.archlinux.org/CVE-2021-2388

1 0

[ASA-202107-52] virtualbox: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-52 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-2409 CVE-2021-2442 CVE-2021-2443 CVE-2021-2454 Package : virtualbox Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2187 Summary ======= The package virtualbox before version 6.1.24-1 is vulnerable to multiple issues including information disclosure, sandbox escape and denial of service. Resolution ========== Upgrade to 6.1.24-1. # pacman -Syu "virtualbox>=6.1.24-1" The problems have been fixed upstream in version 6.1.24. Workaround ========== None. Description =========== - CVE-2021-2409 (sandbox escape) A security issue has been found in Oracle VM VirtualBox before version 6.1.24. An easily exploitable vulnerability allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in a takeover of Oracle VM VirtualBox. - CVE-2021-2442 (denial of service) A security issue has been found in Oracle VM VirtualBox before version 6.1.24. An easily exploitable vulnerability allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of Oracle VM VirtualBox. - CVE-2021-2443 (information disclosure) A security issue has been found in Oracle VM VirtualBox before version 6.1.24. An easily exploitable vulnerability allows a high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in the unauthorized ability to cause a hang or frequently repeatable crash (complete denial of service) of Oracle VM VirtualBox as well as unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data and unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2021-2454 (sandbox escape) A security issue has been found in Oracle VM VirtualBox before version 6.1.24. A difficult to exploit vulnerability allows a low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in a takeover of Oracle VM VirtualBox. Impact ====== A malicious virtual machine guest could escape its confinement to run arbitrary code on the host system, disclose or modify sensitive information, or crash VirtualBox. References ========== https://www.oracle.com/security-alerts/cpujul2021verbose.html#OVIR https://security.archlinux.org/CVE-2021-2409 https://security.archlinux.org/CVE-2021-2442 https://security.archlinux.org/CVE-2021-2443 https://security.archlinux.org/CVE-2021-2454

1 0

[ASA-202107-51] linux-lts: privilege escalation
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-51 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-3609 CVE-2021-3612 CVE-2021-33909 Package : linux-lts Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2184 Summary ======= The package linux-lts before version 5.10.52-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.10.52-1. # pacman -Syu "linux-lts>=5.10.52-1" The problems have been fixed upstream in version 5.10.52. Workaround ========== None. Description =========== - CVE-2021-3609 (privilege escalation) A race condition in net/can/bcm.c in the Linux kernel before version 5.13.2 allows for local privilege escalation to root. The CAN BCM networking protocol allows to register a CAN message receiver for a specified socket. The function bcm_rx_handler() is run for incoming CAN messages. Simultaneously to running this function, the socket can be closed and bcm_release() will be called. Inside bcm_release(), struct bcm_op and struct bcm_sock are freed while bcm_rx_handler() is still running, finally leading to multiple use-after-free's. - CVE-2021-3612 (privilege escalation) An out-of-bounds memory write security issue was found in the Linux kernel’s joystick devices subsystem before version 5.13.2, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. - CVE-2021-33909 (privilege escalation) An privilege escalation security issue has been found in the filesystem layer of the Linux kernel before version 5.13.4. An unprivileged local attacker can obtain full root privileges by creating, mounting, and deleting a deep directory structure whose total path length exceeds 1GB, which leads to an uncontrolled out-of-bounds write. Impact ====== An unprivileged local attacker could obtain full root privileges or crash the system. References ========== https://www.openwall.com/lists/oss-security/2021/06/19/1 https://www.openwall.com/lists/oss-security/2021/06/19/2 https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://bugzilla.redhat.com/show_bug.cgi?id=1974079 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-es… https://www.qualys.com/2021/07/20/cve-2021-33909/cve-2021-33909-crasher.c https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2021-3609 https://security.archlinux.org/CVE-2021-3612 https://security.archlinux.org/CVE-2021-33909

1 0

[ASA-202107-50] linux-hardened: privilege escalation
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-50 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-3609 CVE-2021-3612 CVE-2021-33909 Package : linux-hardened Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2183 Summary ======= The package linux-hardened before version 5.12.19.hardened1-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.12.19.hardened1-1. # pacman -Syu "linux-hardened>=5.12.19.hardened1-1" The problems have been fixed upstream in version 5.12.19.hardened1. Workaround ========== None. Description =========== - CVE-2021-3609 (privilege escalation) A race condition in net/can/bcm.c in the Linux kernel before version 5.13.2 allows for local privilege escalation to root. The CAN BCM networking protocol allows to register a CAN message receiver for a specified socket. The function bcm_rx_handler() is run for incoming CAN messages. Simultaneously to running this function, the socket can be closed and bcm_release() will be called. Inside bcm_release(), struct bcm_op and struct bcm_sock are freed while bcm_rx_handler() is still running, finally leading to multiple use-after-free's. - CVE-2021-3612 (privilege escalation) An out-of-bounds memory write security issue was found in the Linux kernel’s joystick devices subsystem before version 5.13.2, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. - CVE-2021-33909 (privilege escalation) An privilege escalation security issue has been found in the filesystem layer of the Linux kernel before version 5.13.4. An unprivileged local attacker can obtain full root privileges by creating, mounting, and deleting a deep directory structure whose total path length exceeds 1GB, which leads to an uncontrolled out-of-bounds write. Impact ====== An unprivileged local attacker could obtain full root privileges or crash the system. References ========== https://www.openwall.com/lists/oss-security/2021/06/19/1 https://www.openwall.com/lists/oss-security/2021/06/19/2 https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://bugzilla.redhat.com/show_bug.cgi?id=1974079 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-es… https://www.qualys.com/2021/07/20/cve-2021-33909/cve-2021-33909-crasher.c https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2021-3609 https://security.archlinux.org/CVE-2021-3612 https://security.archlinux.org/CVE-2021-33909

1 0

[ASA-202107-49] linux-zen: privilege escalation
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-49 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-3609 CVE-2021-3612 CVE-2021-33909 Package : linux-zen Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2182 Summary ======= The package linux-zen before version 5.13.4.zen1-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.13.4.zen1-1. # pacman -Syu "linux-zen>=5.13.4.zen1-1" The problems have been fixed upstream in version 5.13.4.zen1. Workaround ========== None. Description =========== - CVE-2021-3609 (privilege escalation) A race condition in net/can/bcm.c in the Linux kernel before version 5.13.2 allows for local privilege escalation to root. The CAN BCM networking protocol allows to register a CAN message receiver for a specified socket. The function bcm_rx_handler() is run for incoming CAN messages. Simultaneously to running this function, the socket can be closed and bcm_release() will be called. Inside bcm_release(), struct bcm_op and struct bcm_sock are freed while bcm_rx_handler() is still running, finally leading to multiple use-after-free's. - CVE-2021-3612 (privilege escalation) An out-of-bounds memory write security issue was found in the Linux kernel’s joystick devices subsystem before version 5.13.2, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. - CVE-2021-33909 (privilege escalation) An privilege escalation security issue has been found in the filesystem layer of the Linux kernel before version 5.13.4. An unprivileged local attacker can obtain full root privileges by creating, mounting, and deleting a deep directory structure whose total path length exceeds 1GB, which leads to an uncontrolled out-of-bounds write. Impact ====== An unprivileged local attacker could obtain full root privileges or crash the system. References ========== https://www.openwall.com/lists/oss-security/2021/06/19/1 https://www.openwall.com/lists/oss-security/2021/06/19/2 https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://bugzilla.redhat.com/show_bug.cgi?id=1974079 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-es… https://www.qualys.com/2021/07/20/cve-2021-33909/cve-2021-33909-crasher.c https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2021-3609 https://security.archlinux.org/CVE-2021-3612 https://security.archlinux.org/CVE-2021-33909

1 0

[ASA-202107-48] linux: privilege escalation
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-48 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-3609 CVE-2021-3612 CVE-2021-33909 Package : linux Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2181 Summary ======= The package linux before version 5.13.4.arch1-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.13.4.arch1-1. # pacman -Syu "linux>=5.13.4.arch1-1" The problems have been fixed upstream in version 5.13.4.arch1. Workaround ========== None. Description =========== - CVE-2021-3609 (privilege escalation) A race condition in net/can/bcm.c in the Linux kernel before version 5.13.2 allows for local privilege escalation to root. The CAN BCM networking protocol allows to register a CAN message receiver for a specified socket. The function bcm_rx_handler() is run for incoming CAN messages. Simultaneously to running this function, the socket can be closed and bcm_release() will be called. Inside bcm_release(), struct bcm_op and struct bcm_sock are freed while bcm_rx_handler() is still running, finally leading to multiple use-after-free's. - CVE-2021-3612 (privilege escalation) An out-of-bounds memory write security issue was found in the Linux kernel’s joystick devices subsystem before version 5.13.2, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. - CVE-2021-33909 (privilege escalation) An privilege escalation security issue has been found in the filesystem layer of the Linux kernel before version 5.13.4. An unprivileged local attacker can obtain full root privileges by creating, mounting, and deleting a deep directory structure whose total path length exceeds 1GB, which leads to an uncontrolled out-of-bounds write. Impact ====== An unprivileged local attacker could obtain full root privileges or crash the system. References ========== https://www.openwall.com/lists/oss-security/2021/06/19/1 https://www.openwall.com/lists/oss-security/2021/06/19/2 https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://bugzilla.redhat.com/show_bug.cgi?id=1974079 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-es… https://www.qualys.com/2021/07/20/cve-2021-33909/cve-2021-33909-crasher.c https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2021-3609 https://security.archlinux.org/CVE-2021-3612 https://security.archlinux.org/CVE-2021-33909

1 0

[ASA-202107-47] chromium: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-47 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-30565 CVE-2021-30566 CVE-2021-30567 CVE-2021-30568 CVE-2021-30569 CVE-2021-30571 CVE-2021-30572 CVE-2021-30573 CVE-2021-30574 CVE-2021-30575 CVE-2021-30576 CVE-2021-30578 CVE-2021-30579 CVE-2021-30581 CVE-2021-30582 CVE-2021-30584 CVE-2021-30585 CVE-2021-30588 CVE-2021-30589 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2200 Summary ======= The package chromium before version 92.0.4515.107-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, content spoofing, incorrect calculation, information disclosure and insufficient validation. Resolution ========== Upgrade to 92.0.4515.107-1. # pacman -Syu "chromium>=92.0.4515.107-1" The problems have been fixed upstream in version 92.0.4515.107. Workaround ========== None. Description =========== - CVE-2021-30565 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30566 (arbitrary code execution) A stack buffer overflow security issue has been found in the Printing component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30567 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30568 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebGL component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30569 (arbitrary code execution) A use after free security issue has been found in the sqlite component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30571 (access restriction bypass) An insufficient policy enforcement security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30572 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30573 (arbitrary code execution) A use after free security issue has been found in the GPU component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30574 (arbitrary code execution) A use after free security issue has been found in the protocol handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30575 (information disclosure) An out of bounds read security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30576 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30578 (arbitrary code execution) An uninitialized use security issue has been found in the Media component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30579 (arbitrary code execution) A use after free security issue has been found in the UI framework component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30581 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30582 (incorrect calculation) An inappropriate implementation security issue has been found in the Animation component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30584 (content spoofing) An incorrect security UI security issue has been found in the Downloads component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30585 (arbitrary code execution) A use after free security issue has been found in the sensor handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30588 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30589 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Sharing component of the Chromium browser engine before version 92.0.4515.107. Impact ====== A remote attacker could execute arbitrary code or spoof content through a crafted web page. References ========== https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1210985 https://crbug.com/1202661 https://crbug.com/1211326 https://crbug.com/1219886 https://crbug.com/1218707 https://crbug.com/1101897 https://crbug.com/1214234 https://crbug.com/1216822 https://crbug.com/1227315 https://crbug.com/1213313 https://crbug.com/1194896 https://crbug.com/1201074 https://crbug.com/1207277 https://crbug.com/1194431 https://crbug.com/1205981 https://crbug.com/1213350 https://crbug.com/1023503 https://crbug.com/1195650 https://crbug.com/1180510 https://security.archlinux.org/CVE-2021-30565 https://security.archlinux.org/CVE-2021-30566 https://security.archlinux.org/CVE-2021-30567 https://security.archlinux.org/CVE-2021-30568 https://security.archlinux.org/CVE-2021-30569 https://security.archlinux.org/CVE-2021-30571 https://security.archlinux.org/CVE-2021-30572 https://security.archlinux.org/CVE-2021-30573 https://security.archlinux.org/CVE-2021-30574 https://security.archlinux.org/CVE-2021-30575 https://security.archlinux.org/CVE-2021-30576 https://security.archlinux.org/CVE-2021-30578 https://security.archlinux.org/CVE-2021-30579 https://security.archlinux.org/CVE-2021-30581 https://security.archlinux.org/CVE-2021-30582 https://security.archlinux.org/CVE-2021-30584 https://security.archlinux.org/CVE-2021-30585 https://security.archlinux.org/CVE-2021-30588 https://security.archlinux.org/CVE-2021-30589

1 0

[ASA-202107-46] opera: arbitrary code execution
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-46 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Package : opera Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2168 Summary ======= The package opera before version 77.0.4054.277-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 77.0.4054.277-1. # pacman -Syu "opera>=77.0.4054.277-1" The problems have been fixed upstream in version 77.0.4054.277. Workaround ========== None. Description =========== - CVE-2021-30541 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30559 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30560 (arbitrary code execution) A use after free security issue has been found in the Blink XSLT component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30561 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30562 (arbitrary code execution) A use after free security issue has been found in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30563 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild. - CVE-2021-30564 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebXR component of the Chromium browser engine before version 91.0.4472.164. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://blogs.opera.com/desktop/changelog-for-77/ https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1214842 https://crbug.com/1219082 https://crbug.com/1219209 https://crbug.com/1219630 https://crbug.com/1220078 https://crbug.com/1228407 https://crbug.com/1221309 https://security.archlinux.org/CVE-2021-30541 https://security.archlinux.org/CVE-2021-30559 https://security.archlinux.org/CVE-2021-30560 https://security.archlinux.org/CVE-2021-30561 https://security.archlinux.org/CVE-2021-30562 https://security.archlinux.org/CVE-2021-30563 https://security.archlinux.org/CVE-2021-30564

1 0

[ASA-202107-45] telegram-desktop: content spoofing
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-45 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-36769 Package : telegram-desktop Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-2170 Summary ======= The package telegram-desktop before version 2.8.11-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 2.8.11-1. # pacman -Syu "telegram-desktop>=2.8.11-1" The problem has been fixed upstream in version 2.8.11. Workaround ========== None. Description =========== A reordering issue exists in Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent by a client. Impact ====== A man-in-the-middle attacker could reorder the messages sent by a client, potentially altering the meaning of the conversation. References ========== https://mtpsym.github.io/ https://security.archlinux.org/CVE-2021-36769

1 0