July 2021 - Arch-security - lists.archlinux.org

[ASA-202107-34] code: arbitrary code execution
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-34 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-31211 CVE-2021-31214 Package : code Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1963 Summary ======= The package code before version 1.58.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.58.0-1. # pacman -Syu "code>=1.58.0-1" The problems have been fixed upstream in version 1.58.0. Workaround ========== None. Description =========== - CVE-2021-31211 (arbitrary code execution) An arbitrary code execution vulnerability through crafted remote terminal settings has been found in Visual Studio Code before version 1.57.0. - CVE-2021-31214 (arbitrary code execution) An arbitrary code execution vulnerability in the Grunt, Gulp and Jake task auto detection has been found in Visual Studio Code before version 1.57.0. Impact ====== An attacker could execute arbitrary code through crafted remote terminal settings or JavaScript task runner configuration files without user interaction. References ========== https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021… https://github.com/microsoft/vscode/issues/123590 https://github.com/microsoft/vscode/commit/7259955ce318a2bb2a86ee121c34dcaa… https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021… https://github.com/microsoft/vscode/issues/123588 https://github.com/microsoft/vscode/commit/5f3466a21e80b2c016a1c0cbe2af683c… https://security.archlinux.org/CVE-2021-31211 https://security.archlinux.org/CVE-2021-31214

1 0

[ASA-202107-33] nodejs-lts-erbium: multiple issues
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-33 ========================================== Severity: High Date : 2021-07-20 CVE-ID : CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 Package : nodejs-lts-erbium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2128 Summary ======= The package nodejs-lts-erbium before version 12.22.3-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 12.22.3-1. # pacman -Syu "nodejs-lts-erbium>=12.22.3-1" The problems have been fixed upstream in version 12.22.3. Workaround ========== None. Description =========== - CVE-2021-22918 (information disclosure) libuv before version 1.14.1, as bundled by Node.js before versions 16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. - CVE-2021-23362 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. - CVE-2021-27290 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. Impact ====== A remote attacker could disclose information by supplying crafted domain names, or cause denial of service through high resource usage with crafted Git repository URLs or Subresource Integrity (SRI) hashes. References ========== https://github.com/libuv/libuv/issues/3147 https://hackerone.com/reports/1209681 https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de2… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv… https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631… https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac… https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc09… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 https://github.com/npm/hosted-git-info/pull/76 https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f8… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://github.com/advisories/GHSA-vx3p-948g-6vhq https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf https://github.com/npm/ssri/pull/17 https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2 https://security.archlinux.org/CVE-2021-22918 https://security.archlinux.org/CVE-2021-23362 https://security.archlinux.org/CVE-2021-27290

1 0

[ASA-202107-32] nodejs-lts-fermium: multiple issues
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-32 ========================================== Severity: High Date : 2021-07-20 CVE-ID : CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 Package : nodejs-lts-fermium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2127 Summary ======= The package nodejs-lts-fermium before version 14.17.3-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 14.17.3-1. # pacman -Syu "nodejs-lts-fermium>=14.17.3-1" The problems have been fixed upstream in version 14.17.3. Workaround ========== None. Description =========== - CVE-2021-22918 (information disclosure) libuv before version 1.14.1, as bundled by Node.js before versions 16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. - CVE-2021-23362 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. - CVE-2021-27290 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. Impact ====== A remote attacker could disclose information by supplying crafted domain names, or cause denial of service through high resource usage with crafted Git repository URLs or Subresource Integrity (SRI) hashes. References ========== https://github.com/libuv/libuv/issues/3147 https://hackerone.com/reports/1209681 https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de2… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv… https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631… https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac… https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc09… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 https://github.com/npm/hosted-git-info/pull/76 https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f8… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://github.com/advisories/GHSA-vx3p-948g-6vhq https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf https://github.com/npm/ssri/pull/17 https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2 https://security.archlinux.org/CVE-2021-22918 https://security.archlinux.org/CVE-2021-23362 https://security.archlinux.org/CVE-2021-27290

1 0

[ASA-202107-31] vivaldi: arbitrary code execution
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-31 ========================================== Severity: High Date : 2021-07-16 CVE-ID : CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Package : vivaldi Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2167 Summary ======= The package vivaldi before version 4.0.2312.41-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.0.2312.41-1. # pacman -Syu "vivaldi>=4.0.2312.41-1" The problems have been fixed upstream in version 4.0.2312.41. Workaround ========== None. Description =========== - CVE-2021-30541 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30559 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30560 (arbitrary code execution) A use after free security issue has been found in the Blink XSLT component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30561 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30562 (arbitrary code execution) A use after free security issue has been found in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30563 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild. - CVE-2021-30564 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebXR component of the Chromium browser engine before version 91.0.4472.164. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://vivaldi.com/blog/desktop/minor-update-3-for-vivaldi-desktop-browser… https://vivaldi.com/blog/desktop/minor-update-6-for-desktop-4-0/ https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1214842 https://crbug.com/1219082 https://crbug.com/1219209 https://crbug.com/1219630 https://crbug.com/1220078 https://crbug.com/1228407 https://crbug.com/1221309 https://security.archlinux.org/CVE-2021-30541 https://security.archlinux.org/CVE-2021-30559 https://security.archlinux.org/CVE-2021-30560 https://security.archlinux.org/CVE-2021-30561 https://security.archlinux.org/CVE-2021-30562 https://security.archlinux.org/CVE-2021-30563 https://security.archlinux.org/CVE-2021-30564

1 0

[ASA-202107-30] chromium: arbitrary code execution
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-30 ========================================== Severity: High Date : 2021-07-16 CVE-ID : CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2166 Summary ======= The package chromium before version 91.0.4472.164-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 91.0.4472.164-1. # pacman -Syu "chromium>=91.0.4472.164-1" The problems have been fixed upstream in version 91.0.4472.164. Workaround ========== None. Description =========== - CVE-2021-30541 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30559 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30560 (arbitrary code execution) A use after free security issue has been found in the Blink XSLT component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30561 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30562 (arbitrary code execution) A use after free security issue has been found in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30563 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild. - CVE-2021-30564 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebXR component of the Chromium browser engine before version 91.0.4472.164. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1214842 https://crbug.com/1219082 https://crbug.com/1219209 https://crbug.com/1219630 https://crbug.com/1220078 https://crbug.com/1228407 https://crbug.com/1221309 https://security.archlinux.org/CVE-2021-30541 https://security.archlinux.org/CVE-2021-30559 https://security.archlinux.org/CVE-2021-30560 https://security.archlinux.org/CVE-2021-30561 https://security.archlinux.org/CVE-2021-30562 https://security.archlinux.org/CVE-2021-30563 https://security.archlinux.org/CVE-2021-30564

1 0

[ASA-202107-29] systemd: denial of service
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-29 ========================================== Severity: Low Date : 2021-07-14 CVE-ID : CVE-2020-13529 Package : systemd Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1935 Summary ======= The package systemd before version 249-2 is vulnerable to denial of service. Resolution ========== Upgrade to 249-2. # pacman -Syu "systemd>=249-2" The problem has been fixed upstream in version 249. Workaround ========== None. Description =========== An exploitable denial-of-service vulnerability exists in systemd- networkd before version 249. A maliciously crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server. Impact ====== A network-adjacent attacker could reconfigure the networking properties of a device running systemd-networkd through crafted DHCP packets. References ========== https://talosintelligence.com/vulnerability_reports/TALOS-2020-1142 https://github.com/systemd/systemd/issues/16774 https://github.com/systemd/systemd/pull/20002 https://github.com/systemd/systemd/commit/38e980a6a5a3442c2f48b1f8272843880… https://security.archlinux.org/CVE-2020-13529

1 0

[ASA-202107-28] varnish: url request injection
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-28 ========================================== Severity: Medium Date : 2021-07-14 CVE-ID : CVE-2021-36740 Package : varnish Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-2154 Summary ======= The package varnish before version 6.6.1-1 is vulnerable to url request injection. Resolution ========== Upgrade to 6.6.1-1. # pacman -Syu "varnish>=6.6.1-1" The problem has been fixed upstream in version 6.6.1. Workaround ========== The issue can be mitigated by turning off support for HTTP/2, using sudo varnishadm param.set feature -http2 or by preventing connection reuse with the following configuration: sub vcl_backend_fetch { set bereq.http.Connection = "close"; } Description =========== Varnish Cache before version 6.6.1, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. Impact ====== A remote attacker could inject arbitrary HTTP requests through an HTTP/2 POST request with a large Content-Length header. References ========== https://varnish-cache.org/security/VSV00007.html https://github.com/varnishcache/varnish-cache/commit/7d73bc843ea9bff79e3377… https://security.archlinux.org/CVE-2021-36740

1 0

[ASA-202107-27] mbedtls: information disclosure
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-27 ========================================== Severity: Medium Date : 2021-07-14 CVE-ID : CVE-2021-24119 Package : mbedtls Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-2153 Summary ======= The package mbedtls before version 2.26.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.26.0-1. # pacman -Syu "mbedtls>=2.26.0-1" The problem has been fixed upstream in version 2.26.0. Workaround ========== None. Description =========== In Trusted Firmware Mbed TLS before version 2.26.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX. Impact ====== A local attacker could disclose secret RSA keys through a side-channel attack. References ========== https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publicat… https://github.com/ARMmbed/mbedtls/commit/0544d49330b9b12b244a54c9ff145d55c… https://security.archlinux.org/CVE-2021-24119

1 0

[ASA-202107-26] python-pillow: arbitrary code execution
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-26 ========================================== Severity: Medium Date : 2021-07-14 CVE-ID : CVE-2021-34552 Package : python-pillow Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2150 Summary ======= The package python-pillow before version 8.3.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.3.0-1. # pacman -Syu "python-pillow>=8.3.0-1" The problem has been fixed upstream in version 8.3.0. Workaround ========== None. Description =========== Pillow through 8.2.0 allows an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. Impact ====== Converting a crafted image file could lead to arbitrary code execution. References ========== https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-over… https://github.com/python-pillow/Pillow/pull/5567 https://github.com/python-pillow/Pillow/commit/518ee3722a99d7f7d890db82a20b… https://security.archlinux.org/CVE-2021-34552

1 0

[ASA-202107-25] ruby2.6: multiple issues
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-25 ========================================== Severity: High Date : 2021-07-14 CVE-ID : CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 Package : ruby2.6 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2140 Summary ======= The package ruby2.6 before version 2.6.8-1 is vulnerable to multiple issues including silent downgrade, arbitrary command execution and information disclosure. Resolution ========== Upgrade to 2.6.8-1. # pacman -Syu "ruby2.6>=2.6.8-1" The problems have been fixed upstream in version 2.6.8. Workaround ========== None. Description =========== - CVE-2021-31799 (arbitrary command execution) RDoc before version 6.3.1, as bundled with Ruby before version 2.7.4 and 2.6.8 as well as GitLab before version 14.0.2, used to call Kernel#open to open a local file. If a Ruby project has a file whose name starts with "|" and ends with "tags", the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run the rdoc command. - CVE-2021-31810 (information disclosure) A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). - CVE-2021-32066 (silent downgrade) A security issue has been discovered in Ruby before versions 3.0.2, 2.7.4 and 2.6.8. Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack”. Impact ====== A remote man-in-the-middle attacker could strip StartTLS encryption from IMAP connections to disclose authentication credentials and emails. Furthermore, a malicious FTP server could induce connections to an arbitrary IP address and port on a client, leading to potential information disclosure. References ========== https://www.ruby-lang.org/en/news/2021/05/02/os-command-injection-in-rdoc/ https://github.com/ruby/rdoc/commit/a7f5d6ab88632b3b482fe10611382ff73d14eed7 https://github.com/ruby/ruby/commit/483f303d02e768b69e476e0b9be4ab2f26389522 https://github.com/ruby/ruby/commit/fe3c49c9baeeab58304ede915b7edd18ecf360fc https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net… https://hackerone.com/reports/1145454 https://github.com/ruby/net-ftp/commit/5709ece67cf57a94655e34532f8a7899b28d… https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ https://hackerone.com/reports/1178562 https://github.com/ruby/net-imap/commit/adba6f0c3e5c5607c4822b9120322eb7e9a… https://security.archlinux.org/CVE-2021-31799 https://security.archlinux.org/CVE-2021-31810 https://security.archlinux.org/CVE-2021-32066

1 0