August 2021 - Arch-security - lists.archlinux.org

[ASA-202108-14] firefox: multiple issues
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-14 ========================================== Severity: High Date : 2021-08-11 CVE-ID : CVE-2021-29980 CVE-2021-29981 CVE-2021-29982 CVE-2021-29984 CVE-2021-29985 CVE-2021-29986 CVE-2021-29987 CVE-2021-29988 CVE-2021-29989 CVE-2021-29990 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2269 Summary ======= The package firefox before version 91.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 91.0-1. # pacman -Syu "firefox>=91.0-1" The problems have been fixed upstream in version 91.0. Workaround ========== None. Description =========== - CVE-2021-29980 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. - CVE-2021-29981 (arbitrary code execution) A security issue has been found in Firefox and Thunderbird before version 91. An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash. - CVE-2021-29982 (information disclosure) A security issue has been found in Firefox and Thunderbird before version 91. Due to incorrect JIT optimization, it incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. - CVE-2021-29984 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. - CVE-2021-29985 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. - CVE-2021-29986 (arbitrary code execution) A security issue has been found in Firefox before version 91 and Thunderbird before version 78.13. A suspected race condition when calling getaddrinfo() led to memory corruption and a potentially exploitable crash. - CVE-2021-29987 (content spoofing) A security issue has been found in Firefox and Thunderbird before version 91. After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. - CVE-2021-29988 (arbitrary code execution) Firefox before version 91 and Thunderbird before version 78.13 incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. - CVE-2021-29989 (arbitrary code execution) Mozilla developers reported memory safety bugs present in Firefox 90 and Thunderbird 78.12. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2021-29990 (arbitrary code execution) Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker could execute arbitrary code or trick the user into accepting additional site permissions through maliciously crafted web content. References ========== https://www.mozilla.org/security/advisories/mfsa2021-33/ https://www.mozilla.org/security/advisories/mfsa2021-35/ https://bugzilla.mozilla.org/show_bug.cgi?id=1722204 https://www.mozilla.org/security/advisories/mfsa2021-36/ https://bugzilla.mozilla.org/show_bug.cgi?id=1707774 https://bugzilla.mozilla.org/show_bug.cgi?id=1715318 https://bugzilla.mozilla.org/show_bug.cgi?id=1720031 https://bugzilla.mozilla.org/show_bug.cgi?id=1722083 https://bugzilla.mozilla.org/show_bug.cgi?id=1696138 https://bugzilla.mozilla.org/show_bug.cgi?id=1716129 https://bugzilla.mozilla.org/show_bug.cgi?id=1717922 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1662676%2C1666184%2C1719178… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1544190%2C1716481%2C1717778… https://security.archlinux.org/CVE-2021-29980 https://security.archlinux.org/CVE-2021-29981 https://security.archlinux.org/CVE-2021-29982 https://security.archlinux.org/CVE-2021-29984 https://security.archlinux.org/CVE-2021-29985 https://security.archlinux.org/CVE-2021-29986 https://security.archlinux.org/CVE-2021-29987 https://security.archlinux.org/CVE-2021-29988 https://security.archlinux.org/CVE-2021-29989 https://security.archlinux.org/CVE-2021-29990

1 0

[ASA-202108-13] c-ares: insufficient validation
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-13 ========================================== Severity: Medium Date : 2021-08-10 CVE-ID : CVE-2021-3672 Package : c-ares Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-2268 Summary ======= The package c-ares before version 1.17.2-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.17.2-1. # pacman -Syu "c-ares>=1.17.2-1" The problem has been fixed upstream in version 1.17.2. Workaround ========== None. Description =========== Missing input validation of host names returned by Domain Name Servers in the c-ares library before version 1.17.2 can lead to output of wrong hostnames (leading to domain hijacking). Impact ====== A remote attacker with the ability to create DNS entries could create crafted entries that output the wrong hostname when resolved with c-ares, leading to potential domain hijacking. References ========== https://c-ares.haxx.se/adv_20210810.html https://github.com/c-ares/c-ares/commit/362f91d807d293791008cdb7616d40f7784… https://github.com/c-ares/c-ares/commit/44c009b8e62ea1929de68e3f438181bea46… https://security.archlinux.org/CVE-2021-3672

1 0

[ASA-202108-12] loki: directory traversal
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-12 ========================================== Severity: Medium Date : 2021-08-10 CVE-ID : CVE-2021-36156 Package : loki Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2250 Summary ======= The package loki before version 2.3.0-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 2.3.0-1. # pacman -Syu "loki>=2.3.0-1" The problem has been fixed upstream in version 2.3.0. Workaround ========== None. Description =========== An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as a ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message. Impact ====== A remote attacker could disclose some of the contents of arbitrary files through a crafted X-Scope-OrgID header. References ========== https://github.com/grafana/loki/pull/4020 https://github.com/grafana/loki/commit/2fd633cded9a97c8c6b29160549a157678d1… https://security.archlinux.org/CVE-2021-36156

1 0

[ASA-202108-11] prosody: information disclosure
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-11 ========================================== Severity: Medium Date : 2021-08-10 CVE-ID : CVE-2021-37601 Package : prosody Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2237 Summary ======= The package prosody before version 1:0.11.10-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1:0.11.10-1. # pacman -Syu "prosody>=1:0.11.10-1" The problem has been fixed upstream in version 0.11.10. Workaround ========== None. Description =========== It was discovered that Prosody 0.11.0 up to 0.11.9 exposes the list of entities (Jabber/XMPP addresses) affiliated (part of) a Multi-User chat to any user, even if they are currently not part of the chat or if their affiliation would not let them become part of the chat, if the whois room configuration was set to anyone. This allows any entity to access the list of admins, members, owners and banned entities of any federated XMPP group chat of which they know the address if it is hosted on a vulnerable Prosody server. Impact ====== A remote attacker could disclose the list of admins, members, owners and banned entities of any federated XMPP group chat of which they know the address. References ========== https://bugs.archlinux.org/task/71641 https://prosody.im/security/advisory_20210722/ https://prosody.im/security/advisory_20210722/1.patch https://hg.prosody.im/0.11/rev/d117b92fd8e4 https://security.archlinux.org/CVE-2021-37601

1 0

[ASA-202108-10] jupyterlab: cross-site scripting
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-10 ========================================== Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-32797 Package : jupyterlab Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2266 Summary ======= The package jupyterlab before version 3.1.4-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 3.1.4-1. # pacman -Syu "jupyterlab>=3.1.4-1" The problem has been fixed upstream in version 3.1.4. Workaround ========== None. Description =========== In JupyterLab before version 3.1.4, untrusted notebooks can execute code on load. In particular JupyterLab doesn't sanitize the action attribute of the HTML <form> element. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. Impact ====== An attacker could perform remote code execution using a maliciously crafted notebook file. References ========== https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q… https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d5293… https://security.archlinux.org/CVE-2021-32797

1 0

[ASA-202108-9] lynx: information disclosure
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-9 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-38165 Package : lynx Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2261 Summary ======= The package lynx before version 2.8.9-4 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.8.9-4. # pacman -Syu "lynx>=2.8.9-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== HTParse in Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data or HTTP headers. Impact ====== A remote attacker could retrieve HTTP Basic Authentication credentials. References ========== https://bugs.archlinux.org/task/71764 https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html https://lynx.invisible-island.net/current/CHANGES.html#index-v2.9.0dev.9 https://github.com/archlinux/svntogit-packages/blob/packages/lynx/trunk/CVE… https://security.archlinux.org/CVE-2021-38165

1 0

[ASA-202108-8] fossil: certificate verification bypass
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-8 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-36377 Package : fossil Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-2146 Summary ======= The package fossil before version 2.16-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 2.16-1. # pacman -Syu "fossil>=2.16-1" The problem has been fixed upstream in version 2.16. Workaround ========== None. Description =========== Fossil before version 2.15.2 often skips the hostname check during TLS certificate validation. Impact ====== A man-in-the-middle attacker could spoof a Fossil repository by presenting any valid certificate for an arbitrary hostname, leading to potential information disclosure. References ========== https://www.fossil-scm.org/forum/forumpost/8d367e16f53d93c789d70bd3bf2c9587… https://www.fossil-scm.org/home/info/aaab2a15d1dfc22f5453c2bad8f25ecf518ed3… https://security.archlinux.org/CVE-2021-36377

1 0

[ASA-202108-7] gitlab: multiple issues
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-7 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-22236 CVE-2021-22237 CVE-2021-22239 CVE-2021-22241 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2251 Summary ======= The package gitlab before version 14.1.2-1 is vulnerable to multiple issues including cross-site scripting, access restriction bypass and incorrect calculation. Resolution ========== Upgrade to 14.1.2-1. # pacman -Syu "gitlab>=14.1.2-1" The problems have been fixed upstream in version 14.1.2. Workaround ========== None. Description =========== - CVE-2021-22236 (incorrect calculation) Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1 before version 14.1.2. - CVE-2021-22237 (access restriction bypass) Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab versions before 14.1.2. - CVE-2021-22239 (access restriction bypass) An unauthorized user was able to insert metadata when creating a new issue on GitLab 14.0 and later before version 14.1.2. - CVE-2021-22241 (cross-site scripting) An issue has been discovered in GitLab affecting all versions starting from 13.4 and before 14.1.2. It was possible to exploit a stored cross- site-scripting via a specifically crafted default branch name. Impact ====== A remote attacker could execute arbitrary JavaScript code through a crafted branch name, or bypass access restrictions to perform various actions they are not authorised for. References ========== https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22241.json https://gitlab.com/gitlab-org/gitlab/-/issues/336460 https://hackerone.com/reports/1256777 https://security.archlinux.org/CVE-2021-22236 https://security.archlinux.org/CVE-2021-22237 https://security.archlinux.org/CVE-2021-22239 https://security.archlinux.org/CVE-2021-22241

1 0

[ASA-202108-6] vivaldi: multiple issues
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-6 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-30590 CVE-2021-30591 CVE-2021-30592 CVE-2021-30593 CVE-2021-30594 CVE-2021-30596 CVE-2021-30597 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2247 Summary ======= The package vivaldi before version 4.1.2369.15-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and content spoofing. Resolution ========== Upgrade to 4.1.2369.15-1. # pacman -Syu "vivaldi>=4.1.2369.15-1" The problems have been fixed upstream in version 4.1.2369.15. Workaround ========== None. Description =========== - CVE-2021-30590 (arbitrary code execution) A heap buffer overflow security issue has been found in the Bookmarks component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30591 (arbitrary code execution) A use after free security issue has been found in the File System API component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30592 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30593 (information disclosure) An out of bounds read security issue has been found in the Tab Strip component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30594 (arbitrary code execution) A use after free security issue has been found in the Page Info UI component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30596 (content spoofing) An incorrect security UI security issue has been found in the Navigation component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30597 (arbitrary code execution) A use after free security issue has been found in the Browser UI component of the Chromium browser engine before version 92.0.4515.131. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, or spoof content through crafted web pages. References ========== https://vivaldi.com/blog/desktop/vivaldi-4-1-rc-1-desktop/ https://vivaldi.com/blog/desktop/minor-update-desktop-4-1/ https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-u… https://crbug.com/1227777 https://crbug.com/1229298 https://crbug.com/1209469 https://crbug.com/1209616 https://crbug.com/1218468 https://crbug.com/1214481 https://crbug.com/1232617 https://security.archlinux.org/CVE-2021-30590 https://security.archlinux.org/CVE-2021-30591 https://security.archlinux.org/CVE-2021-30592 https://security.archlinux.org/CVE-2021-30593 https://security.archlinux.org/CVE-2021-30594 https://security.archlinux.org/CVE-2021-30596 https://security.archlinux.org/CVE-2021-30597

1 0

[ASA-202108-5] opera: multiple issues
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-5 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-30565 CVE-2021-30566 CVE-2021-30567 CVE-2021-30568 CVE-2021-30569 CVE-2021-30571 CVE-2021-30572 CVE-2021-30573 CVE-2021-30574 CVE-2021-30575 CVE-2021-30576 CVE-2021-30578 CVE-2021-30579 CVE-2021-30581 CVE-2021-30582 CVE-2021-30584 CVE-2021-30585 CVE-2021-30588 CVE-2021-30589 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2203 Summary ======= The package opera before version 78.0.4093.112-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, content spoofing, incorrect calculation, information disclosure and insufficient validation. Resolution ========== Upgrade to 78.0.4093.112-1. # pacman -Syu "opera>=78.0.4093.112-1" The problems have been fixed upstream in version 78.0.4093.112. Workaround ========== None. Description =========== - CVE-2021-30565 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30566 (arbitrary code execution) A stack buffer overflow security issue has been found in the Printing component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30567 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30568 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebGL component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30569 (arbitrary code execution) A use after free security issue has been found in the sqlite component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30571 (access restriction bypass) An insufficient policy enforcement security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30572 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30573 (arbitrary code execution) A use after free security issue has been found in the GPU component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30574 (arbitrary code execution) A use after free security issue has been found in the protocol handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30575 (information disclosure) An out of bounds read security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30576 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30578 (arbitrary code execution) An uninitialized use security issue has been found in the Media component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30579 (arbitrary code execution) A use after free security issue has been found in the UI framework component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30581 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30582 (incorrect calculation) An inappropriate implementation security issue has been found in the Animation component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30584 (content spoofing) An incorrect security UI security issue has been found in the Downloads component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30585 (arbitrary code execution) A use after free security issue has been found in the sensor handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30588 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30589 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Sharing component of the Chromium browser engine before version 92.0.4515.107. Impact ====== A remote attacker could execute arbitrary code or spoof content through a crafted web page. References ========== https://blogs.opera.com/desktop/changelog-for-77/ https://blogs.opera.com/desktop/changelog-for-78/ https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1210985 https://crbug.com/1202661 https://crbug.com/1211326 https://crbug.com/1219886 https://crbug.com/1218707 https://crbug.com/1101897 https://crbug.com/1214234 https://crbug.com/1216822 https://crbug.com/1227315 https://crbug.com/1213313 https://crbug.com/1194896 https://crbug.com/1201074 https://crbug.com/1207277 https://crbug.com/1194431 https://crbug.com/1205981 https://crbug.com/1213350 https://crbug.com/1023503 https://crbug.com/1195650 https://crbug.com/1180510 https://security.archlinux.org/CVE-2021-30565 https://security.archlinux.org/CVE-2021-30566 https://security.archlinux.org/CVE-2021-30567 https://security.archlinux.org/CVE-2021-30568 https://security.archlinux.org/CVE-2021-30569 https://security.archlinux.org/CVE-2021-30571 https://security.archlinux.org/CVE-2021-30572 https://security.archlinux.org/CVE-2021-30573 https://security.archlinux.org/CVE-2021-30574 https://security.archlinux.org/CVE-2021-30575 https://security.archlinux.org/CVE-2021-30576 https://security.archlinux.org/CVE-2021-30578 https://security.archlinux.org/CVE-2021-30579 https://security.archlinux.org/CVE-2021-30581 https://security.archlinux.org/CVE-2021-30582 https://security.archlinux.org/CVE-2021-30584 https://security.archlinux.org/CVE-2021-30585 https://security.archlinux.org/CVE-2021-30588 https://security.archlinux.org/CVE-2021-30589

1 0