August 2021 - Arch-security - lists.archlinux.org

[ASA-202108-4] chromium: multiple issues
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-4 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-30590 CVE-2021-30591 CVE-2021-30592 CVE-2021-30593 CVE-2021-30594 CVE-2021-30596 CVE-2021-30597 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2246 Summary ======= The package chromium before version 92.0.4515.131-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and content spoofing. Resolution ========== Upgrade to 92.0.4515.131-1. # pacman -Syu "chromium>=92.0.4515.131-1" The problems have been fixed upstream in version 92.0.4515.131. Workaround ========== None. Description =========== - CVE-2021-30590 (arbitrary code execution) A heap buffer overflow security issue has been found in the Bookmarks component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30591 (arbitrary code execution) A use after free security issue has been found in the File System API component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30592 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30593 (information disclosure) An out of bounds read security issue has been found in the Tab Strip component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30594 (arbitrary code execution) A use after free security issue has been found in the Page Info UI component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30596 (content spoofing) An incorrect security UI security issue has been found in the Navigation component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30597 (arbitrary code execution) A use after free security issue has been found in the Browser UI component of the Chromium browser engine before version 92.0.4515.131. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, or spoof content through crafted web pages. References ========== https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-u… https://crbug.com/1227777 https://crbug.com/1229298 https://crbug.com/1209469 https://crbug.com/1209616 https://crbug.com/1218468 https://crbug.com/1214481 https://crbug.com/1232617 https://security.archlinux.org/CVE-2021-30590 https://security.archlinux.org/CVE-2021-30591 https://security.archlinux.org/CVE-2021-30592 https://security.archlinux.org/CVE-2021-30593 https://security.archlinux.org/CVE-2021-30594 https://security.archlinux.org/CVE-2021-30596 https://security.archlinux.org/CVE-2021-30597

1 0

[ASA-202108-3] nodejs-lts-erbium: arbitrary code execution
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-3 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-22930 Package : nodejs-lts-erbium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2241 Summary ======= The package nodejs-lts-erbium before version 12.22.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 12.22.4-1. # pacman -Syu "nodejs-lts-erbium>=12.22.4-1" The problem has been fixed upstream in version 12.22.4. Workaround ========== None. Description =========== Node.js before version 16.6.0, 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Impact ====== A remote attacker could execute arbitrary code through crafted HTTP/2 requests. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/#use… https://github.com/nodejs/node/issues/38964 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91… https://github.com/nodejs/node/commit/d48b91ea2b27828ceea10dab1effa42bc542b… https://github.com/nodejs/node/commit/b263f2585ab53f56e0e22b46cf1f8519a8af8… https://security.archlinux.org/CVE-2021-22930

1 0

[ASA-202108-2] nodejs-lts-fermium: arbitrary code execution
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-2 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-22930 Package : nodejs-lts-fermium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2240 Summary ======= The package nodejs-lts-fermium before version 14.17.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 14.17.4-1. # pacman -Syu "nodejs-lts-fermium>=14.17.4-1" The problem has been fixed upstream in version 14.17.4. Workaround ========== None. Description =========== Node.js before version 16.6.0, 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Impact ====== A remote attacker could execute arbitrary code through crafted HTTP/2 requests. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/#use… https://github.com/nodejs/node/issues/38964 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91… https://github.com/nodejs/node/commit/d48b91ea2b27828ceea10dab1effa42bc542b… https://github.com/nodejs/node/commit/b263f2585ab53f56e0e22b46cf1f8519a8af8… https://security.archlinux.org/CVE-2021-22930

1 0

[ASA-202108-1] nodejs: arbitrary code execution
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-1 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-22930 Package : nodejs Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2239 Summary ======= The package nodejs before version 16.6.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 16.6.0-1. # pacman -Syu "nodejs>=16.6.0-1" The problem has been fixed upstream in version 16.6.0. Workaround ========== None. Description =========== Node.js before version 16.6.0, 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Impact ====== A remote attacker could execute arbitrary code through crafted HTTP/2 requests. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/#use… https://github.com/nodejs/node/issues/38964 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91… https://github.com/nodejs/node/commit/d48b91ea2b27828ceea10dab1effa42bc542b… https://github.com/nodejs/node/commit/b263f2585ab53f56e0e22b46cf1f8519a8af8… https://security.archlinux.org/CVE-2021-22930

1 0