- Arch-security - lists.archlinux.org

[ASA-202108-3] nodejs-lts-erbium: arbitrary code execution
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-3 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-22930 Package : nodejs-lts-erbium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2241 Summary ======= The package nodejs-lts-erbium before version 12.22.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 12.22.4-1. # pacman -Syu "nodejs-lts-erbium>=12.22.4-1" The problem has been fixed upstream in version 12.22.4. Workaround ========== None. Description =========== Node.js before version 16.6.0, 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Impact ====== A remote attacker could execute arbitrary code through crafted HTTP/2 requests. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/#use… https://github.com/nodejs/node/issues/38964 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91… https://github.com/nodejs/node/commit/d48b91ea2b27828ceea10dab1effa42bc542b… https://github.com/nodejs/node/commit/b263f2585ab53f56e0e22b46cf1f8519a8af8… https://security.archlinux.org/CVE-2021-22930

1 0

[ASA-202108-2] nodejs-lts-fermium: arbitrary code execution
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-2 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-22930 Package : nodejs-lts-fermium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2240 Summary ======= The package nodejs-lts-fermium before version 14.17.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 14.17.4-1. # pacman -Syu "nodejs-lts-fermium>=14.17.4-1" The problem has been fixed upstream in version 14.17.4. Workaround ========== None. Description =========== Node.js before version 16.6.0, 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Impact ====== A remote attacker could execute arbitrary code through crafted HTTP/2 requests. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/#use… https://github.com/nodejs/node/issues/38964 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91… https://github.com/nodejs/node/commit/d48b91ea2b27828ceea10dab1effa42bc542b… https://github.com/nodejs/node/commit/b263f2585ab53f56e0e22b46cf1f8519a8af8… https://security.archlinux.org/CVE-2021-22930

1 0

[ASA-202108-1] nodejs: arbitrary code execution
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-1 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-22930 Package : nodejs Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2239 Summary ======= The package nodejs before version 16.6.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 16.6.0-1. # pacman -Syu "nodejs>=16.6.0-1" The problem has been fixed upstream in version 16.6.0. Workaround ========== None. Description =========== Node.js before version 16.6.0, 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Impact ====== A remote attacker could execute arbitrary code through crafted HTTP/2 requests. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/#use… https://github.com/nodejs/node/issues/38964 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91… https://github.com/nodejs/node/commit/d48b91ea2b27828ceea10dab1effa42bc542b… https://github.com/nodejs/node/commit/b263f2585ab53f56e0e22b46cf1f8519a8af8… https://security.archlinux.org/CVE-2021-22930

1 0

[ASA-202107-74] vivaldi: multiple issues
by Jonas Witschel 30 Jul '21

30 Jul '21

Arch Linux Security Advisory ASA-202107-74 ========================================== Severity: High Date : 2021-07-28 CVE-ID : CVE-2021-30565 CVE-2021-30566 CVE-2021-30567 CVE-2021-30568 CVE-2021-30569 CVE-2021-30571 CVE-2021-30572 CVE-2021-30573 CVE-2021-30574 CVE-2021-30575 CVE-2021-30576 CVE-2021-30578 CVE-2021-30579 CVE-2021-30581 CVE-2021-30582 CVE-2021-30584 CVE-2021-30585 CVE-2021-30588 CVE-2021-30589 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2202 Summary ======= The package vivaldi before version 4.1.2369.11-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, content spoofing, incorrect calculation, information disclosure and insufficient validation. Resolution ========== Upgrade to 4.1.2369.11-1. # pacman -Syu "vivaldi>=4.1.2369.11-1" The problems have been fixed upstream in version 4.1.2369.11. Workaround ========== None. Description =========== - CVE-2021-30565 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30566 (arbitrary code execution) A stack buffer overflow security issue has been found in the Printing component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30567 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30568 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebGL component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30569 (arbitrary code execution) A use after free security issue has been found in the sqlite component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30571 (access restriction bypass) An insufficient policy enforcement security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30572 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30573 (arbitrary code execution) A use after free security issue has been found in the GPU component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30574 (arbitrary code execution) A use after free security issue has been found in the protocol handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30575 (information disclosure) An out of bounds read security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30576 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30578 (arbitrary code execution) An uninitialized use security issue has been found in the Media component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30579 (arbitrary code execution) A use after free security issue has been found in the UI framework component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30581 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30582 (incorrect calculation) An inappropriate implementation security issue has been found in the Animation component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30584 (content spoofing) An incorrect security UI security issue has been found in the Downloads component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30585 (arbitrary code execution) A use after free security issue has been found in the sensor handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30588 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30589 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Sharing component of the Chromium browser engine before version 92.0.4515.107. Impact ====== A remote attacker could execute arbitrary code or spoof content through a crafted web page. References ========== https://vivaldi.com/blog/desktop/minor-update-6-for-desktop-4-0/ https://vivaldi.com/blog/desktop/vivaldi-4-1-rc-1-desktop/ https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1210985 https://crbug.com/1202661 https://crbug.com/1211326 https://crbug.com/1219886 https://crbug.com/1218707 https://crbug.com/1101897 https://crbug.com/1214234 https://crbug.com/1216822 https://crbug.com/1227315 https://crbug.com/1213313 https://crbug.com/1194896 https://crbug.com/1201074 https://crbug.com/1207277 https://crbug.com/1194431 https://crbug.com/1205981 https://crbug.com/1213350 https://crbug.com/1023503 https://crbug.com/1195650 https://crbug.com/1180510 https://security.archlinux.org/CVE-2021-30565 https://security.archlinux.org/CVE-2021-30566 https://security.archlinux.org/CVE-2021-30567 https://security.archlinux.org/CVE-2021-30568 https://security.archlinux.org/CVE-2021-30569 https://security.archlinux.org/CVE-2021-30571 https://security.archlinux.org/CVE-2021-30572 https://security.archlinux.org/CVE-2021-30573 https://security.archlinux.org/CVE-2021-30574 https://security.archlinux.org/CVE-2021-30575 https://security.archlinux.org/CVE-2021-30576 https://security.archlinux.org/CVE-2021-30578 https://security.archlinux.org/CVE-2021-30579 https://security.archlinux.org/CVE-2021-30581 https://security.archlinux.org/CVE-2021-30582 https://security.archlinux.org/CVE-2021-30584 https://security.archlinux.org/CVE-2021-30585 https://security.archlinux.org/CVE-2021-30588 https://security.archlinux.org/CVE-2021-30589

1 0

[ASA-202107-73] powerdns: denial of service
by Jonas Witschel 30 Jul '21

30 Jul '21

Arch Linux Security Advisory ASA-202107-73 ========================================== Severity: Medium Date : 2021-07-27 CVE-ID : CVE-2021-36754 Package : powerdns Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2222 Summary ======= The package powerdns before version 4.5.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.5.1-1. # pacman -Syu "powerdns>=4.5.1-1" The problem has been fixed upstream in version 4.5.1. Workaround ========== Users that cannot upgrade immediately, but do have dnsdist in place, can use dnsdist to filter such queries before they do harm, with something like addAction(QTypeRule(65535), RCodeAction(DNSRCode.REFUSED)). Description =========== PowerDNS Authoritative Server 4.5.0 will crash with an uncaught out of bounds exception if it receives a query with QTYPE 65535. The offending code was not present in earlier versions, and they are not affected. Users that cannot upgrade immediately, but do have dnsdist in place, can use dnsdist to filter such queries before they do harm, with something like addAction(QTypeRule(65535), RCodeAction(DNSRCode.REFUSED)). When the PowerDNS Authoritative Server is run inside a supervisor like supervisord or systemd, an uncaught exception crash will lead to an automatic restart, limiting the impact to a somewhat degraded service. Impact ====== A remote attacker could crash the DNS server with a crafted query. References ========== https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisor… https://downloads.powerdns.com/patches/2021-01/pdns-4.5.0-2021-01.patch https://github.com/PowerDNS/pdns/commit/96cae2fd21054b383a16c569a363a50f718… https://security.archlinux.org/CVE-2021-36754

1 0

[ASA-202107-72] 389-ds-base: multiple issues
by Jonas Witschel 30 Jul '21

30 Jul '21

Arch Linux Security Advisory ASA-202107-72 ========================================== Severity: Medium Date : 2021-07-27 CVE-ID : CVE-2021-3514 CVE-2021-3652 Package : 389-ds-base Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2206 Summary ======= The package 389-ds-base before version 2.0.7-1 is vulnerable to multiple issues including authentication bypass and denial of service. Resolution ========== Upgrade to 2.0.7-1. # pacman -Syu "389-ds-base>=2.0.7-1" The problems have been fixed upstream in version 2.0.7. Workaround ========== None. Description =========== - CVE-2021-3514 (denial of service) A security issue was found in 389-ds-base before version 2.0.5. When using a sync_repl client, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query, causing a crash of 389-ds-base. - CVE-2021-3652 (authentication bypass) In 389-ds-base before version 2.0.7, it was found that if an asterisk is imported as a password hash, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This would allow an attacker to successfully authenticate as a user who's password was supposedly disabled. Impact ====== An attacker could successfully authenticate as a user who's password was supposedly disabled. Furthermore, an authenticated attacker could crash the 389-ds-base server. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1952907 https://github.com/389ds/389-ds-base/issues/4711 https://github.com/389ds/389-ds-base/pull/4738 https://github.com/389ds/389-ds-base/commit/d7eef2fcfbab2ef8aa6ee0bf60f0a9b… https://bugzilla.redhat.com/show_bug.cgi?id=1982782 https://github.com/389ds/389-ds-base/issues/4817 https://github.com/389ds/389-ds-base/pull/4819 https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b… https://security.archlinux.org/CVE-2021-3514 https://security.archlinux.org/CVE-2021-3652

1 0

[ASA-202107-71] geckodriver: cross-site request forgery
by Jonas Witschel 30 Jul '21

30 Jul '21

Arch Linux Security Advisory ASA-202107-71 ========================================== Severity: Medium Date : 2021-07-27 CVE-ID : CVE-2020-15660 Package : geckodriver Type : cross-site request forgery Remote : Yes Link : https://security.archlinux.org/AVG-2180 Summary ======= The package geckodriver before version 0.29.1-1 is vulnerable to cross- site request forgery. Resolution ========== Upgrade to 0.29.1-1. # pacman -Syu "geckodriver>=0.29.1-1" The problem has been fixed upstream in version 0.29.1. Workaround ========== None. Description =========== Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a cross-site request forgery (CSRF) vulnerability, that might, when paired with a specifically prepared request, lead to remote code execution. Impact ====== A remote attacker could execute arbitrary code through a crafted request. References ========== https://bugs.archlinux.org/task/71558 https://github.com/mozilla/geckodriver/releases/tag/v0.27.0 https://security.archlinux.org/CVE-2020-15660

1 0

[ASA-202107-70] containerd: directory traversal
by Jonas Witschel 30 Jul '21

30 Jul '21

Arch Linux Security Advisory ASA-202107-70 ========================================== Severity: Medium Date : 2021-07-27 CVE-ID : CVE-2021-32760 Package : containerd Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-2174 Summary ======= The package containerd before version 1.5.4-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 1.5.4-1. # pacman -Syu "containerd>=1.5.4-1" The problem has been fixed upstream in version 1.5.4. Workaround ========== As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files. Description =========== A bug was found in containerd version prior to 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host's filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. Impact ====== A crafted container image could change file permissions on the host system, leading to potential denial of service or information disclosure. References ========== https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj… https://github.com/containerd/containerd/commit/37a44de17d5d09e258e3c8c29d3… https://security.archlinux.org/CVE-2021-32760

1 0

[ASA-202107-69] consul: multiple issues
by Jonas Witschel 30 Jul '21

30 Jul '21

Arch Linux Security Advisory ASA-202107-69 ========================================== Severity: Medium Date : 2021-07-27 CVE-ID : CVE-2021-32574 CVE-2021-36213 Package : consul Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2171 Summary ======= The package consul before version 1.9.8-1 is vulnerable to multiple issues including access restriction bypass and certificate verification bypass. Resolution ========== Upgrade to 1.9.8-1. # pacman -Syu "consul>=1.9.8-1" The problems have been fixed upstream in version 1.9.8. Workaround ========== None. Description =========== - CVE-2021-32574 (certificate verification bypass) HashiCorp Consul before version 1.9.8 does not validate SSL certificates correctly: xds does not ensure that the Subject Alternative Name of an upstream is validated. - CVE-2021-36213 (access restriction bypass) In HashiCorp Consul before version 1.9.8, xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action. Impact ====== A single L7 deny intention could erroneously result in an allow action, leading to access restriction bypass. Furthermore, a malicious upstream could present an invalid certificate. References ========== https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configurat… https://github.com/hashicorp/consul/issues/6364 https://github.com/hashicorp/consul/pull/10621 https://github.com/hashicorp/consul/pull/10623 https://github.com/hashicorp/consul/commit/2bca52fa88caedc2b6a7cc3627f3cd1f… https://github.com/hashicorp/consul/commit/0b4fe4b7a2a7c400521248a0d5484299… https://discuss.hashicorp.com/t/hcsec-2021-16-consul-s-application-aware-in… https://github.com/hashicorp/consul/pull/10619 https://github.com/hashicorp/consul/pull/10620 https://github.com/hashicorp/consul/commit/3ca24425ef7ad223077269a42041622f… https://security.archlinux.org/CVE-2021-32574 https://security.archlinux.org/CVE-2021-36213

1 0

[ASA-202107-68] wpewebkit: multiple issues
by Jonas Witschel 30 Jul '21

30 Jul '21

Arch Linux Security Advisory ASA-202107-68 ========================================== Severity: High Date : 2021-07-27 CVE-ID : CVE-2021-21775 CVE-2021-21779 CVE-2021-30663 CVE-2021-30665 CVE-2021-30689 CVE-2021-30720 CVE-2021-30734 CVE-2021-30744 CVE-2021-30749 CVE-2021-30795 CVE-2021-30797 CVE-2021-30799 Package : wpewebkit Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2221 Summary ======= The package wpewebkit before version 2.32.3-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, cross-site scripting and information disclosure. Resolution ========== Upgrade to 2.32.3-1. # pacman -Syu "wpewebkit>=2.32.3-1" The problems have been fixed upstream in version 2.32.3. Workaround ========== None. Description =========== - CVE-2021-21775 (information disclosure) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of WebKit. A specially crafted web page can lead to a potential information leak and further memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a malicious webpage. - CVE-2021-21779 (information disclosure) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. A use-after-free vulnerability exists in the way that WebKit GraphicsContext handles certain events. A specially crafted web page can lead to a potential information leak and further memory corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability. - CVE-2021-30663 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30665 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. - CVE-2021-30689 (cross-site scripting) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2021-30720 (access restriction bypass) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. A malicious website may be able to access restricted ports on arbitrary servers. - CVE-2021-30734 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30744 (cross-site scripting) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2021-30749 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30795 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2021-30797 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to code execution. - CVE-2021-30799 (arbitrary code execution) A security issue has been found in WebKitGTK and WPE WebKit before 2.32.3. Processing maliciously crafted web content may lead to arbitrary code execution. Impact ====== A remote attacker could execute arbitrary code or disclose sensitive information through crafted web content. Apple is aware of a report that one of the arbitrary code execution issues may have been actively exploited. References ========== https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-21775 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1229 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-21779 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1238 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30663 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30665 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30689 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30720 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30734 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30744 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30749 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30795 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30797 https://webkitgtk.org/security/WSA-2021-0004.html#CVE-2021-30799 https://security.archlinux.org/CVE-2021-21775 https://security.archlinux.org/CVE-2021-21779 https://security.archlinux.org/CVE-2021-30663 https://security.archlinux.org/CVE-2021-30665 https://security.archlinux.org/CVE-2021-30689 https://security.archlinux.org/CVE-2021-30720 https://security.archlinux.org/CVE-2021-30734 https://security.archlinux.org/CVE-2021-30744 https://security.archlinux.org/CVE-2021-30749 https://security.archlinux.org/CVE-2021-30795 https://security.archlinux.org/CVE-2021-30797 https://security.archlinux.org/CVE-2021-30799

1 0