- Arch-security - lists.archlinux.org

[ASA-202107-47] chromium: multiple issues
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-47 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-30565 CVE-2021-30566 CVE-2021-30567 CVE-2021-30568 CVE-2021-30569 CVE-2021-30571 CVE-2021-30572 CVE-2021-30573 CVE-2021-30574 CVE-2021-30575 CVE-2021-30576 CVE-2021-30578 CVE-2021-30579 CVE-2021-30581 CVE-2021-30582 CVE-2021-30584 CVE-2021-30585 CVE-2021-30588 CVE-2021-30589 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2200 Summary ======= The package chromium before version 92.0.4515.107-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, content spoofing, incorrect calculation, information disclosure and insufficient validation. Resolution ========== Upgrade to 92.0.4515.107-1. # pacman -Syu "chromium>=92.0.4515.107-1" The problems have been fixed upstream in version 92.0.4515.107. Workaround ========== None. Description =========== - CVE-2021-30565 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30566 (arbitrary code execution) A stack buffer overflow security issue has been found in the Printing component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30567 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30568 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebGL component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30569 (arbitrary code execution) A use after free security issue has been found in the sqlite component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30571 (access restriction bypass) An insufficient policy enforcement security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30572 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30573 (arbitrary code execution) A use after free security issue has been found in the GPU component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30574 (arbitrary code execution) A use after free security issue has been found in the protocol handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30575 (information disclosure) An out of bounds read security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30576 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30578 (arbitrary code execution) An uninitialized use security issue has been found in the Media component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30579 (arbitrary code execution) A use after free security issue has been found in the UI framework component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30581 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30582 (incorrect calculation) An inappropriate implementation security issue has been found in the Animation component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30584 (content spoofing) An incorrect security UI security issue has been found in the Downloads component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30585 (arbitrary code execution) A use after free security issue has been found in the sensor handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30588 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30589 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Sharing component of the Chromium browser engine before version 92.0.4515.107. Impact ====== A remote attacker could execute arbitrary code or spoof content through a crafted web page. References ========== https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1210985 https://crbug.com/1202661 https://crbug.com/1211326 https://crbug.com/1219886 https://crbug.com/1218707 https://crbug.com/1101897 https://crbug.com/1214234 https://crbug.com/1216822 https://crbug.com/1227315 https://crbug.com/1213313 https://crbug.com/1194896 https://crbug.com/1201074 https://crbug.com/1207277 https://crbug.com/1194431 https://crbug.com/1205981 https://crbug.com/1213350 https://crbug.com/1023503 https://crbug.com/1195650 https://crbug.com/1180510 https://security.archlinux.org/CVE-2021-30565 https://security.archlinux.org/CVE-2021-30566 https://security.archlinux.org/CVE-2021-30567 https://security.archlinux.org/CVE-2021-30568 https://security.archlinux.org/CVE-2021-30569 https://security.archlinux.org/CVE-2021-30571 https://security.archlinux.org/CVE-2021-30572 https://security.archlinux.org/CVE-2021-30573 https://security.archlinux.org/CVE-2021-30574 https://security.archlinux.org/CVE-2021-30575 https://security.archlinux.org/CVE-2021-30576 https://security.archlinux.org/CVE-2021-30578 https://security.archlinux.org/CVE-2021-30579 https://security.archlinux.org/CVE-2021-30581 https://security.archlinux.org/CVE-2021-30582 https://security.archlinux.org/CVE-2021-30584 https://security.archlinux.org/CVE-2021-30585 https://security.archlinux.org/CVE-2021-30588 https://security.archlinux.org/CVE-2021-30589

1 0

[ASA-202107-46] opera: arbitrary code execution
by Jonas Witschel 22 Jul '21

22 Jul '21

Arch Linux Security Advisory ASA-202107-46 ========================================== Severity: High Date : 2021-07-21 CVE-ID : CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Package : opera Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2168 Summary ======= The package opera before version 77.0.4054.277-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 77.0.4054.277-1. # pacman -Syu "opera>=77.0.4054.277-1" The problems have been fixed upstream in version 77.0.4054.277. Workaround ========== None. Description =========== - CVE-2021-30541 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30559 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30560 (arbitrary code execution) A use after free security issue has been found in the Blink XSLT component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30561 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30562 (arbitrary code execution) A use after free security issue has been found in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30563 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild. - CVE-2021-30564 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebXR component of the Chromium browser engine before version 91.0.4472.164. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://blogs.opera.com/desktop/changelog-for-77/ https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1214842 https://crbug.com/1219082 https://crbug.com/1219209 https://crbug.com/1219630 https://crbug.com/1220078 https://crbug.com/1228407 https://crbug.com/1221309 https://security.archlinux.org/CVE-2021-30541 https://security.archlinux.org/CVE-2021-30559 https://security.archlinux.org/CVE-2021-30560 https://security.archlinux.org/CVE-2021-30561 https://security.archlinux.org/CVE-2021-30562 https://security.archlinux.org/CVE-2021-30563 https://security.archlinux.org/CVE-2021-30564

1 0

[ASA-202107-45] telegram-desktop: content spoofing
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-45 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-36769 Package : telegram-desktop Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-2170 Summary ======= The package telegram-desktop before version 2.8.11-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 2.8.11-1. # pacman -Syu "telegram-desktop>=2.8.11-1" The problem has been fixed upstream in version 2.8.11. Workaround ========== None. Description =========== A reordering issue exists in Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent by a client. Impact ====== A man-in-the-middle attacker could reorder the messages sent by a client, potentially altering the meaning of the conversation. References ========== https://mtpsym.github.io/ https://security.archlinux.org/CVE-2021-36769

1 0

[ASA-202107-44] wireshark-cli: denial of service
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-44 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-22235 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2160 Summary ======= The package wireshark-cli before version 3.4.7-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.4.7-1. # pacman -Syu "wireshark-cli>=3.4.7-1" The problem has been fixed upstream in version 3.4.7. Workaround ========== None. Description =========== It may be possible to make Wireshark before version 3.4.7 crash by injecting a malformed DNP3 packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker could crash Wireshark with crafted DNP3 packets through packet injection or a crafted capture file. References ========== https://www.wireshark.org/security/wnpa-sec-2021-06 https://gitlab.com/wireshark/wireshark/-/issues/17462 https://gitlab.com/wireshark/wireshark/-/merge_requests/3477 https://gitlab.com/wireshark/wireshark/-/commit/490fe2684bf63cf4fe03e6495c9… https://security.archlinux.org/CVE-2021-22235

1 0

[ASA-202107-43] ant: denial of service
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-43 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-36373 CVE-2021-36374 Package : ant Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-2151 Summary ======= The package ant before version 1.10.11-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.10.11-1. # pacman -Syu "ant>=1.10.11-1" The problems have been fixed upstream in version 1.10.11. Workaround ========== None. Description =========== - CVE-2021-36373 (denial of service) When reading a specially crafted TAR archive, Apache Ant before version 1.10.11 can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. - CVE-2021-36374 (denial of service) When reading a specially crafted ZIP archive, or a derived format, Apache Ant before version 1.10.11 can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Impact ====== A crafted TAR or ZIP archive could consume large amounts of memory, leading to denial of service. References ========== https://www.openwall.com/lists/oss-security/2021/07/13/5 https://github.com/apache/ant/commit/6594a2d66f7f060dafcbbf094dd60676db19a8… https://www.openwall.com/lists/oss-security/2021/07/13/6 https://security.archlinux.org/CVE-2021-36373 https://security.archlinux.org/CVE-2021-36374

1 0

[ASA-202107-42] go: denial of service
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-42 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-34558 Package : go Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2147 Summary ======= The package go before version 2:1.16.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2:1.16.6-1. # pacman -Syu "go>=2:1.16.6-1" The problem has been fixed upstream in version 1.16.6. Workaround ========== Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher suites without ECDHE), as well as TLS 1.3-only clients, are unaffected. Description =========== A security issue has been found in Go before version 1.16.6. crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists (or can be issued), or the client is configured with Config.InsecureSkipVerify. Clients that disable all TLS_RSA cipher suites (that is, TLS 1.0–1.2 cipher suites without ECDHE), as well as TLS 1.3-only clients, are unaffected. Impact ====== A man-in-the-middle attacker able to intercept a TLS negotiation could crash a TLS client by injecting a crafted invalid certificate. References ========== https://groups.google.com/g/golang-announce/c/n9FxMelZGAQ/m/4ZhvTx0dAQAJ https://github.com/golang/go/issues/47143 https://github.com/golang/go/commit/58bc454a11d4b3dbc03f44dfcabb9068a9c076f4 https://security.archlinux.org/CVE-2021-34558

1 0

[ASA-202107-41] nextcloud-app-mail: information disclosure
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-41 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-32707 Package : nextcloud-app-mail Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2145 Summary ======= The package nextcloud-app-mail before version 1.10.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.10.1-1. # pacman -Syu "nextcloud-app-mail>=1.10.1-1" The problem has been fixed upstream in version 1.10.1. Workaround ========== None. Description =========== In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with `background-image` CSS attribute. Note that the images were still passed through the Nextcloud image proxy, and thus there was no IP leakage. Impact ====== A remote attacker could disclose whether an email message has been read by embedding a remote CSS background image. References ========== https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x… https://hackerone.com/reports/1215251 https://github.com/nextcloud/mail/pull/5189 https://github.com/nextcloud/mail/commit/e54c2331f4b98cc39a5b3899c8ed1468df… https://security.archlinux.org/CVE-2021-32707

1 0

[ASA-202107-40] openvswitch: arbitrary code execution
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-40 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-36980 Package : openvswitch Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-2177 Summary ======= The package openvswitch before version 2.15.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.15.1-1. # pacman -Syu "openvswitch>=2.15.1-1" The problem has been fixed upstream in version 2.15.1. Workaround ========== None. Description =========== Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after- free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action. Impact ====== An attacker could execute arbitrary code through crafted Open vSwitch Actions. References ========== https://github.com/google/oss-fuzz-vulns/blob/main/vulns/openvswitch/OSV-20… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851 https://github.com/openvswitch/ovs/commit/38744b1bcb022c611712527f039722115… https://security.archlinux.org/CVE-2021-36980

1 0

[ASA-202107-39] racket: sandbox escape
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-39 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-32773 Package : racket Type : sandbox escape Remote : Yes Link : https://security.archlinux.org/AVG-2175 Summary ======= The package racket before version 8.2-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 8.2-1. # pacman -Syu "racket>=8.2-1" The problem has been fixed upstream in version 8.2. Workaround ========== None. Description =========== In Racket versions prior to 8.2, code evaluated using the Racket sandbox could cause system modules to incorrectly use attacker-created modules instead of their intended dependencies. This could allow system functions to be controlled by the attacker, giving access to facilities intended to be restricted. Impact ====== Code executed in the Racket sandbox could escape its confinement through attacker-created modules. References ========== https://github.com/racket/racket/security/advisories/GHSA-cgrw-p7p7-937c https://github.com/racket/racket/commit/9877b84eaadd14e54e555b9f0ac8d784474… https://security.archlinux.org/CVE-2021-32773

1 0

[ASA-202107-38] firefox-ublock-origin: denial of service
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-38 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-36773 Package : firefox-ublock-origin Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2172 Summary ======= The package firefox-ublock-origin before version 1.36.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.36.2-1. # pacman -Syu "firefox-ublock-origin>=1.36.2-1" The problem has been fixed upstream in version 1.36.2. Workaround ========== None. Description =========== uBlock Origin before 1.36.2 supports an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality). Impact ====== A crafted web site could consume a lot of memory, disabling all blocking functionality. References ========== https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and… https://github.com/uBlockOrigin/uBlock-issues/issues/1649 https://github.com/gorhill/uBlock/commit/365b20e8cc27cd776ef3868b02ea739ba3… https://security.archlinux.org/CVE-2021-36773

1 0