- Arch-security - lists.archlinux.org

[ASA-202107-37] putty: content spoofing
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-37 ========================================== Severity: Low Date : 2021-07-20 CVE-ID : CVE-2021-36367 Package : putty Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-2143 Summary ======= The package putty before version 0.76-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 0.76-1. # pacman -Syu "putty>=0.76-1" The problem has been fixed upstream in version 0.76. Workaround ========== None. Description =========== PuTTY before version 0.76 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. This makes it easier for an attacker-controlled SSH server to present a later spoofed authentication prompt (that the attacker can use to capture credential data, and use that data for purposes that are undesired by the client user). Impact ====== A remote SSH server could present a spoofed authentication prompt. References ========== https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=1dc5659aa62848f0… https://security.archlinux.org/CVE-2021-36367

1 0

[ASA-202107-36] libuv: information disclosure
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-36 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-22918 Package : libuv Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2131 Summary ======= The package libuv before version 1.41.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.41.1-1. # pacman -Syu "libuv>=1.41.1-1" The problem has been fixed upstream in version 1.41.1. Workaround ========== None. Description =========== libuv before version 1.14.1, as bundled by Node.js before versions 16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. Impact ====== Attempting to look up a crafted domain name could disclose sensitive information or crash an application using libuv. References ========== https://github.com/libuv/libuv/issues/3147 https://hackerone.com/reports/1209681 https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de2… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv… https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631… https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac… https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc09… https://security.archlinux.org/CVE-2021-22918

1 0

[ASA-202107-35] dino: directory traversal
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-35 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-33896 Package : dino Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2043 Summary ======= The package dino before version 0.2.1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 0.2.1-1. # pacman -Syu "dino>=0.2.1-1" The problem has been fixed upstream in version 0.2.1. Workaround ========== None. Description =========== It was discovered that when a user receives and downloads a file in Dino before version 0.2.1, URI-encoded path separators in the file name will be decoded, allowing an attacker to traverse directories and create arbitrary files in the context of the user. This vulnerability does not allow to overwrite or modify existing files and the attacker cannot control the executable flag of created files. However, third-party software may be affected by newly created configuration files, potentially allowing for code execution. The file name, including path separators, is displayed to the user, however, long file names are ellipsized in the middle of the file name, allowing the attacker to hide the malicious path separators, as long as the resulting file name has sufficient length. Impact ====== A remote attacker could create files in arbitrary locations in the context of the user by tricking the user into downloading a file with a crafted file name. References ========== https://dino.im/security/cve-2021-33896/ https://github.com/dino/dino/commit/1eaad1ccfbd00c6e76650535496531c172453994 https://security.archlinux.org/CVE-2021-33896

1 0

[ASA-202107-34] code: arbitrary code execution
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-34 ========================================== Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-31211 CVE-2021-31214 Package : code Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1963 Summary ======= The package code before version 1.58.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.58.0-1. # pacman -Syu "code>=1.58.0-1" The problems have been fixed upstream in version 1.58.0. Workaround ========== None. Description =========== - CVE-2021-31211 (arbitrary code execution) An arbitrary code execution vulnerability through crafted remote terminal settings has been found in Visual Studio Code before version 1.57.0. - CVE-2021-31214 (arbitrary code execution) An arbitrary code execution vulnerability in the Grunt, Gulp and Jake task auto detection has been found in Visual Studio Code before version 1.57.0. Impact ====== An attacker could execute arbitrary code through crafted remote terminal settings or JavaScript task runner configuration files without user interaction. References ========== https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021… https://github.com/microsoft/vscode/issues/123590 https://github.com/microsoft/vscode/commit/7259955ce318a2bb2a86ee121c34dcaa… https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021… https://github.com/microsoft/vscode/issues/123588 https://github.com/microsoft/vscode/commit/5f3466a21e80b2c016a1c0cbe2af683c… https://security.archlinux.org/CVE-2021-31211 https://security.archlinux.org/CVE-2021-31214

1 0

[ASA-202107-33] nodejs-lts-erbium: multiple issues
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-33 ========================================== Severity: High Date : 2021-07-20 CVE-ID : CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 Package : nodejs-lts-erbium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2128 Summary ======= The package nodejs-lts-erbium before version 12.22.3-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 12.22.3-1. # pacman -Syu "nodejs-lts-erbium>=12.22.3-1" The problems have been fixed upstream in version 12.22.3. Workaround ========== None. Description =========== - CVE-2021-22918 (information disclosure) libuv before version 1.14.1, as bundled by Node.js before versions 16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. - CVE-2021-23362 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. - CVE-2021-27290 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. Impact ====== A remote attacker could disclose information by supplying crafted domain names, or cause denial of service through high resource usage with crafted Git repository URLs or Subresource Integrity (SRI) hashes. References ========== https://github.com/libuv/libuv/issues/3147 https://hackerone.com/reports/1209681 https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de2… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv… https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631… https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac… https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc09… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 https://github.com/npm/hosted-git-info/pull/76 https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f8… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://github.com/advisories/GHSA-vx3p-948g-6vhq https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf https://github.com/npm/ssri/pull/17 https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2 https://security.archlinux.org/CVE-2021-22918 https://security.archlinux.org/CVE-2021-23362 https://security.archlinux.org/CVE-2021-27290

1 0

[ASA-202107-32] nodejs-lts-fermium: multiple issues
by Jonas Witschel 20 Jul '21

20 Jul '21

Arch Linux Security Advisory ASA-202107-32 ========================================== Severity: High Date : 2021-07-20 CVE-ID : CVE-2021-22918 CVE-2021-23362 CVE-2021-27290 Package : nodejs-lts-fermium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2127 Summary ======= The package nodejs-lts-fermium before version 14.17.3-1 is vulnerable to multiple issues including denial of service and information disclosure. Resolution ========== Upgrade to 14.17.3-1. # pacman -Syu "nodejs-lts-fermium>=14.17.3-1" The problems have been fixed upstream in version 14.17.3. Workaround ========== None. Description =========== - CVE-2021-22918 (information disclosure) libuv before version 1.14.1, as bundled by Node.js before versions 16.4.1, 14.17.2 and 12.22.2, is vulnerable to an out-of-bounds read in the libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. - CVE-2021-23362 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. - CVE-2021-27290 (denial of service) A security issue has been found in Node.js before versions 16.4.1, 14.17.2 and 12.22.2. There is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. Impact ====== A remote attacker could disclose information by supplying crafted domain names, or cause denial of service through high resource usage with crafted Git repository URLs or Subresource Integrity (SRI) hashes. References ========== https://github.com/libuv/libuv/issues/3147 https://hackerone.com/reports/1209681 https://github.com/libuv/libuv/commit/86dbeb4bd665749d6234ae90d30923e210de2… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#libuv… https://github.com/nodejs/node/commit/d33aead28bcec32a2a450f884907a6d971631… https://github.com/nodejs/node/commit/a7496aba0a95b6425e9651c297697b5dd67ac… https://github.com/nodejs/node/commit/623fd1fcb557985bf452984856c1d0ce4fc09… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355 https://github.com/npm/hosted-git-info/pull/76 https://github.com/npm/hosted-git-info/commit/bede0dc38e1785e732bf0a48ba6f8… https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/#npm-u… https://github.com/advisories/GHSA-vx3p-948g-6vhq https://doyensec.com/resources/Doyensec_Advisory_ssri_redos.pdf https://github.com/npm/ssri/pull/17 https://github.com/npm/ssri/commit/76e223317d971f19e4db8191865bdad5edee40d2 https://security.archlinux.org/CVE-2021-22918 https://security.archlinux.org/CVE-2021-23362 https://security.archlinux.org/CVE-2021-27290

1 0

[ASA-202107-31] vivaldi: arbitrary code execution
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-31 ========================================== Severity: High Date : 2021-07-16 CVE-ID : CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Package : vivaldi Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2167 Summary ======= The package vivaldi before version 4.0.2312.41-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.0.2312.41-1. # pacman -Syu "vivaldi>=4.0.2312.41-1" The problems have been fixed upstream in version 4.0.2312.41. Workaround ========== None. Description =========== - CVE-2021-30541 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30559 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30560 (arbitrary code execution) A use after free security issue has been found in the Blink XSLT component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30561 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30562 (arbitrary code execution) A use after free security issue has been found in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30563 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild. - CVE-2021-30564 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebXR component of the Chromium browser engine before version 91.0.4472.164. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://vivaldi.com/blog/desktop/minor-update-3-for-vivaldi-desktop-browser… https://vivaldi.com/blog/desktop/minor-update-6-for-desktop-4-0/ https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1214842 https://crbug.com/1219082 https://crbug.com/1219209 https://crbug.com/1219630 https://crbug.com/1220078 https://crbug.com/1228407 https://crbug.com/1221309 https://security.archlinux.org/CVE-2021-30541 https://security.archlinux.org/CVE-2021-30559 https://security.archlinux.org/CVE-2021-30560 https://security.archlinux.org/CVE-2021-30561 https://security.archlinux.org/CVE-2021-30562 https://security.archlinux.org/CVE-2021-30563 https://security.archlinux.org/CVE-2021-30564

1 0

[ASA-202107-30] chromium: arbitrary code execution
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-30 ========================================== Severity: High Date : 2021-07-16 CVE-ID : CVE-2021-30541 CVE-2021-30559 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2166 Summary ======= The package chromium before version 91.0.4472.164-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 91.0.4472.164-1. # pacman -Syu "chromium>=91.0.4472.164-1" The problems have been fixed upstream in version 91.0.4472.164. Workaround ========== None. Description =========== - CVE-2021-30541 (arbitrary code execution) A use after free security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30559 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30560 (arbitrary code execution) A use after free security issue has been found in the Blink XSLT component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30561 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30562 (arbitrary code execution) A use after free security issue has been found in the WebSerial component of the Chromium browser engine before version 91.0.4472.164. - CVE-2021-30563 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 91.0.4472.164. Google is aware of reports that an exploit for CVE-2021-30563 exists in the wild. - CVE-2021-30564 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebXR component of the Chromium browser engine before version 91.0.4472.164. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1214842 https://crbug.com/1219082 https://crbug.com/1219209 https://crbug.com/1219630 https://crbug.com/1220078 https://crbug.com/1228407 https://crbug.com/1221309 https://security.archlinux.org/CVE-2021-30541 https://security.archlinux.org/CVE-2021-30559 https://security.archlinux.org/CVE-2021-30560 https://security.archlinux.org/CVE-2021-30561 https://security.archlinux.org/CVE-2021-30562 https://security.archlinux.org/CVE-2021-30563 https://security.archlinux.org/CVE-2021-30564

1 0

[ASA-202107-29] systemd: denial of service
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-29 ========================================== Severity: Low Date : 2021-07-14 CVE-ID : CVE-2020-13529 Package : systemd Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1935 Summary ======= The package systemd before version 249-2 is vulnerable to denial of service. Resolution ========== Upgrade to 249-2. # pacman -Syu "systemd>=249-2" The problem has been fixed upstream in version 249. Workaround ========== None. Description =========== An exploitable denial-of-service vulnerability exists in systemd- networkd before version 249. A maliciously crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server. Impact ====== A network-adjacent attacker could reconfigure the networking properties of a device running systemd-networkd through crafted DHCP packets. References ========== https://talosintelligence.com/vulnerability_reports/TALOS-2020-1142 https://github.com/systemd/systemd/issues/16774 https://github.com/systemd/systemd/pull/20002 https://github.com/systemd/systemd/commit/38e980a6a5a3442c2f48b1f8272843880… https://security.archlinux.org/CVE-2020-13529

1 0

[ASA-202107-28] varnish: url request injection
by Jonas Witschel 16 Jul '21

16 Jul '21

Arch Linux Security Advisory ASA-202107-28 ========================================== Severity: Medium Date : 2021-07-14 CVE-ID : CVE-2021-36740 Package : varnish Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-2154 Summary ======= The package varnish before version 6.6.1-1 is vulnerable to url request injection. Resolution ========== Upgrade to 6.6.1-1. # pacman -Syu "varnish>=6.6.1-1" The problem has been fixed upstream in version 6.6.1. Workaround ========== The issue can be mitigated by turning off support for HTTP/2, using sudo varnishadm param.set feature -http2 or by preventing connection reuse with the following configuration: sub vcl_backend_fetch { set bereq.http.Connection = "close"; } Description =========== Varnish Cache before version 6.6.1, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. Impact ====== A remote attacker could inject arbitrary HTTP requests through an HTTP/2 POST request with a large Content-Length header. References ========== https://varnish-cache.org/security/VSV00007.html https://github.com/varnishcache/varnish-cache/commit/7d73bc843ea9bff79e3377… https://security.archlinux.org/CVE-2021-36740

1 0