- Arch-security - lists.archlinux.org

[ASA-202106-52] helm: information disclosure
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-52 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-32690 Package : helm Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2078 Summary ======= The package helm before version 3.6.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 3.6.1-1. # pacman -Syu "helm>=3.6.1-1" The problem has been fixed upstream in version 3.6.1. Workaround ========== None. Description =========== In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. The index.yaml within a Helm chart repository contains a reference where to get the chart archive for each version of a chart. The reference can be relative to the index.yaml file or a URL to location. The URL can point to any domain and this is a feature leveraged by Helm users. For example, an index.yaml file can be hosted on GitHub pages while the chart archives are hosted as GitHub releases. These are on different domain names and the index.yaml file points to the other domain. When a username and password were associated with a Helm repository the username and password were also passed on to other domains referenced in the index.yaml file. This occurred when Helm went to retrieve a specific chart archive on the other domain. Impact ====== Username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. References ========== https://github.com/helm/helm/security/advisories/GHSA-56hp-xqp3-w2jf https://github.com/helm/helm/commit/61d8e8c4a6f95540c15c6a65f36a6dd0a45e7a2f https://security.archlinux.org/CVE-2021-32690

1 0

[ASA-202106-51] matrix-appservice-irc: insufficient validation
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-51 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-32659 Package : matrix-appservice-irc Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-2076 Summary ======= The package matrix-appservice-irc before version 0.27.0-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 0.27.0-1. # pacman -Syu "matrix-appservice-irc>=0.27.0-1" The problem has been fixed upstream in version 0.27.0. Workaround ========== As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options. Description =========== In versions 2.6.0 and earlier of matrix-appservice-bridge, as included in matrix-appservice-irc before version 0.27.0, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. Versions 2.6.1 and greater are patched. As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options. Impact ====== A malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. References ========== https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/… https://github.com/matrix-org/matrix-appservice-irc/releases/tag/0.27.0 https://github.com/matrix-org/matrix-appservice-bridge/pull/330 https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34… https://security.archlinux.org/CVE-2021-32659

1 0

[ASA-202106-50] tor: denial of service
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-50 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-34548 CVE-2021-34549 CVE-2021-34550 Package : tor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2075 Summary ======= The package tor before version 0.4.5.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.4.5.9-1. # pacman -Syu "tor>=0.4.5.9-1" The problems have been fixed upstream in version 0.4.5.9. Workaround ========== None. Description =========== - CVE-2021-34548 (denial of service) A security issue has been found in Tor before version 0.4.5.9. Relays could spoof RELAY_END or RELAY_RESOLVED cell on half-closed streams because clients failed to validate which hop sent these cells. This would allow a relay on a circuit to end a stream that wasn't actually built with it. - CVE-2021-34549 (denial of service) A security issue has been found in Tor before version 0.4.5.9 that could be exploited for a hashtable-based CPU denial-of-service attack against relays. Previously a naive unkeyed hash function to look up circuits in a circuitmux object was used. An attacker could exploit this to construct circuits with chosen circuit IDs, to create collisions and make the hash table inefficient. Now a SipHash construction is used instead. - CVE-2021-34550 (denial of service) A security issue has been found in Tor before version 0.4.5.9. An out- of-bounds memory access in the v3 onion service descriptor parsing could be exploited by crafting an onion service descriptor that would crash any client that tried to visit it. Impact ====== A malicious relay could terminate client connections through crafted cells, leading to denial of service. A malicious client could cause denial of service on a relay through high resource usage using crafted circuit IDs. Lastly, clients could be crashed through crafted onion service descriptors. References ========== https://blog.torproject.org/node/2041 https://gitlab.torproject.org/tpo/core/tor/-/issues/40389 https://gitlab.torproject.org/tpo/core/tor/-/commit/adb248b6d6e0779719e6b87… https://gitlab.torproject.org/tpo/core/tor/-/issues/40391 https://gitlab.torproject.org/tpo/core/tor/-/commit/4c06c619faceb5d158a725d… https://gitlab.torproject.org/tpo/core/tor/-/issues/40392 https://gitlab.torproject.org/tpo/core/tor/-/commit/f57b5c48e0aa01acd84a194… https://security.archlinux.org/CVE-2021-34548 https://security.archlinux.org/CVE-2021-34549 https://security.archlinux.org/CVE-2021-34550

1 0

[ASA-202106-49] libslirp: information disclosure
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-49 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 Package : libslirp Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-2073 Summary ======= The package libslirp before version 4.6.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.6.0-1. # pacman -Syu "libslirp>=4.6.0-1" The problems have been fixed upstream in version 4.6.0. Workaround ========== None. Description =========== - CVE-2021-3592 (information disclosure) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU before version 4.6.0. The flaw exists in the bootp_input() function and could occur while processing a UDP packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. - CVE-2021-3593 (information disclosure) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU before version 4.6.0. The flaw exists in the udp6_input() function and could occur while processing a UDP packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. - CVE-2021-3594 (information disclosure) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU before version 4.6.0. The flaw exists in the udp_input() function and could occur while processing a UDP packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. - CVE-2021-3595 (information disclosure) An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU before version 4.6.0. The flaw exists in the tftp_input() function and could occur while processing a UDP packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. Impact ====== A malicious guest could disclose contents of the host's memory using crafted UDP packets. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1970484 https://gitlab.freedesktop.org/slirp/libslirp/-/issues/44 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/93e645e72a056ec0b2c1… https://gitlab.freedesktop.org/slirp/libslirp/-/commit/f13cad45b25d92760bb0… https://gitlab.freedesktop.org/slirp/libslirp/-/commit/2eca0838eee1da962045… https://bugzilla.redhat.com/show_bug.cgi?id=1970487 https://gitlab.freedesktop.org/slirp/libslirp/-/issues/45 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/de71c15de66ba9350bf6… https://bugzilla.redhat.com/show_bug.cgi?id=1970491 https://gitlab.freedesktop.org/slirp/libslirp/-/issues/47 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/74572be49247c8c5feae… https://bugzilla.redhat.com/show_bug.cgi?id=1970489 https://gitlab.freedesktop.org/slirp/libslirp/-/issues/46 https://gitlab.freedesktop.org/slirp/libslirp/-/commit/3f17948137155f025f78… https://gitlab.freedesktop.org/slirp/libslirp/-/commit/990163cf3ac86b787555… https://security.archlinux.org/CVE-2021-3592 https://security.archlinux.org/CVE-2021-3593 https://security.archlinux.org/CVE-2021-3594 https://security.archlinux.org/CVE-2021-3595

1 0

[ASA-202106-48] nginx-mainline: arbitrary code execution
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-48 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-23017 Package : nginx-mainline Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1987 Summary ======= The package nginx-mainline before version 1.21.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.21.0-1. # pacman -Syu "nginx-mainline>=1.21.0-1" The problem has been fixed upstream in version 1.21.0. Workaround ========== The issue can be mitigated by removing the "resolver" directive from the configuration file. Description =========== A security issue in nginx resolver was identified, which might allow an attacker to cause 1-byte memory overwrite by using a specially crafted DNS response, resulting in worker process crash or, potentially, in arbitrary code execution. The issue only affects nginx if the "resolver" directive is used in the configuration file. Further, the attack is only possible if an attacker is able to forge UDP packets from the DNS server. Impact ====== A remote attacker could crash the nginx server, or potentially execute arbitrary code, using a crafted DNS server response. References ========== https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html http://nginx.org/download/patch.2021.resolver.txt https://github.com/nginx/nginx/commit/7199ebc203f74fd9e44595474de6bdc41740c… https://security.archlinux.org/CVE-2021-23017

1 0

[ASA-202106-47] vivaldi: arbitrary code execution
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-47 ========================================== Severity: High Date : 2021-06-22 CVE-ID : CVE-2021-30554 CVE-2021-30555 CVE-2021-30556 CVE-2021-30557 Package : vivaldi Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2082 Summary ======= The package vivaldi before version 4.0.2312.33-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.0.2312.33-1. # pacman -Syu "vivaldi>=4.0.2312.33-1" The problems have been fixed upstream in version 4.0.2312.33. Workaround ========== None. Description =========== - CVE-2021-30554 (arbitrary code execution) A use after free security issue has been found in the WebGL component of the Chromium browser engine before version 91.0.4472.114. Google is aware that an exploit for CVE-2021-30554 exists in the wild. - CVE-2021-30555 (arbitrary code execution) A use after free security issue has been found in the Sharing component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30556 (arbitrary code execution) A use after free security issue has been found in the WebAudio component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30557 (arbitrary code execution) A use after free security issue has been found in the TabGroups component of the Chromium browser engine before version 91.0.4472.114. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://vivaldi.com/blog/desktop/minor-update-for-vivaldi-desktop-browser-4… https://vivaldi.com/blog/desktop/minor-update-3-for-vivaldi-desktop-browser… https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1219857 https://crbug.com/1215029 https://crbug.com/1212599 https://crbug.com/1202102 https://security.archlinux.org/CVE-2021-30554 https://security.archlinux.org/CVE-2021-30555 https://security.archlinux.org/CVE-2021-30556 https://security.archlinux.org/CVE-2021-30557

1 0

[ASA-202106-46] chromium: arbitrary code execution
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-46 ========================================== Severity: High Date : 2021-06-22 CVE-ID : CVE-2021-30554 CVE-2021-30555 CVE-2021-30556 CVE-2021-30557 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2081 Summary ======= The package chromium before version 91.0.4472.114-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 91.0.4472.114-1. # pacman -Syu "chromium>=91.0.4472.114-1" The problems have been fixed upstream in version 91.0.4472.114. Workaround ========== None. Description =========== - CVE-2021-30554 (arbitrary code execution) A use after free security issue has been found in the WebGL component of the Chromium browser engine before version 91.0.4472.114. Google is aware that an exploit for CVE-2021-30554 exists in the wild. - CVE-2021-30555 (arbitrary code execution) A use after free security issue has been found in the Sharing component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30556 (arbitrary code execution) A use after free security issue has been found in the WebAudio component of the Chromium browser engine before version 91.0.4472.114. - CVE-2021-30557 (arbitrary code execution) A use after free security issue has been found in the TabGroups component of the Chromium browser engine before version 91.0.4472.114. Impact ====== A remote attacker could execute arbitrary code through a crafted web page. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1219857 https://crbug.com/1215029 https://crbug.com/1212599 https://crbug.com/1202102 https://security.archlinux.org/CVE-2021-30554 https://security.archlinux.org/CVE-2021-30555 https://security.archlinux.org/CVE-2021-30556 https://security.archlinux.org/CVE-2021-30557

1 0

[ASA-202106-45] opera: multiple issues
by Jonas Witschel 24 Jun '21

24 Jun '21

Arch Linux Security Advisory ASA-202106-45 ========================================== Severity: Critical Date : 2021-06-22 CVE-ID : CVE-2021-30544 CVE-2021-30545 CVE-2021-30546 CVE-2021-30547 CVE-2021-30548 CVE-2021-30549 CVE-2021-30550 CVE-2021-30551 CVE-2021-30552 CVE-2021-30553 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2059 Summary ======= The package opera before version 77.0.4054.90-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 77.0.4054.90-1. # pacman -Syu "opera>=77.0.4054.90-1" The problems have been fixed upstream in version 77.0.4054.90. Workaround ========== None. Description =========== - CVE-2021-30544 (arbitrary code execution) A use after free security issue has been found in the BFCache component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30545 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30546 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30547 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30548 (arbitrary code execution) A use after free security issue has been found in the Loader component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30549 (arbitrary code execution) A use after free security issue has been found in the Spell check component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30550 (arbitrary code execution) A use after free security issue has been found in the Accessibility component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30551 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.101. Google is aware that an exploit for CVE-2021-30551 exists in the wild. - CVE-2021-30552 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30553 (arbitrary code execution) A use after free security issue has been found in the Network service component of the Chromium browser before version 91.0.4472.101. Impact ====== A remote attacker could execute arbitrary code through a crafted web page or extension. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://blogs.opera.com/desktop/changelog-for-77/ https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1212618 https://crbug.com/1201031 https://crbug.com/1206911 https://crbug.com/1210414 https://crbug.com/1210487 https://crbug.com/1212498 https://crbug.com/1212500 https://crbug.com/1216437 https://crbug.com/1200679 https://crbug.com/1209769 https://security.archlinux.org/CVE-2021-30544 https://security.archlinux.org/CVE-2021-30545 https://security.archlinux.org/CVE-2021-30546 https://security.archlinux.org/CVE-2021-30547 https://security.archlinux.org/CVE-2021-30548 https://security.archlinux.org/CVE-2021-30549 https://security.archlinux.org/CVE-2021-30550 https://security.archlinux.org/CVE-2021-30551 https://security.archlinux.org/CVE-2021-30552 https://security.archlinux.org/CVE-2021-30553

1 0

[ASA-202106-44] connman: arbitrary code execution
by Jonas Witschel 18 Jun '21

18 Jun '21

Arch Linux Security Advisory ASA-202106-44 ========================================== Severity: High Date : 2021-06-16 CVE-ID : CVE-2021-33833 Package : connman Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2055 Summary ======= The package connman before version 1.40-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.40-1. # pacman -Syu "connman>=1.40-1" The problem has been fixed upstream in version 1.40. Workaround ========== None. Description =========== A security issue has been found in the dnsproxy component of connman in releases 1.32 to 1.39. Unpacking of NAME and RDATA/RDLENGTH fields with TYPE A/AAAA in the uncompress function uses a memcpy with insufficient bounds checking, which can overflow a stack buffer. Impact ====== A remote attacker might be able to execute arbitrary code on the victim's host. References ========== https://www.openwall.com/lists/oss-security/2021/06/09/1 https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=eceb2… https://security.archlinux.org/CVE-2021-33833

1 0

[ASA-202106-43] grub: multiple issues
by Jonas Witschel 18 Jun '21

18 Jun '21

Arch Linux Security Advisory ASA-202106-43 ========================================== Severity: Medium Date : 2021-06-15 CVE-ID : CVE-2020-14372 CVE-2020-25632 CVE-2020-25647 CVE-2020-27749 CVE-2020-27779 CVE-2021-20225 CVE-2021-20233 Package : grub Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1629 Summary ======= The package grub before version 2:2.06-1 is vulnerable to multiple issues including access restriction bypass and arbitrary code execution. Resolution ========== Upgrade to 2:2.06-1. # pacman -Syu "grub>=2:2.06-1" The problems have been fixed upstream in version 2.06. Workaround ========== None. Description =========== - CVE-2020-14372 (arbitrary code execution) GRUB2 enables the use of the command acpi even when secure boot is signaled by the firmware. An attacker with local root privileges can drop a small SSDT in /boot/efi and modify grub.cfg to instruct grub to load said SSDT. The SSDT then gets run by the kernel and it overwrites the kernel lockdown configuration enabling the attacker to load unsigned kernel modules and kexec unsigned code. - CVE-2020-25632 (arbitrary code execution) The rmmod implementation for grub2 is flawed, allowing an attacker to unload a module used as a dependency without checking if any other dependent module is still loaded. This leads to a use-after-free scenario possibly allowing an attacker to execute arbitrary code and by-pass Secure Boot protections. - CVE-2020-25647 (arbitrary code execution) grub_usb_device_initialize() is called to handle USB device initialization. It reads out the descriptors it needs from the USB device and uses that data to fill in some USB data structures. grub_usb_device_initialize() performs very little bounds checking and simply assumes the USB device provides sane values. This behavior can trigger memory corruption. If properly exploited, this would lead to arbitrary code execution allowing the attacker to bypass the Secure Boot mechanism. - CVE-2020-27749 (arbitrary code execution) grub_parser_split_cmdline() expands variable names present in the supplied command line in to their corresponding variable contents and uses a 1kB stack buffer for temporary storage without sufficient bounds checking. If the function is called with a command line that references a variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack frame and control execution. An attacker may use this to circumvent Secure Boot protections. - CVE-2020-27779 (access restriction bypass) The GRUB2's cutmem command does not honor Secure Boot locking. This allows an privileged attacker to remove address ranges from memory creating an opportunity to circumvent Secure Boot protections after proper triage of grub's memory layout. - CVE-2021-20225 (arbitrary code execution) The option parser in GRUB2 allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. - CVE-2021-20233 (arbitrary code execution) There's a flaw in GRUB2 menu rendering code setparam_prefix() in the menu rendering code. It performs a length calculation under the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters. This allow an attacker to corrupt memory by one byte for each quote in the input. Impact ====== When secure boot is enabled, complete subversion of the integrity prospects can be achieved through malicious use of existing commands, side-loaded modules, command acpi, rmmod, variable referencing and option parsers. References ========== https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=3e8e4c0549240fa2… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=7630ec5397fe4182… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=128c16a682034263… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=4ea7bae51f97e49c… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=d298b41f90cbf1f2… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=2a330dba93ff11bc… https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=2f533a89a8dfcacb… https://security.archlinux.org/CVE-2020-14372 https://security.archlinux.org/CVE-2020-25632 https://security.archlinux.org/CVE-2020-25647 https://security.archlinux.org/CVE-2020-27749 https://security.archlinux.org/CVE-2020-27779 https://security.archlinux.org/CVE-2021-20225 https://security.archlinux.org/CVE-2021-20233

1 0