- Arch-security - lists.archlinux.org

[ASA-202106-32] vivaldi: multiple issues
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-32 ========================================== Severity: Critical Date : 2021-06-15 CVE-ID : CVE-2021-30544 CVE-2021-30545 CVE-2021-30546 CVE-2021-30547 CVE-2021-30548 CVE-2021-30549 CVE-2021-30550 CVE-2021-30551 CVE-2021-30552 CVE-2021-30553 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2058 Summary ======= The package vivaldi before version 4.0.2312.25-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 4.0.2312.25-1. # pacman -Syu "vivaldi>=4.0.2312.25-1" The problems have been fixed upstream in version 4.0.2312.25. Workaround ========== None. Description =========== - CVE-2021-30544 (arbitrary code execution) A use after free security issue has been found in the BFCache component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30545 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30546 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30547 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30548 (arbitrary code execution) A use after free security issue has been found in the Loader component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30549 (arbitrary code execution) A use after free security issue has been found in the Spell check component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30550 (arbitrary code execution) A use after free security issue has been found in the Accessibility component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30551 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.101. Google is aware that an exploit for CVE-2021-30551 exists in the wild. - CVE-2021-30552 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30553 (arbitrary code execution) A use after free security issue has been found in the Network service component of the Chromium browser before version 91.0.4472.101. Impact ====== A remote attacker could execute arbitrary code through a crafted web page or extension. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://vivaldi.com/blog/desktop/minor-update-for-vivaldi-desktop-browser-4… https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1212618 https://crbug.com/1201031 https://crbug.com/1206911 https://crbug.com/1210414 https://crbug.com/1210487 https://crbug.com/1212498 https://crbug.com/1212500 https://crbug.com/1216437 https://crbug.com/1200679 https://crbug.com/1209769 https://security.archlinux.org/CVE-2021-30544 https://security.archlinux.org/CVE-2021-30545 https://security.archlinux.org/CVE-2021-30546 https://security.archlinux.org/CVE-2021-30547 https://security.archlinux.org/CVE-2021-30548 https://security.archlinux.org/CVE-2021-30549 https://security.archlinux.org/CVE-2021-30550 https://security.archlinux.org/CVE-2021-30551 https://security.archlinux.org/CVE-2021-30552 https://security.archlinux.org/CVE-2021-30553

1 0

[ASA-202106-31] chromium: multiple issues
by Santiago Torres-Arias 17 Jun '21

17 Jun '21

Arch Linux Security Advisory ASA-202106-31 ========================================== Severity: Critical Date : 2021-06-15 CVE-ID : CVE-2021-30544 CVE-2021-30545 CVE-2021-30546 CVE-2021-30547 CVE-2021-30548 CVE-2021-30549 CVE-2021-30550 CVE-2021-30551 CVE-2021-30552 CVE-2021-30553 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2057 Summary ======= The package chromium before version 91.0.4472.101-1 is vulnerable to multiple issues including arbitrary code execution and incorrect calculation. Resolution ========== Upgrade to 91.0.4472.101-1. # pacman -Syu "chromium>=91.0.4472.101-1" The problems have been fixed upstream in version 91.0.4472.101. Workaround ========== None. Description =========== - CVE-2021-30544 (arbitrary code execution) A use after free security issue has been found in the BFCache component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30545 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30546 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30547 (arbitrary code execution) An out of bounds write security issue has been found in the ANGLE component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30548 (arbitrary code execution) A use after free security issue has been found in the Loader component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30549 (arbitrary code execution) A use after free security issue has been found in the Spell check component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30550 (arbitrary code execution) A use after free security issue has been found in the Accessibility component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30551 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.101. Google is aware that an exploit for CVE-2021-30551 exists in the wild. - CVE-2021-30552 (arbitrary code execution) A use after free security issue has been found in the Extensions component of the Chromium browser before version 91.0.4472.101. - CVE-2021-30553 (arbitrary code execution) A use after free security issue has been found in the Network service component of the Chromium browser before version 91.0.4472.101. Impact ====== A remote attacker could execute arbitrary code through a crafted web page or extension. Google is aware that an exploit for one of the security issues exists in the wild. References ========== https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-des… https://crbug.com/1212618 https://crbug.com/1201031 https://crbug.com/1206911 https://crbug.com/1210414 https://crbug.com/1210487 https://crbug.com/1212498 https://crbug.com/1212500 https://crbug.com/1216437 https://crbug.com/1200679 https://crbug.com/1209769 https://security.archlinux.org/CVE-2021-30544 https://security.archlinux.org/CVE-2021-30545 https://security.archlinux.org/CVE-2021-30546 https://security.archlinux.org/CVE-2021-30547 https://security.archlinux.org/CVE-2021-30548 https://security.archlinux.org/CVE-2021-30549 https://security.archlinux.org/CVE-2021-30550 https://security.archlinux.org/CVE-2021-30551 https://security.archlinux.org/CVE-2021-30552 https://security.archlinux.org/CVE-2021-30553

1 0

[ASA-202106-30] wireshark-cli: denial of service
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-30 ========================================== Severity: Low Date : 2021-06-09 CVE-ID : CVE-2021-22222 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2037 Summary ======= The package wireshark-cli before version 3.4.6-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.4.6-1. # pacman -Syu "wireshark-cli>=3.4.6-1" The problem has been fixed upstream in version 3.4.6. Workaround ========== None. Description =========== An infinite loop in the DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows a denial of service via packet injection or a crafted capture file. Impact ====== A remote attacker could crash Wireshark with crafted DVB-S2 packets via packet injection or a crafted capture file. References ========== https://www.wireshark.org/security/wnpa-sec-2021-05 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22222.json https://gitlab.com/wireshark/wireshark/-/merge_requests/3130 https://gitlab.com/wireshark/wireshark/-/commit/0d8be1fb797b3d65f1c2c204da7… https://security.archlinux.org/CVE-2021-22222

1 0

[ASA-202106-29] kube-apiserver: insufficient validation
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-29 ========================================== Severity: Low Date : 2021-06-09 CVE-ID : CVE-2021-25737 Package : kube-apiserver Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1970 Summary ======= The package kube-apiserver before version 1.21.1-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.21.1-1. # pacman -Syu "kube-apiserver>=1.21.1-1" The problem has been fixed upstream in version 1.21.1. Workaround ========== To mitigate this vulnerability without upgrading kube-apiserver, you can create a validating admission webhook that prevents EndpointSlices with endpoint addresses in the 127.0.0.0/8 and 169.254.0.0/16 ranges. If you have an existing admission policy mechanism (like OPA Gatekeeper) you can create a policy that enforces this restriction. Description =========== A security issue was discovered in kube-apiserver before version 1.21.1 where a user may be able to redirect pod traffic to private networks on a node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs. Impact ====== A user could redirect pod traffic to private networks on a node. References ========== https://github.com/kubernetes/kubernetes/issues/102106 https://github.com/kubernetes/kubernetes/pull/101084 https://github.com/kubernetes/kubernetes/commit/233c8d6eeef9e7a259c39dd1db0… https://security.archlinux.org/CVE-2021-25737

1 0

[ASA-202106-28] nettle: denial of service
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-28 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-3580 Package : nettle Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2052 Summary ======= The package nettle before version 3.7.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.7.3-1. # pacman -Syu "nettle>=3.7.3-1" The problem has been fixed upstream in version 3.7.3. Workaround ========== None. Description =========== Multiple issues were found with Nettle's RSA decryption functions before version 3.7.3. These can be triggered by providing manipulated ciphertext and could lead to application crash and denial of service. Since nettle is used with gnuTLS, there is a possibility that a remote client could crash a server compiled with gnuTLS when RSA is used for the initial key exchange. Impact ====== A remote attacker could crash an application using Nettle with a crafted RSA ciphertext. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1967983 https://git.lysator.liu.se/nettle/nettle/-/commit/0ad0b5df315665250dfdaa4a1… https://git.lysator.liu.se/nettle/nettle/-/commit/485b5e2820a057e873b1ba812… https://security.archlinux.org/CVE-2021-3580

1 0

[ASA-202106-27] isync: arbitrary code execution
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-27 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-3578 Package : isync Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2042 Summary ======= The package isync before version 1.4.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.4.2-1. # pacman -Syu "isync>=1.4.2-1" The problem has been fixed upstream in version 1.4.2. Workaround ========== None. Description =========== A security issue was found in mbsync before version 1.4.2, where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client. Impact ====== A remote server could cause arbitrary code execution on the mbsync client using a crafted APPENDUID response. References ========== https://sourceforge.net/p/isync/mailman/message/37297759/ https://sourceforge.net/p/isync/isync/ci/589d2ed4283130108df5495b5510d82228… https://security.archlinux.org/CVE-2021-3578

1 0

[ASA-202106-26] python-websockets: private key recovery
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-26 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33880 Package : python-websockets Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-2040 Summary ======= The package python-websockets before version 9.1-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 9.1-1. # pacman -Syu "python-websockets>=9.1-1" The problem has been fixed upstream in version 9.1. Workaround ========== None. Description =========== The aaugustin websockets library before 9.1 for Python has an observable timing discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack. Impact ====== A remote attacker could guess HTTP Basic Authentication passwords using a timing attack. References ========== https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7… https://security.archlinux.org/CVE-2021-33880

1 0

[ASA-202106-25] python-urllib3: denial of service
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-25 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33503 Package : python-urllib3 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2038 Summary ======= The package python-urllib3 before version 1.26.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.26.5-1. # pacman -Syu "python-urllib3>=1.26.5-1" The problem has been fixed upstream in version 1.26.5. Workaround ========== None. Description =========== A security issue has been found in python-urllib3 before version 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL was passed as a parameter or redirected to via an HTTP redirect. Impact ====== A remote attacker could exhaust CPU resources, leading to denial of service, using a crafted URL. References ========== https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759… https://security.archlinux.org/CVE-2021-33503

1 0

[ASA-202106-24] polkit: privilege escalation
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-24 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-3560 Package : polkit Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2028 Summary ======= The package polkit before version 0.119-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 0.119-1. # pacman -Syu "polkit>=0.119-1" The problem has been fixed upstream in version 0.119. Workaround ========== None. Description =========== A security issue was found in polkit before version 0.119. When a requesting process disconnects from dbus-daemon just before the call to polkit_system_bus_name_get_creds_sync starts, the process cannot get a unique uid and pid of the process and it cannot verify the privileges of the requesting process. Impact ====== A local attacker could escalate privileges by exploiting a race condition. References ========== https://www.openwall.com/lists/oss-security/2021/06/03/1 https://bugzilla.redhat.com/show_bug.cgi?id=1961710 https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-wi… https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13affe0fa53ff618e… https://security.archlinux.org/CVE-2021-3560

1 0

[ASA-202106-23] apache: denial of service
by Jonas Witschel 11 Jun '21

11 Jun '21

Arch Linux Security Advisory ASA-202106-23 ========================================== Severity: High Date : 2021-06-09 CVE-ID : CVE-2021-31618 Package : apache Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2041 Summary ======= The package apache before version 2.4.48-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.48-1. # pacman -Syu "apache>=2.4.48-1" The problem has been fixed upstream in version 2.4.48. Workaround ========== None. Description =========== A security issue has been found in the Apache HTTP Server (httpd) before version 2.4.48. The Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions, an HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a footer. This led to a NULL pointer dereference on initialised memory, reliably crashing the child process. Since such a triggering HTTP/2 request is easy to craft and submit, this can be exploited for denial of service (DoS) of the server. Impact ====== A remote attacker could crash the HTTP server using a crafted HTTP/2 request. References ========== https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-31618 https://svn.apache.org/viewvc?view=revision&revision=1889759 https://security.archlinux.org/CVE-2021-31618

1 0