- Arch-security - lists.archlinux.org

[ASA-202204-5] bind: multiple issues
by Levente Polyak 06 Apr '22

06 Apr '22

Arch Linux Security Advisory ASA-202204-5 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-25220 CVE-2022-0396 CVE-2022-0635 CVE-2022-0667 Package : bind Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2661 Summary ======= The package bind before version 9.18.1-1 is vulnerable to multiple issues including denial of service and content spoofing. Resolution ========== Upgrade to 9.18.1-1. # pacman -Syu "bind>=9.18.1-1" The problems have been fixed upstream in version 9.18.1. Workaround ========== - CVE-2021-25220 If applicable, modify your configuration to either remove all forwarding or all possibility of recursion. Depending on your use-case, it may be possible to use other zone types to replace forward zones. - CVE-2022-0396 use the default setting of keep-response-order { none; }. - CVE-2022-0635 The failure can be avoided by adding this option to named.conf: synth-from-dnssec no; However we do not recommend disabling this feature other than as a temporary workaround because it provides protection from pseudo-random- subdomain attacks against DNSSEC-signed zones. Description =========== - CVE-2021-25220 (content spoofing) When using forwarders in BIND, bogus NS records supplied by, or via, those forwarders may be cached and used by named if it needs to recurse for any reason, causing it to obtain and pass on potentially incorrect answers. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients. Authoritative-only BIND 9 servers are not vulnerable to this flaw. - CVE-2022-0396 (denial of service) ISC recently discovered an issue in BIND that allows TCP connection slots to be consumed for an indefinite time frame via a specifically crafted TCP stream sent from a client. This issue is present in BIND 9.16.11 to 9.16.26 (including S editions), and 9.18.0. This issue can only be triggered on BIND servers which have keep- response-order enabled, which is not the default configuration. The keep-response-order option is an ACL block; any hosts which are specified within it will be able to trigger this issue on affected versions. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection. - CVE-2022-0635 (denial of service) BIND 9.18.0 stable release refactored the RFC 8198 Aggressive Use of DNSSEC-Validated Cache feature (synth-from-dnssec) and changed the default so that is now automatically enabled for dnssec-validating resolvers. Subsequently it was found that repeated patterns of specific queries to servers with this feature enabled could cause an INSIST failure in query.c:query_dname which causes named to terminate unexpectedly. The vulnerability affects BIND resolvers running 9.18.0 that have both dnssec-validation and synth-from-dnssec enabled. (Note that dnssec- validation auto; is the default setting unless configured otherwise in named.conf and that enabling dnssec-validation automatically enables synth-from-dnssec unless explicitly disabled) When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check. - CVE-2022-0667 (denial of service) In BIND 9.18.0 the recursive client code was refactored that introduced a "backstop lifetime timer". While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate. Impact ====== A remote attacker is able to crash the application or force TCP connections to BIND to remain in CLOSE_WAIT status leading to denial of service on the affected host. Furthermore the cache could become poisoned leading to queries being made to the wrong servers, which might also result in false information being returned to clients. References ========== https://kb.isc.org/docs/cve-2021-25220 https://gitlab.isc.org/isc-projects/bind9/-/commit/fc9cb6cf91c1a36b797ffef0… https://kb.isc.org/docs/cve-2022-0396 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5987 https://gitlab.isc.org/isc-projects/bind9/-/commit/ae7fa0a3082d1b97b1123a96… https://kb.isc.org/docs/cve-2022-0635 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5988 https://gitlab.isc.org/isc-projects/bind9/-/commit/71dd44339f4cf616e514cefa… https://kb.isc.org/docs/cve-2022-0667 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5989 https://gitlab.isc.org/isc-projects/bind9/-/commit/7ba3a069355875409fadd0da… https://security.archlinux.org/CVE-2021-25220 https://security.archlinux.org/CVE-2022-0396 https://security.archlinux.org/CVE-2022-0635 https://security.archlinux.org/CVE-2022-0667

1 0

[ASA-202204-4] rizin: multiple issues
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-4 ========================================= Severity: Medium Date : 2022-04-04 CVE-ID : CVE-2021-4022 CVE-2021-43814 Package : rizin Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2590 Summary ======= The package rizin before version 0.3.2-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.3.2-1. # pacman -Syu "rizin>=0.3.2-1" The problems have been fixed upstream in version 0.3.2. Workaround ========== None. Description =========== - CVE-2021-4022 (denial of service) A specially crafted binary can make Rizin segfault when it tries to analyze it (doing a full analysis with aaa). In rz_core_analysis_type_match retctx structure was initialized on the stack only after a "goto out_function", where a field of that structure was freed. When the goto path is taken, the field is not properly initialized and it could cause a crash of Rizin or have other effects. - CVE-2021-43814 (arbitrary code execution) In Rizin versions up to and including 0.3.1 there is a heap-based out of bounds write in parse_die() when reversing an AMD64 ELF binary with DWARF debug info. When a malicious AMD64 ELF binary is opened by a victim user, Rizin may crash or execute unintended actions. Impact ====== An attacker is able to provide a malicious AMD64 ELF binary that when opened by a victim may execute arbitrary code on the affected host. References ========== https://github.com/rizinorg/rizin/issues/2015 https://github.com/rizinorg/rizin/pull/2031 https://github.com/rizinorg/rizin/commit/21584e416cdcef2fa7d855c5aabf592a96… https://github.com/rizinorg/rizin/commit/6ce71d8aa3dafe3cdb52d5d72ae8f4b959… https://github.com/rizinorg/rizin/security/advisories/GHSA-hqqp-vjcm-mw8r https://github.com/rizinorg/rizin/issues/2083 https://github.com/rizinorg/rizin/pull/2086 https://github.com/rizinorg/rizin/commit/aa6917772d2f32e5a7daab25a46c72df0b… https://github.com/rizinorg/rizin/commit/1a63dad027df62c5d65cad480d9ddc6134… https://security.archlinux.org/CVE-2021-4022 https://security.archlinux.org/CVE-2021-43814

1 0

[ASA-202204-3] zlib: arbitrary code execution
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-3 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2018-25032 Package : zlib Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2657 Summary ======= The package zlib before version 1:1.2.12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:1.2.12-1. # pacman -Syu "zlib>=1:1.2.12-1" The problem has been fixed upstream in version 1.2.12. Workaround ========== None. Description =========== An out-of-bounds access flaw was found in zlib before 1.2.12, which allows memory corruption when deflating (ex: when compressing) if the input has many distant matches. For some rare inputs with a large number of distant matches (crafted payloads), the buffer into which the compressed or deflated data is written can overwrite the distance symbol table which it overlays. This issue results in corrupted output due to invalid distances, which leads to out-of-bound access, corrupting the memory and crashing the application or potentially execute arbitrary code. Impact ====== A remote attacker is able to use a specially crafted input to crash an application that is using zlib or potentially execute arbitrary code on the affected host. References ========== https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c… https://github.com/madler/zlib/issues/605 https://www.openwall.com/lists/oss-security/2022/03/24/1 https://www.openwall.com/lists/oss-security/2022/03/26/1 https://security.archlinux.org/CVE-2018-25032

1 0

[ASA-202204-2] polkit: multiple issues
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-2 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-4034 CVE-2021-4115 Package : polkit Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2654 Summary ======= The package polkit before version 0.120-5 is vulnerable to multiple issues including privilege escalation and denial of service. Resolution ========== Upgrade to 0.120-5. # pacman -Syu "polkit>=0.120-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2021-4034 (privilege escalation) A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine. - CVE-2021-4115 (denial of service) There is a file descriptor leak in polkit, which can enable an unprivileged user to cause polkit to crash, due to file descriptor exhaustion. Impact ====== A local attacker is able to crash the process or elevate privileges on the affected host. References ========== https://access.redhat.com/security/cve/CVE-2021-4034 https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt https://gitlab.freedesktop.org/polkit/polkit/-/commit/a2bf5c9c83b6ae46cbd5c… https://www.openwall.com/lists/oss-security/2022/02/18/5 https://gitlab.freedesktop.org/polkit/polkit/-/issues/141 https://gitlab.freedesktop.org/polkit/polkit/-/commit/41cb093f554da87723626… https://security.archlinux.org/CVE-2021-4034 https://security.archlinux.org/CVE-2021-4115

1 0

[ASA-202204-1] postgresql: man-in-the-middle
by Levente Polyak 05 Apr '22

05 Apr '22

Arch Linux Security Advisory ASA-202204-1 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-23214 Package : postgresql Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-2546 Summary ======= The package postgresql before version 13.5-1 is vulnerable to man-in- the-middle. Resolution ========== Upgrade to 13.5-1. # pacman -Syu "postgresql>=13.5-1" The problem has been fixed upstream in version 13.5. Workaround ========== None. Description =========== A security issue has been found in PostgreSQL versions 9.6 up to 14. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the- middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. Impact ====== A man-in-the-middle attacker is able to inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. References ========== https://www.postgresql.org/support/security/CVE-2021-23214/ https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=28e24125… https://security.archlinux.org/CVE-2021-23214

1 0

[ASA-202112-12] grafana-agent: information disclosure
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-12 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-41090 Package : grafana-agent Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2614 Summary ======= The package grafana-agent before version 0.21.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 0.21.2-1. # pacman -Syu "grafana-agent>=0.21.2-1" The problem has been fixed upstream in version 0.21.2. Workaround ========== None. Description =========== A security issue has been found in Grafana Agent before version 0.21.2. Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server: - Inline secrets for metrics instance configs in the base YAML file are exposed at /-/config - Inline secrets for integrations are exposed at /-/config - Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at /-/config. - Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at /-/config. - Inline secrets for metrics instance configs loaded from the scraping service are exposed at /agent/api/v1/configs/{name}. Inline secrets will be exposed to anyone being able to reach these endpoints. Secrets found in these sections are used for: - Delivering metrics to a Prometheus Remote Write system - Authenticating against a system for discovering Prometheus targets - Authenticating against a system for collecting metrics (scrape_configs and integrations) - Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode - Authenticating against Kafka for receiving traces Non-inlined secrets, such as *_file-based secrets, are not impacted by this vulnerability. Impact ====== A remote attacker could disclose inline secrets over the Grafana Agent HTTP server. References ========== https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh https://security.archlinux.org/CVE-2021-41090

1 0

[ASA-202112-11] grafana: directory traversal
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-11 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-43798 CVE-2021-43813 CVE-2021-43815 Package : grafana Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2609 Summary ======= The package grafana before version 8.3.1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 8.3.1-1. # pacman -Syu "grafana>=8.3.1-1" The problems have been fixed upstream in version 8.3.1. Workaround ========== None. Description =========== - CVE-2021-43798 (directory traversal) Grafana 8 before version 8.3.1 is vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is <grafana_host_url>/public/plugins/<"plugin-id">, where <"plugin-id"> is the plugin ID for any installed plugin. - CVE-2021-43813 (directory traversal) A security issue has been found in Grafana before version 8.3.2 through which authenticated users could read out fully lowercase or fully uppercase .md files through directory traversal. The vulnerable URL path is: /api/plugins/.*/markdown/.* for .md files. - CVE-2021-43815 (directory traversal) A security issue has been found in Grafana 8 before version 8.3.2 through which authenticated users could read out arbitrary .csv files through directory traversal. The vulnerable URL path is: /api/ds/query. Impact ====== A remote attacker could access arbitrary local files on the server through directory traversal. References ========== https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-rel… https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafan… https://j0vsec.com/post/cve-2021-43798/ https://github.com/grafana/grafana/commit/00e38ba555cfb120361c9623de3285d70… https://github.com/grafana/grafana/security/advisories/GHSA-c3q8-26ph-9g2q https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-… https://github.com/grafana/grafana/commit/06706efbbe59ad9d3075835cc31e2f734… https://github.com/grafana/grafana/security/advisories/GHSA-7533-c8qv-jm9m https://github.com/grafana/grafana/commit/1d7105c0959df2083814237024f7ec098… https://security.archlinux.org/CVE-2021-43798 https://security.archlinux.org/CVE-2021-43813 https://security.archlinux.org/CVE-2021-43815

1 0

[ASA-202112-10] gitlab: multiple issues
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-10 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-39910 CVE-2021-39915 CVE-2021-39917 CVE-2021-39919 CVE-2021-39931 CVE-2021-39932 CVE-2021-39933 CVE-2021-39934 CVE-2021-39935 CVE-2021-39936 CVE-2021-39937 CVE-2021-39938 CVE-2021-39940 CVE-2021-39941 CVE-2021-39944 CVE-2021-39945 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2603 Summary ======= The package gitlab before version 14.5.2-1 is vulnerable to multiple issues including privilege escalation, access restriction bypass, denial of service, information disclosure and content spoofing. Resolution ========== Upgrade to 14.5.2-1. # pacman -Syu "gitlab>=14.5.2-1" The problems have been fixed upstream in version 14.5.2. Workaround ========== None. Description =========== - CVE-2021-39910 (content spoofing) An issue has been discovered in GitLab before version 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature. - CVE-2021-39915 (information disclosure) Improper access control in the GraphQL API in GitLab before version 14.5.2 allows an attacker to see the names of project access tokens on arbitrary projects. - CVE-2021-39917 (denial of service) An issue has been discovered in GitLab before version 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a denial of service attack. - CVE-2021-39919 (information disclosure) In all versions of GitLab before version 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure. - CVE-2021-39931 (access restriction bypass) An issue has been discovered in GitLab before version 14.5.2. Under specific condition an unauthorised project member was allowed to delete a protected branches due to a business logic error. - CVE-2021-39932 (denial of service) An issue has been discovered in GitLab before version 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes. - CVE-2021-39933 (denial of service) An issue has been discovered in GitLab before version 14.5.2. A regular expression used for handling user input (notes, comments, etc) was susceptible to catastrophic backtracking that could cause a denial of service attack. - CVE-2021-39934 (information disclosure) Improper access control allows any project member to retrieve the service desk email address in GitLab before version 14.5.2. - CVE-2021-39935 (access restriction bypass) An issue has been discovered in GitLab before version 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API. - CVE-2021-39936 (access restriction bypass) Improper access control in GitLab before version 14.5.2 allows an attacker in possession of a deploy token to access a project's disabled wiki. - CVE-2021-39937 (privilege escalation) A collision in access memoization logic in all versions of GitLab before version 14.5.2 leads to potential elevated privileges in groups and projects under rare circumstances. - CVE-2021-39938 (denial of service) A vulnerable regular expression pattern in GitLab before version 14.5.2 allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands. - CVE-2021-39940 (denial of service) An issue has been discovered in GitLab before version 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent. - CVE-2021-39941 (information disclosure) An information disclosure vulnerability in GitLab before version 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members. - CVE-2021-39944 (privilege escalation) An issue has been discovered in GitLab before version 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import. - CVE-2021-39945 (access restriction bypass) Improper access control in the GitLab API affecting all versions before version 14.5.2 allows an author of a Merge Request to approve the Merge Request even after having their project access revoked. Impact ====== A remote attacker could elevate their privileges, bypass access restrictions, disclose sensitive information, spoof content or cause high resource consumption leading to denial of service. References ========== https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2… https://security.archlinux.org/CVE-2021-39910 https://security.archlinux.org/CVE-2021-39915 https://security.archlinux.org/CVE-2021-39917 https://security.archlinux.org/CVE-2021-39919 https://security.archlinux.org/CVE-2021-39931 https://security.archlinux.org/CVE-2021-39932 https://security.archlinux.org/CVE-2021-39933 https://security.archlinux.org/CVE-2021-39934 https://security.archlinux.org/CVE-2021-39935 https://security.archlinux.org/CVE-2021-39936 https://security.archlinux.org/CVE-2021-39937 https://security.archlinux.org/CVE-2021-39938 https://security.archlinux.org/CVE-2021-39940 https://security.archlinux.org/CVE-2021-39941 https://security.archlinux.org/CVE-2021-39944 https://security.archlinux.org/CVE-2021-39945

1 0

[ASA-202112-9] thunderbird: multiple issues
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-9 ========================================= Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-43528 CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2608 Summary ======= The package thunderbird before version 91.4.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, information disclosure, incorrect calculation, sandbox escape and denial of service. Resolution ========== Upgrade to 91.4.0-1. # pacman -Syu "thunderbird>=91.4.0-1" The problems have been fixed upstream in version 91.4.0. Workaround ========== None. Description =========== - CVE-2021-43528 (arbitrary code execution) Thunderbird before version 91.4.0 unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. - CVE-2021-43536 (information disclosure) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. - CVE-2021-43537 (arbitrary code execution) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. - CVE-2021-43538 (content spoofing) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. By misusing a race in the notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. - CVE-2021-43539 (arbitrary code execution) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Failure to correctly record the location of live pointers across wasm instance calls resulted in a garbage collection occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. - CVE-2021-43541 (incorrect calculation) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. - CVE-2021-43542 (information disclosure) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. - CVE-2021-43543 (sandbox escape) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. - CVE-2021-43545 (denial of service) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Using the Location API in a loop could have caused severe application hangs and crashes. - CVE-2021-43546 (content spoofing) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, spoof content or crash the application through crafted web content. In general, these flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. References ========== https://www.mozilla.org/security/advisories/mfsa2021-54/ https://bugzilla.mozilla.org/show_bug.cgi?id=1742579 https://www.mozilla.org/security/advisories/mfsa2021-52/ https://bugzilla.mozilla.org/show_bug.cgi?id=1730120 https://bugzilla.mozilla.org/show_bug.cgi?id=1738237 https://bugzilla.mozilla.org/show_bug.cgi?id=1739091 https://bugzilla.mozilla.org/show_bug.cgi?id=1739683 https://bugzilla.mozilla.org/show_bug.cgi?id=1696685 https://bugzilla.mozilla.org/show_bug.cgi?id=1723281 https://bugzilla.mozilla.org/show_bug.cgi?id=1738418 https://bugzilla.mozilla.org/show_bug.cgi?id=1720926 https://bugzilla.mozilla.org/show_bug.cgi?id=1737751 https://security.archlinux.org/CVE-2021-43528 https://security.archlinux.org/CVE-2021-43536 https://security.archlinux.org/CVE-2021-43537 https://security.archlinux.org/CVE-2021-43538 https://security.archlinux.org/CVE-2021-43539 https://security.archlinux.org/CVE-2021-43541 https://security.archlinux.org/CVE-2021-43542 https://security.archlinux.org/CVE-2021-43543 https://security.archlinux.org/CVE-2021-43545 https://security.archlinux.org/CVE-2021-43546

1 0

[ASA-202112-8] firefox: multiple issues
by Jonas Witschel 12 Dec '21

12 Dec '21

Arch Linux Security Advisory ASA-202112-8 ========================================= Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43540 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2606 Summary ======= The package firefox before version 95.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, information disclosure, access restriction bypass, incorrect calculation, sandbox escape and denial of service. Resolution ========== Upgrade to 95.0-1. # pacman -Syu "firefox>=95.0-1" The problems have been fixed upstream in version 95.0. Workaround ========== None. Description =========== - CVE-2021-43536 (information disclosure) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. - CVE-2021-43537 (arbitrary code execution) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. - CVE-2021-43538 (content spoofing) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. By misusing a race in the notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. - CVE-2021-43539 (arbitrary code execution) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Failure to correctly record the location of live pointers across wasm instance calls resulted in a garbage collection occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. - CVE-2021-43540 (access restriction bypass) A security issue has been found in Firefox before version 95. WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. - CVE-2021-43541 (incorrect calculation) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. - CVE-2021-43542 (information disclosure) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. - CVE-2021-43543 (sandbox escape) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. - CVE-2021-43545 (denial of service) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. Using the Location API in a loop could have caused severe application hangs and crashes. - CVE-2021-43546 (content spoofing) A security issue has been found in Firefox before version 95 and Thunderbird before version 91.4.0. It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, spoof content or crash the application through crafted web content. References ========== https://www.mozilla.org/security/advisories/mfsa2021-52/ https://www.mozilla.org/security/advisories/mfsa2021-54/ https://bugzilla.mozilla.org/show_bug.cgi?id=1730120 https://bugzilla.mozilla.org/show_bug.cgi?id=1738237 https://bugzilla.mozilla.org/show_bug.cgi?id=1739091 https://bugzilla.mozilla.org/show_bug.cgi?id=1739683 https://bugzilla.mozilla.org/show_bug.cgi?id=1636629 https://bugzilla.mozilla.org/show_bug.cgi?id=1696685 https://bugzilla.mozilla.org/show_bug.cgi?id=1723281 https://bugzilla.mozilla.org/show_bug.cgi?id=1738418 https://bugzilla.mozilla.org/show_bug.cgi?id=1720926 https://bugzilla.mozilla.org/show_bug.cgi?id=1737751 https://security.archlinux.org/CVE-2021-43536 https://security.archlinux.org/CVE-2021-43537 https://security.archlinux.org/CVE-2021-43538 https://security.archlinux.org/CVE-2021-43539 https://security.archlinux.org/CVE-2021-43540 https://security.archlinux.org/CVE-2021-43541 https://security.archlinux.org/CVE-2021-43542 https://security.archlinux.org/CVE-2021-43543 https://security.archlinux.org/CVE-2021-43545 https://security.archlinux.org/CVE-2021-43546

1 0