- Arch-security - lists.archlinux.org

[ASA-202106-2] chromium: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-2 ========================================= Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-30521 CVE-2021-30522 CVE-2021-30523 CVE-2021-30524 CVE-2021-30525 CVE-2021-30526 CVE-2021-30527 CVE-2021-30528 CVE-2021-30529 CVE-2021-30530 CVE-2021-30531 CVE-2021-30532 CVE-2021-30533 CVE-2021-30534 CVE-2021-30535 CVE-2021-30536 CVE-2021-30537 CVE-2021-30538 CVE-2021-30539 CVE-2021-30540 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1990 Summary ======= The package chromium before version 91.0.4472.77-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, insufficient validation and content spoofing. Resolution ========== Upgrade to 91.0.4472.77-1. # pacman -Syu "chromium>=91.0.4472.77-1" The problems have been fixed upstream in version 91.0.4472.77. Workaround ========== None. Description =========== - CVE-2021-30521 (arbitrary code execution) A heap buffer overflow security issue has been found in the Autofill component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30522 (arbitrary code execution) A use after free security issue has been found in the WebAudio component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30523 (arbitrary code execution) A use after free security issue has been found in the WebRTC component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30524 (arbitrary code execution) A use after free security issue has been found in the TabStrip component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30525 (arbitrary code execution) A use after free security issue has been found in the TabGroups component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30526 (arbitrary code execution) An out of bounds write security issue has been found in the TabStrip component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30527 (arbitrary code execution) A use after free security issue has been found in the WebUI component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30528 (arbitrary code execution) A use after free security issue has been found in the WebAuthentication component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30529 (arbitrary code execution) A use after free security issue has been found in the Bookmarks component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30530 (information disclosure) An out of bounds memory access security issue has been found in the WebAudio component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30531 (insufficient validation) An insufficient policy enforcement security issue has been found in the Content Security Policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30532 (insufficient validation) An insufficient policy enforcement security issue has been found in the Content Security Policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30533 (insufficient validation) An insufficient policy enforcement security issue has been found in the PopupBlocker component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30534 (insufficient validation) An insufficient policy enforcement security issue has been found in the iFrameSandbox component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30535 (arbitrary code execution) A double free security issue has been found in the ICU component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30536 (information disclosure) An out of bounds read security issue has been found in the V8 component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30537 (insufficient validation) An insufficient policy enforcement security issue has been found in the cookies component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30538 (insufficient validation) An insufficient policy enforcement security issue has been found in the content security policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30539 (insufficient validation) An insufficient policy enforcement security issue has been found in the content security policy component of the Chromium browser before version 91.0.4472.77. - CVE-2021-30540 (content spoofing) An incorrect security UI security issue has been found in the payments component of the Chromium browser before version 91.0.4472.77. Impact ====== A remote attacker could spoof content, disclose sensitive information, or execute arbitrary code through crafted web pages. References ========== https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-des… https://crbug.com/1208721 https://crbug.com/1176218 https://crbug.com/1187797 https://crbug.com/1197146 https://crbug.com/1197888 https://crbug.com/1198717 https://crbug.com/1199198 https://crbug.com/1206329 https://crbug.com/1195278 https://crbug.com/1201033 https://crbug.com/1115628 https://crbug.com/1117687 https://crbug.com/1145553 https://crbug.com/1151507 https://crbug.com/1194899 https://crbug.com/1194358 https://crbug.com/830101 https://crbug.com/1115045 https://crbug.com/971231 https://crbug.com/1184147 https://security.archlinux.org/CVE-2021-30521 https://security.archlinux.org/CVE-2021-30522 https://security.archlinux.org/CVE-2021-30523 https://security.archlinux.org/CVE-2021-30524 https://security.archlinux.org/CVE-2021-30525 https://security.archlinux.org/CVE-2021-30526 https://security.archlinux.org/CVE-2021-30527 https://security.archlinux.org/CVE-2021-30528 https://security.archlinux.org/CVE-2021-30529 https://security.archlinux.org/CVE-2021-30530 https://security.archlinux.org/CVE-2021-30531 https://security.archlinux.org/CVE-2021-30532 https://security.archlinux.org/CVE-2021-30533 https://security.archlinux.org/CVE-2021-30534 https://security.archlinux.org/CVE-2021-30535 https://security.archlinux.org/CVE-2021-30536 https://security.archlinux.org/CVE-2021-30537 https://security.archlinux.org/CVE-2021-30538 https://security.archlinux.org/CVE-2021-30539 https://security.archlinux.org/CVE-2021-30540

1 0

[ASA-202106-1] opera: multiple issues
by Jonas Witschel 03 Jun '21

03 Jun '21

Arch Linux Security Advisory ASA-202106-1 ========================================= Severity: High Date : 2021-06-01 CVE-ID : CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513 CVE-2021-30514 CVE-2021-30515 CVE-2021-30516 CVE-2021-30517 CVE-2021-30518 CVE-2021-30519 CVE-2021-30520 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1938 Summary ======= The package opera before version 76.0.4017.154-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, incorrect calculation and information disclosure. Resolution ========== Upgrade to 76.0.4017.154-1. # pacman -Syu "opera>=76.0.4017.154-1" The problems have been fixed upstream in version 76.0.4017.154. Workaround ========== None. Description =========== - CVE-2021-30506 (content spoofing) An incorrect security UI security issue has been found in the Web App Installs component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30507 (incorrect calculation) An inappropriate implementation security issue has been found in the Offline component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30508 (arbitrary code execution) A heap buffer overflow security issue has been found in the Media Feeds component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30509 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Strip component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30510 (arbitrary code execution) A race condition security issue has been found in the Aura component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30511 (information disclosure) An out of bounds read security issue has been found in the Tab Groups component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30512 (arbitrary code execution) A use after free security issue has been found in the Notifications component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30513 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30514 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30515 (arbitrary code execution) A use after free security issue has been found in the File API component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30516 (arbitrary code execution) A heap buffer overflow security issue has been found in the History component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30517 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30518 (arbitrary code execution) A heap buffer overflow security issue has been found in the Reader Mode component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30519 (arbitrary code execution) A use after free security issue has been found in the Payments component of the Chromium browser before version 90.0.4430.212. - CVE-2021-30520 (arbitrary code execution) A use after free security issue has been found in the Tab Strip component of the Chromium browser before version 90.0.4430.212. Impact ====== A remote attacker could spoof content, disclose sensitive information, or execute arbitrary code through crafted web pages. References ========== https://blogs.opera.com/desktop/changelog-for-76/ https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-des… https://crbug.com/1180126 https://crbug.com/1178202 https://crbug.com/1195340 https://crbug.com/1196309 https://crbug.com/1197436 https://crbug.com/1197875 https://crbug.com/1200019 https://crbug.com/1200490 https://crbug.com/1200766 https://crbug.com/1201073 https://crbug.com/1201446 https://crbug.com/1203122 https://crbug.com/1203590 https://crbug.com/1194058 https://crbug.com/1193362 https://security.archlinux.org/CVE-2021-30506 https://security.archlinux.org/CVE-2021-30507 https://security.archlinux.org/CVE-2021-30508 https://security.archlinux.org/CVE-2021-30509 https://security.archlinux.org/CVE-2021-30510 https://security.archlinux.org/CVE-2021-30511 https://security.archlinux.org/CVE-2021-30512 https://security.archlinux.org/CVE-2021-30513 https://security.archlinux.org/CVE-2021-30514 https://security.archlinux.org/CVE-2021-30515 https://security.archlinux.org/CVE-2021-30516 https://security.archlinux.org/CVE-2021-30517 https://security.archlinux.org/CVE-2021-30518 https://security.archlinux.org/CVE-2021-30519 https://security.archlinux.org/CVE-2021-30520

1 0

[ASA-202105-29] thunderbird: multiple issues
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-29 ========================================== Severity: Low Date : 2021-05-25 CVE-ID : CVE-2021-29956 CVE-2021-29957 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1964 Summary ======= The package thunderbird before version 78.10.2-1 is vulnerable to multiple issues including content spoofing and information disclosure. Resolution ========== Upgrade to 78.10.2-1. # pacman -Syu "thunderbird>=78.10.2-1" The problems have been fixed upstream in version 78.10.2. Workaround ========== None. Description =========== - CVE-2021-29956 (information disclosure) OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local disk. The master password protection was inactive for those keys. Version 78.10.2 will restore the protection mechanism for newly imported keys, and will automatically protect keys that had been imported using affected Thunderbird versions. This vulnerability affects Thunderbird < 78.10.2. - CVE-2021-29957 (content spoofing) If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only parts of the message are protected. This vulnerability affects Thunderbird < 78.10.2. Impact ====== OpenPGP secret keys were store unencrypted on disk, allowing for potential local exfiltration. Additionally, a remote attacker could inject unprotected parts into OpenPGP signed or encrypted messages in order to spoof content. References ========== https://www.mozilla.org/security/advisories/mfsa2021-22/ https://bugzilla.mozilla.org/show_bug.cgi?id=1710290 https://bugzilla.mozilla.org/show_bug.cgi?id=1673241 https://security.archlinux.org/CVE-2021-29956 https://security.archlinux.org/CVE-2021-29957

1 0

[ASA-202105-28] hivex: denial of service
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-28 ========================================== Severity: Low Date : 2021-05-25 CVE-ID : CVE-2021-3504 Package : hivex Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1907 Summary ======= The package hivex before version 1.3.20-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.3.20-1. # pacman -Syu "hivex>=1.3.20-1" The problem has been fixed upstream in version 1.3.20. Workaround ========== None. Description =========== A security issue was found in the hivex library before version 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to crash. Impact ====== A crafted Windows Registry (hive) file could lead to an application crash. References ========== https://bugzilla.redhat.com/show_bug.cgi?id=1949687 https://github.com/libguestfs/hivex/commit/8f1935733b10d974a1a4176d38dd151e… https://security.archlinux.org/CVE-2021-3504

1 0

[ASA-202105-27] lz4: denial of service
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-27 ========================================== Severity: Low Date : 2021-05-25 CVE-ID : CVE-2021-3520 Package : lz4 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1889 Summary ======= The package lz4 before version 1:1.9.3-2 is vulnerable to denial of service. Resolution ========== Upgrade to 1:1.9.3-2. # pacman -Syu "lz4>=1:1.9.3-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A vulnerability was found in lz4, where a potential memory corruption due to an integer overflow bug caused one of the memmove arguments to become negative. Depending on how the library was compiled this will hit an assert() inside the library and dump core, leaving a 4GB core file, or it wil go into libc and crash inside the memmove() function. Impact ====== A crafted lz4 file can lead to an application crash, potentially creating a large core dump file. References ========== https://bugs.archlinux.org/task/70970 https://bugzilla.redhat.com/show_bug.cgi?id=1954559 https://github.com/lz4/lz4/pull/972 https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7 https://security.archlinux.org/CVE-2021-3520

1 0

[ASA-202105-26] gupnp: information disclosure
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-26 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-33516 Package : gupnp Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1985 Summary ======= The package gupnp before version 1.2.6-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.2.6-1. # pacman -Syu "gupnp>=1.2.6-1" The problem has been fixed upstream in version 1.2.6. Workaround ========== None. Description =========== An issue was discovered in GUPnP before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tampering, etc. Impact ====== A remote attacker can use DNS rebinding to trick a victim's browser into triggering actions against local UPnP services. References ========== https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cv… https://gitlab.gnome.org/GNOME/gupnp/-/issues/24 https://gitlab.gnome.org/GNOME/gupnp/-/merge_requests/13 https://gitlab.gnome.org/GNOME/gupnp/-/commit/ca6ec9dcb26fd7a2a630eb6a68118… https://security.archlinux.org/CVE-2021-33516

1 0

[ASA-202105-25] prometheus: open redirect
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-25 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-29622 Package : prometheus Type : open redirect Remote : Yes Link : https://security.archlinux.org/AVG-1971 Summary ======= The package prometheus before version 2.27.1-1 is vulnerable to open redirect. Resolution ========== Upgrade to 2.27.1-1. # pacman -Syu "prometheus>=2.27.1-1" The problem has been fixed upstream in version 2.27.1. Workaround ========== The issue can be mitigated by using the --web.external-url= flag with a path (e.g. --web.external-url=http://example.com/prometheus). Description =========== A security issue has been found in Prometheus before version 2.27.1. In 2.23.0, Prometheus changed its default UI to the New UI. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL in the /new endpoint. If a user visits a Prometheus server with a specially crafted address (e.g. http://127.0.0.1:9090/new/new<url>), they can be redirected to an arbitrary URL. E.g. if a user visits http://127.0.0.1:9090/new/newhttp://www.google.com/, they will be redirected to http://google.com. Note: Users who use a --web.external-url= flag with a path (e.g. --web.external-url=http://example.com/prometheus) are not affected. Impact ====== A remote attacker can use crafted URLs to redirect victims from a Prometheus server instance to an arbitrary address. References ========== https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q… https://github.com/prometheus/prometheus/commit/db7f0bcec27bd8aeebad6b08ac8… https://security.archlinux.org/CVE-2021-29622

1 0

[ASA-202105-24] python-pydantic: denial of service
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-24 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-29510 Package : python-pydantic Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1951 Summary ======= The package python-pydantic before version 1.8.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.8.2-1. # pacman -Syu "python-pydantic>=1.8.2-1" The problem has been fixed upstream in version 1.8.2. Workaround ========== None. Description =========== A security issue has been found in pydantic before version 1.8.2. Passing either 'infinity', 'inf' or float('inf') (or their negatives) to datetime or date fields causes validation to run forever with 100% CPU usage (on one CPU). Impact ====== An attacker could cause high CPU usage using invalid datetime or date fields, leading to denial of service. References ========== https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6… https://github.com/samuelcolvin/pydantic/commit/1c24f1d74ba95ea985b50bdc001… https://security.archlinux.org/CVE-2021-29510

1 0

[ASA-202105-23] dotnet-sdk-3.1: privilege escalation
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-23 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-sdk-3.1 Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1945 Summary ======= The package dotnet-sdk-3.1 before version 3.1.15.sdk115-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 3.1.15.sdk115-1. # pacman -Syu "dotnet-sdk-3.1>=3.1.15.sdk115-1" The problem has been fixed upstream in version 3.1.15.sdk115. Workaround ========== None. Description =========== An elevation of privilege vulnerability exists in .NET 5.0 and .NET Core 3.1 when a user runs a single file application on operating systems based on Linux or macOS. The issue is fixed in .NET 5.0, Runtime 5.0.6 and SDK 5.0.203, as well as .NET Core 3.1, Runtime 3.1.15 and SDK 3.1.115. Impact ====== An attacker could elevate privileges from a crafted single file application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31204 https://github.com/dotnet/announcements/issues/185 https://security.archlinux.org/CVE-2021-31204

1 0

[ASA-202105-22] dotnet-runtime-3.1: privilege escalation
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-22 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-runtime-3.1 Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1945 Summary ======= The package dotnet-runtime-3.1 before version 3.1.15.sdk115-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 3.1.15.sdk115-1. # pacman -Syu "dotnet-runtime-3.1>=3.1.15.sdk115-1" The problem has been fixed upstream in version 3.1.15.sdk115. Workaround ========== None. Description =========== An elevation of privilege vulnerability exists in .NET 5.0 and .NET Core 3.1 when a user runs a single file application on operating systems based on Linux or macOS. The issue is fixed in .NET 5.0, Runtime 5.0.6 and SDK 5.0.203, as well as .NET Core 3.1, Runtime 3.1.15 and SDK 3.1.115. Impact ====== An attacker could elevate privileges from a crafted single file application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31204 https://github.com/dotnet/announcements/issues/185 https://security.archlinux.org/CVE-2021-31204

1 0