- Arch-security - lists.archlinux.org

[ASA-202105-21] dotnet-runtime: privilege escalation
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-21 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-runtime Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1944 Summary ======= The package dotnet-runtime before version 5.0.6.sdk203-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.0.6.sdk203-1. # pacman -Syu "dotnet-runtime>=5.0.6.sdk203-1" The problem has been fixed upstream in version 5.0.6.sdk203. Workaround ========== None. Description =========== An elevation of privilege vulnerability exists in .NET 5.0 and .NET Core 3.1 when a user runs a single file application on operating systems based on Linux or macOS. The issue is fixed in .NET 5.0, Runtime 5.0.6 and SDK 5.0.203, as well as .NET Core 3.1, Runtime 3.1.15 and SDK 3.1.115. Impact ====== An attacker could elevate privileges from a crafted single file application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31204 https://github.com/dotnet/announcements/issues/185 https://security.archlinux.org/CVE-2021-31204

1 0

[ASA-202105-20] dotnet-sdk: privilege escalation
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-20 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-31204 Package : dotnet-sdk Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1944 Summary ======= The package dotnet-sdk before version 5.0.6.sdk203-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.0.6.sdk203-1. # pacman -Syu "dotnet-sdk>=5.0.6.sdk203-1" The problem has been fixed upstream in version 5.0.6.sdk203. Workaround ========== None. Description =========== An elevation of privilege vulnerability exists in .NET 5.0 and .NET Core 3.1 when a user runs a single file application on operating systems based on Linux or macOS. The issue is fixed in .NET 5.0, Runtime 5.0.6 and SDK 5.0.203, as well as .NET Core 3.1, Runtime 3.1.15 and SDK 3.1.115. Impact ====== An attacker could elevate privileges from a crafted single file application. References ========== https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31204 https://github.com/dotnet/announcements/issues/185 https://security.archlinux.org/CVE-2021-31204

1 0

[ASA-202105-19] matrix-synapse: denial of service
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-19 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-29471 Package : matrix-synapse Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1943 Summary ======= The package matrix-synapse before version 1.33.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.33.2-1. # pacman -Syu "matrix-synapse>=1.33.2-1" The problem has been fixed upstream in version 1.33.2. Workaround ========== A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy. Description =========== In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy. Impact ====== A remote attacker could cause high CPU usage on the server using crafted push rules, leading to denial of service. References ========== https://bugs.archlinux.org/task/70801 https://github.com/matrix-org/synapse/security/advisories/GHSA-x345-32rc-8h… https://github.com/matrix-org/synapse/commit/03318a766cac9f8b053db2214d9c33… https://security.archlinux.org/CVE-2021-29471

1 0

[ASA-202105-18] djvulibre: arbitrary code execution
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-18 ========================================== Severity: Medium Date : 2021-05-25 CVE-ID : CVE-2021-3500 CVE-2021-32490 CVE-2021-32491 CVE-2021-32492 CVE-2021-32493 Package : djvulibre Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1899 Summary ======= The package djvulibre before version 3.5.28-3 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.5.28-3. # pacman -Syu "djvulibre>=3.5.28-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2021-3500 (arbitrary code execution) A security issue was found in djvulibre. A stack overflow in the function DJVU::DjVuDocument::get_djvu_file() may lead to an application crash and other consequences via a crafted djvu file. - CVE-2021-32490 (arbitrary code execution) A security issue was found in djvulibre. An out of bounds write in the function DJVU::filter_bv() may lead to an application crash and other consequences via a crafted djvu file. - CVE-2021-32491 (arbitrary code execution) A security issue was found in djvulibre. An integer overflow in the function render() in tools/ddjvu may lead to an application crash and other consequences via a crafted djvu file. - CVE-2021-32492 (arbitrary code execution) A security issue was found in djvulibre. An out of bounds read in the function DJVU::DataPool::has_data() may lead to an application crash and other consequences via a crafted djvu file. - CVE-2021-32493 (arbitrary code execution) A security issue was found in djvulibre. A heap buffer overflow in the function DJVU::GBitmap::decode() may lead to an application crash and other consequences via a crafted djvu file. Impact ====== An attacker could cause a crash, or possible execute arbitrary code, using a crafted djvu file. References ========== https://bugs.archlinux.org/task/70787 https://bugzilla.redhat.com/show_bug.cgi?id=1943685 https://bugzilla.redhat.com/show_bug.cgi?id=1943411 https://src.fedoraproject.org/rpms/djvulibre/blob/rawhide/f/djvulibre-3.5.2… https://bugzilla.redhat.com/show_bug.cgi?id=1943693 https://bugzilla.redhat.com/show_bug.cgi?id=1943408 https://bugzilla.redhat.com/attachment.cgi?id=1770184&action=diff https://src.fedoraproject.org/rpms/djvulibre/blob/rawhide/f/djvulibre-3.5.2… https://bugzilla.redhat.com/show_bug.cgi?id=1943684 https://bugzilla.redhat.com/show_bug.cgi?id=1943409 https://bugzilla.redhat.com/attachment.cgi?id=1770218&action=diff https://src.fedoraproject.org/rpms/djvulibre/blob/4b8d9b4bcb10c24739ca2dcd6… https://bugzilla.redhat.com/show_bug.cgi?id=1943686 https://bugzilla.redhat.com/show_bug.cgi?id=1943410 https://bugzilla.redhat.com/attachment.cgi?id=1770220&action=diff https://src.fedoraproject.org/rpms/djvulibre/blob/rawhide/f/djvulibre-3.5.2… https://bugzilla.redhat.com/show_bug.cgi?id=1943690 https://bugzilla.redhat.com/show_bug.cgi?id=1943424 https://bugzilla.redhat.com/attachment.cgi?id=1774554&action=diff https://src.fedoraproject.org/rpms/djvulibre/blob/rawhide/f/djvulibre-3.5.2… https://security.archlinux.org/CVE-2021-3500 https://security.archlinux.org/CVE-2021-32490 https://security.archlinux.org/CVE-2021-32491 https://security.archlinux.org/CVE-2021-32492 https://security.archlinux.org/CVE-2021-32493

1 0

[ASA-202105-17] runc: sandbox escape
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-17 ========================================== Severity: High Date : 2021-05-25 CVE-ID : CVE-2021-30465 Package : runc Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-1972 Summary ======= The package runc before version 1.0.0rc95-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 1.0.0rc95-1. # pacman -Syu "runc>=1.0.0rc95-1" The problem has been fixed upstream in version 1.0.0rc95. Workaround ========== Container hardening mechanisms such as LSMs (AppArmor/SELinux) and user namespaces can restrict the amount of damage an attacker could do but they do not block this attack outright. Description =========== runc 1.0.0-rc94 and earlier are vulnerable to a symlink exchange attack where an attacker with the ability to start containers using a custom volume configuration can request a seemingly-innocuous container configuration that results in the host filesystem being bind-mounted into the container (allowing for a container escape). Impact ====== An attacker can escape from a container and access arbitrary files on the host system using a crafted container configuration. References ========== https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-g… https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849… https://security.archlinux.org/CVE-2021-30465

1 0

[ASA-202105-16] websvn: arbitrary command execution
by Jonas Witschel 26 May '21

26 May '21

Arch Linux Security Advisory ASA-202105-16 ========================================== Severity: High Date : 2021-05-25 CVE-ID : CVE-2021-32305 Package : websvn Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1969 Summary ======= The package websvn before version 2.6.1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2.6.1-1. # pacman -Syu "websvn>=2.6.1-1" The problem has been fixed upstream in version 2.6.1. Workaround ========== None. Description =========== WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. Impact ====== A remote attacker can execute arbitrary shell commands on the server using a crafted search query. References ========== https://github.com/websvnphp/websvn/pull/142 https://github.com/websvnphp/websvn/commit/88fce56b7b9dbfc0fe2629217c3bff2c… https://security.archlinux.org/CVE-2021-32305

1 0

[ASA-202105-15] python-babel: arbitrary code execution
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-15 ========================================== Severity: Medium Date : 2021-05-19 CVE-ID : CVE-2021-20095 Package : python-babel Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1894 Summary ======= The package python-babel before version 2.9.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.9.1-1. # pacman -Syu "python-babel>=2.9.1-1" The problem has been fixed upstream in version 2.9.1. Workaround ========== None. Description =========== Relative Path Traversal in Babel 2.9.0 allows an attacker to load arbitrary locale files on disk and execute arbitrary code. Impact ====== A local attacker could load arbitrary locale files through path traversal using a crafted locale identifier and execute arbitrary code. References ========== https://www.tenable.com/security/research/tra-2021-14 https://github.com/python-babel/babel/pull/782 https://github.com/python-babel/babel/commit/412015ef642bfcc0d8ba8f4d05cdbb… https://security.archlinux.org/CVE-2021-20095

1 0

[ASA-202105-14] mariadb: denial of service
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-14 ========================================== Severity: Medium Date : 2021-05-19 CVE-ID : CVE-2021-2154 CVE-2021-2166 Package : mariadb Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1882 Summary ======= The package mariadb before version 10.5.10-1 is vulnerable to denial of service. Resolution ========== Upgrade to 10.5.10-1. # pacman -Syu "mariadb>=10.5.10-1" The problems have been fixed upstream in version 10.5.10. Workaround ========== None. Description =========== - CVE-2021-2154 (denial of service) A security issue has been found in MariaDB before version 10.5.10. An easily exploitable vulnerability allows high privileged attackers with network access via multiple protocols to compromise the MariaDB server. Successful attacks of this vulnerability can cause a hang or a frequently repeatable crash (complete denial of service) of the server. - CVE-2021-2166 (denial of service) A security issue has been found in MariaDB before version 10.5.10. An easily exploitable vulnerability allows high privileged attackers with network access via multiple protocols to compromise the MariaDB server. Successful attacks of this vulnerability can cause a hang or a frequently repeatable crash (complete denial of service) of the server. Impact ====== A privileged remote attacker could cause the MariaDB server to hang or crash. References ========== https://mariadb.com/kb/en/mariadb-10510-release-notes/ https://security.archlinux.org/CVE-2021-2154 https://security.archlinux.org/CVE-2021-2166

1 0

[ASA-202105-13] opendmarc: multiple issues
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-13 ========================================== Severity: Medium Date : 2021-05-19 CVE-ID : CVE-2019-20790 CVE-2020-12272 Package : opendmarc Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1375 Summary ======= The package opendmarc before version 1.4.1.1-1 is vulnerable to multiple issues including content spoofing and authentication bypass. Resolution ========== Upgrade to 1.4.1.1-1. # pacman -Syu "opendmarc>=1.4.1.1-1" The problems have been fixed upstream in version 1.4.1.1. Workaround ========== None. Description =========== - CVE-2019-20790 (authentication bypass) OpenDMARC before 1.4.1, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field. - CVE-2020-12272 (content spoofing) OpenDMARC before 1.4.1 allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring. OpenDMARC has added checking to validate that the domain element in both SPF and DKIM header fields being inspected argument contains only valid domain name characters. This has been fixed as of OpenDMARC 1.4.1 (March 2021). Impact ====== A remote attacker could spoof SPF, DMARC and DKIM authentication results. References ========== https://github.com/trusteddomainproject/OpenDMARC/blob/develop/SECURITY/CVE… https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816 https://sourceforge.net/p/opendmarc/tickets/235/ https://www.usenix.org/system/files/sec20fall_chen-jianjun_prepub_0.pdf https://github.com/trusteddomainproject/OpenDMARC/issues/49 https://github.com/trusteddomainproject/OpenDMARC/issues/158 https://github.com/trusteddomainproject/OpenDMARC/commit/d72e1ec0ae6ed3a982… https://github.com/trusteddomainproject/OpenDMARC/commit/9c0db8c12e4488fbf9… https://github.com/trusteddomainproject/OpenDMARC/commit/5f980792546d11bc16… https://github.com/trusteddomainproject/OpenDMARC/blob/develop/SECURITY/CVE… https://sourceforge.net/p/opendmarc/tickets/237/ https://github.com/trusteddomainproject/OpenDMARC/commit/f3a9a9d4edfaa05102… https://security.archlinux.org/CVE-2019-20790 https://security.archlinux.org/CVE-2020-12272

1 0

[ASA-202105-12] libx11: insufficient validation
by Jonas Witschel 20 May '21

20 May '21

Arch Linux Security Advisory ASA-202105-12 ========================================== Severity: High Date : 2021-05-19 CVE-ID : CVE-2021-31535 Package : libx11 Type : insufficient validation Remote : No Link : https://security.archlinux.org/AVG-1968 Summary ======= The package libx11 before version 1.7.1-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 1.7.1-1. # pacman -Syu "libx11>=1.7.1-1" The problem has been fixed upstream in version 1.7.1. Workaround ========== None. Description =========== A security issue has been found in libx11 before version 1.7.1. XLookupColor() and other X libraries function lack proper validation of the length of their string parameters. If those parameters can be controlled by an external application (for instance a color name that can be emitted via a terminal control sequence) it can lead to the emission of extra X protocol requests to the X server. Impact ====== An attacker could emit arbitrary X protocol requests to the X server through crafted string parameters. References ========== https://unparalleled.eu/publications/2021/advisory-unpar-2021-1.txt https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge… https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53… https://security.archlinux.org/CVE-2021-31535

1 0