- Arch-security - lists.archlinux.org

[ASA-202101-6] chromium: multiple issues
by Morten Linderud 10 Jan '21

10 Jan '21

Arch Linux Security Advisory ASA-202101-6 ========================================= Severity: High Date : 2021-01-08 CVE-ID : CVE-2020-15995 CVE-2020-16043 CVE-2021-21106 CVE-2021-21107 CVE-2021-21108 CVE-2021-21109 CVE-2021-21110 CVE-2021-21111 CVE-2021-21112 CVE-2021-21113 CVE-2021-21114 CVE-2021-21115 CVE-2021-21116 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1414 Summary ======= The package chromium before version 87.0.4280.141-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 87.0.4280.141-1. # pacman -Syu "chromium>=87.0.4280.141-1" The problems have been fixed upstream in version 87.0.4280.141. Workaround ========== None. Description =========== - CVE-2020-15995 (arbitrary code execution) An out of bounds write security issue has been found in the V8 component of the Chromium browser before version 87.0.4280.141. - CVE-2020-16043 (insufficient validation) An insufficient data validation security issue has been found in the networking component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21106 (arbitrary code execution) A use after free security issue has been found in the autofill component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21107 (arbitrary code execution) A use after free security issue has been found in the drag and drop component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21108 (arbitrary code execution) A use after free security issue has been found in the media component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21109 (arbitrary code execution) A use after free security issue has been found in the payments component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21110 (arbitrary code execution) A use after free security issue has been found in the safe browsing component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21111 (access restriction bypass) An insufficient policy enforcement security issue has been found in the WebUI component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21112 (arbitrary code execution) A use after free security issue has been found in the Blink component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21113 (arbitrary code execution) A heap buffer overflow security issue has been found in the Skia component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21114 (arbitrary code execution) A use after free security issue has been found in the audio component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21115 (arbitrary code execution) A use after free security issue has been found in the safe browsing component of the Chromium browser before version 87.0.4280.141. - CVE-2021-21116 (arbitrary code execution) A heap buffer overflow security issue has been found in the audio component of the Chromium browser before version 87.0.4280.141. Impact ====== A remote attacker might be able to bypass security restrictions and execute arbitrary code. References ========== https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-des… https://crbug.com/1157790 https://crbug.com/1148309 https://crbug.com/1148749 https://crbug.com/1153595 https://crbug.com/1155426 https://crbug.com/1152334 https://crbug.com/1152451 https://crbug.com/1149125 https://crbug.com/1151298 https://crbug.com/1155178 https://crbug.com/1150065 https://crbug.com/1157814 https://crbug.com/1151069 https://security.archlinux.org/CVE-2020-15995 https://security.archlinux.org/CVE-2020-16043 https://security.archlinux.org/CVE-2021-21106 https://security.archlinux.org/CVE-2021-21107 https://security.archlinux.org/CVE-2021-21108 https://security.archlinux.org/CVE-2021-21109 https://security.archlinux.org/CVE-2021-21110 https://security.archlinux.org/CVE-2021-21111 https://security.archlinux.org/CVE-2021-21112 https://security.archlinux.org/CVE-2021-21113 https://security.archlinux.org/CVE-2021-21114 https://security.archlinux.org/CVE-2021-21115 https://security.archlinux.org/CVE-2021-21116

1 0

[ASA-202101-5] firefox: arbitrary code execution
by Morten Linderud 10 Jan '21

10 Jan '21

Arch Linux Security Advisory ASA-202101-5 ========================================= Severity: Critical Date : 2021-01-08 CVE-ID : CVE-2020-16044 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1413 Summary ======= The package firefox before version 84.0.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 84.0.2-1. # pacman -Syu "firefox>=84.0.2-1" The problem has been fixed upstream in version 84.0.2. Workaround ========== None. Description =========== A security issue was found in Firefox before 84.0.2. A malicious peer could have modified a COOKIE-ECHO chunk in a SCTP packet in a way that potentially resulted in a use-after-free. Mozilla presumes that with enough effort it could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to execute arbitrary code via a crafted SCTP packet. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-01/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1683964 https://hg.mozilla.org/mozilla-central/rev/08ba03dc8d4420e04e7c77fee3013e68… https://hg.mozilla.org/mozilla-central/rev/8c09f4813fc7e8f44605b6092262199b… https://hg.mozilla.org/mozilla-central/rev/5991645a87d2abf289686d09d943229c… https://security.archlinux.org/CVE-2020-16044

1 0

[ASA-202101-4] dovecot: multiple issues
by Remi Gacogne 05 Jan '21

05 Jan '21

Arch Linux Security Advisory ASA-202101-4 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-24386 CVE-2020-25275 Package : dovecot Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1398 Summary ======= The package dovecot before version 2.3.13-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 2.3.13-1. # pacman -Syu "dovecot>=2.3.13-1" The problems have been fixed upstream in version 2.3.13. Workaround ========== Operators can choose to disable IMAP hibernation. IMAP hibernation is not on by default. To ensure imap hibernation is disabled, make sure imap_hibernate_timeout is set to 0 or unset. Description =========== - CVE-2020-24386 (information disclosure) A security issue was discovered in dovecot version 2.2.26 up to 2.3.11.3. When imap hibernation is active, an attacker can cause dovecot to discover the file system directory structure and access other users' emails using a specially crafted command. The attacker must have valid credentials to access the mail server. The issue is fixed in dovecot version 2.3.13. - CVE-2020-25275 (denial of service) A security issue was discovered in dovecot version 2.3.11 up to 2.3.11.3. Mail delivery/parsing crashed when the 10 000th MIME part was message/rfc822 (or if its parent was multipart/digest). This happened due to earlier MIME parsing changes for CVE-2020-12100. Malicious senders could crash dovecot repeatedly by sending/uploading messages with more than 10 000 MIME parts. The issue is fixed in dovecot version 2.3.13. Impact ====== Malicious senders could crash dovecot repeatedly by sending/uploading messages with more than 10 000 MIME parts. In addition, when imap hibernation is active, a remote, authenticated attacker can cause dovecot to discover the file system directory structure and access other users' emails using a specially crafted command. References ========== https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html https://github.com/dovecot/core/commit/00df2308b0733e810824545183d73276c416… https://github.com/dovecot/core/commit/b4a9872b833b7985c7d0e7615f1b7fc812dd… https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html https://github.com/dovecot/core/commit/67f792cb98267ee74c425772e766e7a2525c… https://github.com/dovecot/core/commit/6ae93c3936fc870c313a6fdf44a0999d4129… https://security.archlinux.org/CVE-2020-24386 https://security.archlinux.org/CVE-2020-25275

1 0

[ASA-202101-3] poppler: arbitrary code execution
by Remi Gacogne 05 Jan '21

05 Jan '21

Arch Linux Security Advisory ASA-202101-3 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-35702 Package : poppler Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1382 Summary ======= The package poppler before version 21.01.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 21.01.0-1. # pacman -Syu "poppler>=21.01.0-1" The problem has been fixed upstream in version 21.01.0. Workaround ========== None. Description =========== DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. Impact ====== An attacker might be able to execute arbitrary code via a crafted PDF document. References ========== https://gitlab.freedesktop.org/poppler/poppler/-/issues/1011 https://gitlab.freedesktop.org/poppler/poppler/uploads/8455cee26a313a3a0174… https://gitlab.freedesktop.org/poppler/poppler/-/commit/ae614bf8ab42c9d0c7a… https://security.archlinux.org/CVE-2020-35702

1 0

[ASA-202101-2] roundcubemail: cross-site scripting
by Remi Gacogne 05 Jan '21

05 Jan '21

Arch Linux Security Advisory ASA-202101-2 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-35730 Package : roundcubemail Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1388 Summary ======= The package roundcubemail before version 1.4.10-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.4.10-1. # pacman -Syu "roundcubemail>=1.4.10-1" The problem has been fixed upstream in version 1.4.10. Workaround ========== None. Description =========== A security issue was found in Roundcube Webmail before version 1.4.10, 1.3.16 and 1.2.13. linkref_addindex in rcube_string_replacer.php allowed performing a stored cross-site scripting attack using a crafted HTML or plain text email message. Impact ====== A remote attacker can perform a stored cross-site scripting attack using a crafted HTML or plain text email message. References ========== https://bugs.archlinux.org/task/69131 https://github.com/roundcube/roundcubemail/releases/tag/1.4.10 https://github.com/roundcube/roundcubemail/commit/0bceba301aa621ecc0263eac1… https://security.archlinux.org/CVE-2020-35730

1 0

[ASA-202101-1] rsync: man-in-the-middle
by Remi Gacogne 05 Jan '21

05 Jan '21

Arch Linux Security Advisory ASA-202101-1 ========================================= Severity: High Date : 2021-01-04 CVE-ID : CVE-2020-14387 Package : rsync Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-1374 Summary ======= The package rsync before version 3.2.3-2 is vulnerable to man-in-the- middle. Resolution ========== Upgrade to 3.2.3-2. # pacman -Syu "rsync>=3.2.3-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in rsync version 3.2.0pre1 to 3.2.4. rsync-ssl does not verify the hostname in the server certificate in openssl mode, so a remote, unauthenticated man-in-the-middle attacker with a valid certificate for another hostname could intercept connections. Impact ====== A remote, unauthenticated attacker in position of man-in-the-middle with a valid certificate for another hostname can intercept connections. References ========== https://bugs.archlinux.org/task/69051 https://bugzilla.redhat.com/show_bug.cgi?id=1875549 https://git.samba.org/?p=rsync.git;a=commitdiff;h=c3f7414c450faaf6a8281cc4a… https://security.archlinux.org/CVE-2020-14387

1 0

[ASA-202012-26] qemu: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-26 ========================================== Severity: Medium Date : 2020-12-16 CVE-ID : CVE-2020-14364 CVE-2020-25624 CVE-2020-25625 CVE-2020-25723 CVE-2020-28916 Package : qemu Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1300 Summary ======= The package qemu before version 5.2.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.2.0-1. # pacman -Syu "qemu>=5.2.0-1" The problems have been fixed upstream in version 5.2.0. Workaround ========== None. Description =========== - CVE-2020-14364 (arbitrary code execution) An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host. - CVE-2020-25624 (arbitrary code execution) A flaw was found in QEMU before version 5.2.0. An out-of-bounds read/write access issue was found in the USB OHCI controller emulator. The issue could occur while servicing transfer descriptors (TD), as OHCI controller derives variables 'start_addr', 'end_addr', and 'len' from values supplied by the host controller driver. The host controller driver may supply values such that using these variables leads to an out-of-bounds access issue leading to a guest user/process using this flaw to crash the QEMU process on the host resulting in a denial of service (DoS) scenario. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. - CVE-2020-25625 (denial of service) An infinite loop issue was found in the USB OHCI controller emulator of QEMU before version 5.2.0. It could occur while servicing OHCI isochronous transfer descriptors (TD) in ohci_service_iso_td routine, as it retires a TD if it has passed its time frame. While doing so it does not check if the TD was already processed ones and holds an error code in TD_CC. It may happen if the TD list has a loop. A guest user/process may use this flaw to consume cpu cycles on the host resulting in a DoS scenario. - CVE-2020-25723 (denial of service) A reachable assertion issue was found in the USB EHCI emulation code of QEMU before version 5.2.0. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. - CVE-2020-28916 (denial of service) An infinite loop issue was found in the e1000e device emulator in QEMU before version 5.2.0. The issue could occur while receiving packets via e1000e_write_packet_to_guest() routine, if the receive(RX) descriptor has NULL buffer address. A privileged guest user may use this flaw to induce a DoS scenario on the host. Impact ====== A guest might be able to cause a denial of service or execute arbitrary code on the host. References ========== https://bugs.archlinux.org/task/68356 https://www.openwall.com/lists/oss-security/2020/08/24/2 https://www.openwall.com/lists/oss-security/2020/08/24/3 https://git.qemu.org/?p=qemu.git;a=commitdiff;h=b946434f2659a182afc17e155be… https://git.qemu.org/?p=qemu.git;a=commitdiff;h=1328fe0c32d5474604105b81053… https://www.openwall.com/lists/oss-security/2020/09/17/1 https://git.qemu.org/?p=qemu.git;a=commitdiff;h=1be90ebecc95b09a2ee5af3f60c… https://git.qemu.org/?p=qemu.git;a=commit;h=2fdb42d840400d58f2e706ecca82c14… https://www.openwall.com/lists/oss-security/2020/12/01/2 https://git.qemu.org/?p=qemu.git;a=commitdiff;h=c2cb511634012344e3d0fe49a03… https://security.archlinux.org/CVE-2020-14364 https://security.archlinux.org/CVE-2020-25624 https://security.archlinux.org/CVE-2020-25625 https://security.archlinux.org/CVE-2020-25723 https://security.archlinux.org/CVE-2020-28916

1 0

[ASA-202012-25] firefox: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-25 ========================================== Severity: High Date : 2020-12-16 CVE-ID : CVE-2020-16042 CVE-2020-26971 CVE-2020-26972 CVE-2020-26973 CVE-2020-26974 CVE-2020-26976 CVE-2020-26978 CVE-2020-26979 CVE-2020-35111 CVE-2020-35113 CVE-2020-35114 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1362 Summary ======= The package firefox before version 84.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 84.0-1. # pacman -Syu "firefox>=84.0-1" The problems have been fixed upstream in version 84.0. Workaround ========== None. Description =========== - CVE-2020-16042 (information disclosure) An uninitialized use security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88 and Firefox before 84.0. - CVE-2020-26971 (arbitrary code execution) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6 where certain blit values provided by the user were not properly constrained, leading to a heap buffer overflow on some video drivers. - CVE-2020-26972 (arbitrary code execution) A security issue was found in Firefox before 84.0. The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted in WebGL, resulting in a use-after-free and a potentially exploitable crash. - CVE-2020-26973 (content spoofing) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6 where certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. - CVE-2020-26974 (arbitrary code execution) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6. When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. - CVE-2020-26976 (information disclosure) A security issue was found in Firefox before 84.0. When an HTTPS page was embedded in an HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. - CVE-2020-26978 (information disclosure) A security issue was discovered in Firefox before 84.0 and Thunderbird before 78.6. Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. - CVE-2020-26979 (content spoofing) A security issue was discovered in Firefox before 84.0. When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. - CVE-2020-35111 (information disclosure) A security issue was discovered in Firefox before 84.0 and Thunderbird before 78.6. When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. - CVE-2020-35113 (arbitrary code execution) Mozilla developer Christian Holler reported memory safety bugs present in Firefox 83, Firefox ESR 78.5 and Thunderbird 78.5. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-35114 (arbitrary code execution) Mozilla developers Christian Holler, Jan-Ivar Bruaroey, and Gabriele Svelto reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to spoof content, access sensitive information or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/ https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-des… https://crbug.com/1151890 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1679003 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1663466 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1671382 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1680084 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1681022 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1674343 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1677047 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1641287%2C1673299 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-351… https://bugzilla.mozilla.org/show_bug.cgi?id=1657916 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-351… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1664831%2C1673589 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1607449%2C1640416%2C1656459… https://security.archlinux.org/CVE-2020-16042 https://security.archlinux.org/CVE-2020-26971 https://security.archlinux.org/CVE-2020-26972 https://security.archlinux.org/CVE-2020-26973 https://security.archlinux.org/CVE-2020-26974 https://security.archlinux.org/CVE-2020-26976 https://security.archlinux.org/CVE-2020-26978 https://security.archlinux.org/CVE-2020-26979 https://security.archlinux.org/CVE-2020-35111 https://security.archlinux.org/CVE-2020-35113 https://security.archlinux.org/CVE-2020-35114

1 0

[ASA-202012-24] openssl: denial of service
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-24 ========================================== Severity: High Date : 2020-12-16 CVE-ID : CVE-2020-1971 Package : openssl Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1335 Summary ======= The package openssl before version 1.1.1.i-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.1.1.i-1. # pacman -Syu "openssl>=1.1.1.i-1" The problem has been fixed upstream in version 1.1.1.i. Workaround ========== None. Description =========== A denial of service security issue was discovered in OpenSSL before 1.1.1i. The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. Impact ====== A remote attacker might be able to cause a crash by tricking a vulnerable client or server into checking a malicious certificate against a malicious CRL. References ========== https://www.openssl.org/news/secadv/20201208.txt https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f960d81215ebf3… https://security.archlinux.org/CVE-2020-1971

1 0

[ASA-202012-23] thunderbird: multiple issues
by Morten Linderud 31 Dec '20

31 Dec '20

Arch Linux Security Advisory ASA-202012-23 ========================================== Severity: High Date : 2020-12-16 CVE-ID : CVE-2020-16042 CVE-2020-26970 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35113 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1315 Summary ======= The package thunderbird before version 78.6.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 78.6.0-1. # pacman -Syu "thunderbird>=78.6.0-1" The problems have been fixed upstream in version 78.6.0. Workaround ========== None. Description =========== - CVE-2020-16042 (information disclosure) An uninitialized use security issue has been found in the V8 component of the chromium browser before version 87.0.4280.88 and Firefox before 84.0. - CVE-2020-26970 (arbitrary code execution) When reading SMTP server status codes, Thunderbird before 78.5.1 writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable. - CVE-2020-26971 (arbitrary code execution) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6 where certain blit values provided by the user were not properly constrained, leading to a heap buffer overflow on some video drivers. - CVE-2020-26973 (content spoofing) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6 where certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. - CVE-2020-26974 (arbitrary code execution) A security issue was found in Firefox before 84.0 and Thunderbird before 78.6. When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. - CVE-2020-26978 (information disclosure) A security issue was discovered in Firefox before 84.0 and Thunderbird before 78.6. Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. - CVE-2020-35111 (information disclosure) A security issue was discovered in Firefox before 84.0 and Thunderbird before 78.6. When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. - CVE-2020-35113 (arbitrary code execution) Mozilla developer Christian Holler reported memory safety bugs present in Firefox 83, Firefox ESR 78.5 and Thunderbird 78.5. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to access sensitive information, spoof content or execute arbitrary code. Note that in general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. References ========== https://bugs.archlinux.org/task/68853 https://www.mozilla.org/en-US/security/advisories/mfsa2020-53/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/ https://chromereleases.googleblog.com/2020/12/stable-channel-update-for-des… https://crbug.com/1151890 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-160… https://bugzilla.mozilla.org/show_bug.cgi?id=1679003 https://www.mozilla.org/en-US/security/advisories/mfsa2020-53/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1677338 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1663466 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1680084 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1681022 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-269… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-269… https://bugzilla.mozilla.org/show_bug.cgi?id=1677047 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-351… https://bugzilla.mozilla.org/show_bug.cgi?id=1657916 https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/#CVE-2020-351… https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/#CVE-2020-351… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1664831%2C1673589 https://security.archlinux.org/CVE-2020-16042 https://security.archlinux.org/CVE-2020-26970 https://security.archlinux.org/CVE-2020-26971 https://security.archlinux.org/CVE-2020-26973 https://security.archlinux.org/CVE-2020-26974 https://security.archlinux.org/CVE-2020-26978 https://security.archlinux.org/CVE-2020-35111 https://security.archlinux.org/CVE-2020-35113

1 0