- Arch-security - lists.archlinux.org

[ASA-202010-2] linux: multiple issues
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-2 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490 Package : linux Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1248 Summary ======= The package linux before version 5.9.1.arch1-1 is vulnerable to multiple issues including information disclosure, privilege escalation and denial of service. Resolution ========== Upgrade to 5.9.1.arch1-1. # pacman -Syu "linux>=5.9.1.arch1-1" The problems have been fixed upstream in version 5.9.1.arch1. Workaround ========== None. Description =========== - CVE-2020-12351 (privilege escalation) A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. - CVE-2020-12352 (information disclosure) An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. - CVE-2020-24490 (denial of service) A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== A remote unauthenticated attacker in range is able to execute arbitrary code, disclose information or DoS the system through bluetooth. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://github.com/google/security-research/security/advisories/GHSA-h637-c… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz… https://github.com/google/security-research/security/advisories/GHSA-7mh3-g… https://github.com/google/security-research/security/advisories/GHSA-ccx2-w… https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.gi… https://security.archlinux.org/CVE-2020-12351 https://security.archlinux.org/CVE-2020-12352 https://security.archlinux.org/CVE-2020-24490

1 0

[ASA-202010-1] chromium: multiple issues
by Remi Gacogne 14 Oct '20

14 Oct '20

Arch Linux Security Advisory ASA-202010-1 ========================================= Severity: Critical Date : 2020-10-10 CVE-ID : CVE-2020-6557 CVE-2020-15967 CVE-2020-15968 CVE-2020-15969 CVE-2020-15970 CVE-2020-15971 CVE-2020-15972 CVE-2020-15973 CVE-2020-15974 CVE-2020-15975 CVE-2020-15976 CVE-2020-15977 CVE-2020-15978 CVE-2020-15979 CVE-2020-15980 CVE-2020-15981 CVE-2020-15982 CVE-2020-15983 CVE-2020-15984 CVE-2020-15985 CVE-2020-15986 CVE-2020-15987 CVE-2020-15988 CVE-2020-15989 CVE-2020-15990 CVE-2020-15991 CVE-2020-15992 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1238 Summary ======= The package chromium before version 86.0.4240.75-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure and insufficient validation. Resolution ========== Upgrade to 86.0.4240.75-1. # pacman -Syu "chromium>=86.0.4240.75-1" The problems have been fixed upstream in version 86.0.4240.75. Workaround ========== None. Description =========== - CVE-2020-6557 (access restriction bypass) An inappropriate implementation security issue has been found in the networking component of the chromium browser before 86.0.4240.75. - CVE-2020-15967 (arbitrary code execution) A use after free security issue has been found in the payments component of the chromium browser before 86.0.4240.75. - CVE-2020-15968 (arbitrary code execution) A use after free security issue has been found in the Blink component of the chromium browser before 86.0.4240.75. - CVE-2020-15969 (arbitrary code execution) A use after free security issue has been found in the WebRTC component of the chromium browser before 86.0.4240.75. - CVE-2020-15970 (arbitrary code execution) A use after free security issue has been found in the NFC component of the chromium browser before 86.0.4240.75. - CVE-2020-15971 (arbitrary code execution) A use after free security issue has been found in the printing component of the chromium browser before 86.0.4240.75. - CVE-2020-15972 (arbitrary code execution) A use after free security issue has been found in the audio component of the chromium browser before 86.0.4240.75. - CVE-2020-15973 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 86.0.4240.75. - CVE-2020-15974 (arbitrary code execution) An integer overflow security issue has been found in the Blink component of the chromium browser before 86.0.4240.75. - CVE-2020-15975 (arbitrary code execution) An integer overflow security issue has been found in the SwiftShader component of the chromium browser before 86.0.4240.75. - CVE-2020-15976 (arbitrary code execution) A use after free security issue has been found in the WebXR component of the chromium browser before 86.0.4240.75. - CVE-2020-15977 (insufficient validation) An insufficient data validation security issue has been found in the dialogs component of the chromium browser before 86.0.4240.75. - CVE-2020-15978 (insufficient validation) An insufficient data validation security issue has been found in the navigation component of the chromium browser before 86.0.4240.75. - CVE-2020-15979 (access restriction bypass) An inappropriate implementation security issue has been found in the V8 component of the chromium browser before 86.0.4240.75. - CVE-2020-15980 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Intents component of the chromium browser before 86.0.4240.75. - CVE-2020-15981 (information disclosure) An out of bounds read security issue has been found in the audio component of the chromium browser before 86.0.4240.75. - CVE-2020-15982 (information disclosure) A side-channel information leakage security issue has been found in the cache component of the chromium browser before 86.0.4240.75. - CVE-2020-15983 (insufficient validation) An insufficient data validation security issue has been found in the webUI component of the chromium browser before 86.0.4240.75. - CVE-2020-15984 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Omnibox component of the chromium browser before 86.0.4240.75. - CVE-2020-15985 (access restriction bypass) An inappropriate implementation security issue has been found in the Blink component of the chromium browser before 86.0.4240.75. - CVE-2020-15986 (arbitrary code execution) An integer overflow security issue has been found in the media component of the chromium browser before 86.0.4240.75. - CVE-2020-15987 (arbitrary code execution) A use after free security issue has been found in the WebRTC component of the chromium browser before 86.0.4240.75. - CVE-2020-15988 (access restriction bypass) An insufficient policy enforcement security issue has been found in the downloads component of the chromium browser before 86.0.4240.75. - CVE-2020-15989 (information disclosure) An uninitialized use security issue has been found in the PDFium component of the chromium browser before 86.0.4240.75. - CVE-2020-15990 (arbitrary code execution) A use after free security issue has been found in the autofill component of the chromium browser before 86.0.4240.75. - CVE-2020-15991 (arbitrary code execution) A use after free security issue has been found in the password manager component of the chromium browser before 86.0.4240.75. - CVE-2020-15992 (access restriction bypass) An insufficient policy enforcement security issue has been found in the networking component of the chromium browser before 86.0.4240.75. Impact ====== A remote attacker can access sensitive information, bypass security measures and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-des… https://crbug.com/1083278 https://crbug.com/1127322 https://crbug.com/1126424 https://crbug.com/1124659 https://crbug.com/1108299 https://crbug.com/1114062 https://crbug.com/1115901 https://crbug.com/1106890 https://crbug.com/1104103 https://crbug.com/1110800 https://crbug.com/1123522 https://crbug.com/1097724 https://crbug.com/1116280 https://crbug.com/1127319 https://crbug.com/1092453 https://crbug.com/1123023 https://crbug.com/1039882 https://crbug.com/1076786 https://crbug.com/1080395 https://crbug.com/1099276 https://crbug.com/1100247 https://crbug.com/1127774 https://crbug.com/1092518 https://crbug.com/1108351 https://crbug.com/1133671 https://crbug.com/1133688 https://crbug.com/1110195 https://security.archlinux.org/CVE-2020-6557 https://security.archlinux.org/CVE-2020-15967 https://security.archlinux.org/CVE-2020-15968 https://security.archlinux.org/CVE-2020-15969 https://security.archlinux.org/CVE-2020-15970 https://security.archlinux.org/CVE-2020-15971 https://security.archlinux.org/CVE-2020-15972 https://security.archlinux.org/CVE-2020-15973 https://security.archlinux.org/CVE-2020-15974 https://security.archlinux.org/CVE-2020-15975 https://security.archlinux.org/CVE-2020-15976 https://security.archlinux.org/CVE-2020-15977 https://security.archlinux.org/CVE-2020-15978 https://security.archlinux.org/CVE-2020-15979 https://security.archlinux.org/CVE-2020-15980 https://security.archlinux.org/CVE-2020-15981 https://security.archlinux.org/CVE-2020-15982 https://security.archlinux.org/CVE-2020-15983 https://security.archlinux.org/CVE-2020-15984 https://security.archlinux.org/CVE-2020-15985 https://security.archlinux.org/CVE-2020-15986 https://security.archlinux.org/CVE-2020-15987 https://security.archlinux.org/CVE-2020-15988 https://security.archlinux.org/CVE-2020-15989 https://security.archlinux.org/CVE-2020-15990 https://security.archlinux.org/CVE-2020-15991 https://security.archlinux.org/CVE-2020-15992

1 0

[ASA-202009-17] samba: access restriction bypass
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-17 ========================================== Severity: Medium Date : 2020-09-29 CVE-ID : CVE-2020-1472 Package : samba Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-1236 Summary ======= The package samba before version 4.13.0-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 4.13.0-1. # pacman -Syu "samba>=4.13.0-1" The problem has been fixed upstream in version 4.13.0. Workaround ========== Ensure you do not have an schannel directive and if you do make sure it's either = yes or = auto. Description =========== A flaw was found in the Microsoft Windows Netlogon Remote Protocol (MS- NRPC), where it reuses a known, static, zero-value initialization vector (IV) in AES-CFB8 mode. This flaw allows an unauthenticated attacker to impersonate a domain-joined computer, including a domain controller, and possibly obtain domain administrator privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== An unauthenticated attacker can gain administrator access through crafted traffic, if the samba server is configured to run with a vulnerable schannel directive. References ========== https://bugs.archlinux.org/task/67983 https://www.samba.org/samba/security/CVE-2020-1472.html https://security.archlinux.org/CVE-2020-1472

1 0

[ASA-202009-16] zeromq: denial of service
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-16 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-15166 Package : zeromq Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1219 Summary ======= The package zeromq before version 4.3.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.3.3-1. # pacman -Syu "zeromq>=4.3.3-1" The problem has been fixed upstream in version 4.3.3. Workaround ========== None. Description =========== A denial of service has been found in libzmq before 4.3.3, allowing unauthenticated clients to prevent legitimate clients from exchange any message with a CURVE/ZAP-protected server. Impact ====== A remote attacker might be able to cause a denial of service through a malicious connection. References ========== https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m https://github.com/zeromq/libzmq/pull/3913/commits/e7f0090b161ce6344f6bd350… https://oss-fuzz.com/testcase-detail/5707174518194176 https://security.archlinux.org/CVE-2020-15166

1 0

[ASA-202009-15] lib32-zeromq: denial of service
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-15 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-15166 Package : lib32-zeromq Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1220 Summary ======= The package lib32-zeromq before version 4.3.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.3.3-1. # pacman -Syu "lib32-zeromq>=4.3.3-1" The problem has been fixed upstream in version 4.3.3. Workaround ========== None. Description =========== A denial of service has been found in libzmq before 4.3.3, allowing unauthenticated clients to prevent legitimate clients from exchange any message with a CURVE/ZAP-protected server. Impact ====== A remote attacker might be able to cause a denial of service through a malicious connection. References ========== https://github.com/zeromq/libzmq/security/advisories/GHSA-25wp-cf8g-938m https://github.com/zeromq/libzmq/pull/3913/commits/e7f0090b161ce6344f6bd350… https://oss-fuzz.com/testcase-detail/5707174518194176 https://security.archlinux.org/CVE-2020-15166

1 0

[ASA-202009-14] yaws: multiple issues
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-14 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-12872 CVE-2020-24379 CVE-2020-24916 Package : yaws Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1228 Summary ======= The package yaws before version 2.0.8-1 is vulnerable to multiple issues including arbitrary command execution and information disclosure. Resolution ========== Upgrade to 2.0.8-1. # pacman -Syu "yaws>=2.0.8-1" The problems have been fixed upstream in version 2.0.8. Workaround ========== None. Description =========== - CVE-2020-12872 (information disclosure) yaws_config.erl in Yaws through 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks. - CVE-2020-24379 (information disclosure) WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. - CVE-2020-24916 (arbitrary command execution) CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection. Impact ====== A remote attacker might be able to execute arbitrary commands, downgrade TLS ciphers, or load foreign entities via crafted content. References ========== https://github.com/erlyaws/yaws/releases/tag/yaws-2.0.8 https://vuln.be/post/yaws-xxe-and-shell-injections/ https://sweet32.info/ https://medium.com/@charlielabs101/cve-2020-12872-df315411aa70 https://packetstormsecurity.com/files/159106/Yaws-2.0.7-XML-Injection-Comma… https://github.com/erlyaws/yaws/commit/05a06345012598f5da55dbb4d041c8dc26e8… https://github.com/vulnbe/poc-yaws-dav-xxe https://github.com/erlyaws/yaws/commit/799b3b526d15b7a9bc43ae97165aeb085f18… https://github.com/vulnbe/poc-yaws-cgi-shell-injection https://security.archlinux.org/CVE-2020-12872 https://security.archlinux.org/CVE-2020-24379 https://security.archlinux.org/CVE-2020-24916

1 0

[ASA-202009-13] brotli: denial of service
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-13 ========================================== Severity: Medium Date : 2020-09-26 CVE-ID : CVE-2020-8927 Package : brotli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1230 Summary ======= The package brotli before version 1.0.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.9-1. # pacman -Syu "brotli>=1.0.9-1" The problem has been fixed upstream in version 1.0.9. Workaround ========== None. Description =========== A buffer overflow exists in the Brotli library < 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits. Impact ====== A remote attacker might be able to cause a crash via crafted content. References ========== https://github.com/google/brotli/releases/tag/v1.0.9 https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f… https://security.archlinux.org/CVE-2020-8927

1 0

[ASA-202009-12] lib32-brotli: denial of service
by Morten Linderud 06 Oct '20

06 Oct '20

Arch Linux Security Advisory ASA-202009-12 ========================================== Severity: Medium Date : 2020-09-26 CVE-ID : CVE-2020-8927 Package : lib32-brotli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1231 Summary ======= The package lib32-brotli before version 1.0.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.0.9-1. # pacman -Syu "lib32-brotli>=1.0.9-1" The problem has been fixed upstream in version 1.0.9. Workaround ========== None. Description =========== A buffer overflow exists in the Brotli library < 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits. Impact ====== A remote attacker might be able to cause a crash via crafted content. References ========== https://github.com/google/brotli/releases/tag/v1.0.9 https://github.com/google/brotli/commit/223d80cfbec8fd346e32906c732c8ede21f… https://security.archlinux.org/CVE-2020-8927

1 0

[ASA-202009-11] podman: information disclosure
by Morten Linderud 29 Sep '20

29 Sep '20

Arch Linux Security Advisory ASA-202009-11 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-14370 Package : podman Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1233 Summary ======= The package podman before version 2.1.0-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.1.0-1. # pacman -Syu "podman>=2.1.0-1" The problem has been fixed upstream in version 2.1.0. Workaround ========== None. Description =========== A flaw was discovered in Podman before upstream version 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first containers will get leaked into subsequent containers. An attacker who has control over those subsequent containers may get access to secrets shared with previous containers through environment variables. Impact ====== A local privileged user can potentially view secrets in environment variables. References ========== https://github.com/containers/podman/commit/a7e864e6e7de894d4edde4fff00e53d… https://security.archlinux.org/CVE-2020-14370

1 0

[ASA-202009-10] firefox: multiple issues
by Morten Linderud 29 Sep '20

29 Sep '20

Arch Linux Security Advisory ASA-202009-10 ========================================== Severity: High Date : 2020-09-23 CVE-ID : CVE-2020-15673 CVE-2020-15674 CVE-2020-15675 CVE-2020-15676 CVE-2020-15677 CVE-2020-15678 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1235 Summary ======= The package firefox before version 81.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, cross-site scripting and denial of service. Resolution ========== Upgrade to 81.0-1. # pacman -Syu "firefox>=81.0-1" The problems have been fixed upstream in version 81.0. Workaround ========== None. Description =========== - CVE-2020-15673 (arbitrary code execution) Several memory safety issues have been found in Firefox before 81.0 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-15674 (arbitrary code execution) Several memory safety issues have been found in Firefox before 81.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-15675 (arbitrary code execution) A use-after-free issue has been found in the WebGL implementation of Firefox before 81.0 where, when processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. - CVE-2020-15676 (cross-site scripting) Firefox before 81.0 sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a content-editable element. - CVE-2020-15677 (content spoofing) An issue has been found in Firefox before 81.0 where, by exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. - CVE-2020-15678 (denial of service) A use-after-free issue has been found in Firefox before 81.0 where, when recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. Impact ====== A remote attacker might be able to cause a crash, spoof content or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-42 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1648493%2C1660800 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1656063%2C1656064%2C1656067… https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/show_bug.cgi?id=1654211 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/show_bug.cgi?id=1646140 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/show_bug.cgi?id=1641487 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-156… https://bugzilla.mozilla.org/show_bug.cgi?id=1660211 https://security.archlinux.org/CVE-2020-15673 https://security.archlinux.org/CVE-2020-15674 https://security.archlinux.org/CVE-2020-15675 https://security.archlinux.org/CVE-2020-15676 https://security.archlinux.org/CVE-2020-15677 https://security.archlinux.org/CVE-2020-15678

1 0