- Arch-security - lists.archlinux.org

[ASA-202009-9] chromium: multiple issues
by Morten Linderud 29 Sep '20

29 Sep '20

Arch Linux Security Advisory ASA-202009-9 ========================================= Severity: High Date : 2020-09-23 CVE-ID : CVE-2020-15960 CVE-2020-15961 CVE-2020-15962 CVE-2020-15963 CVE-2020-15964 CVE-2020-15965 CVE-2020-15966 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1234 Summary ======= The package chromium before version 85.0.4183.121-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, information disclosure and insufficient validation. Resolution ========== Upgrade to 85.0.4183.121-1. # pacman -Syu "chromium>=85.0.4183.121-1" The problems have been fixed upstream in version 85.0.4183.121. Workaround ========== None. Description =========== - CVE-2020-15960 (information disclosure) An out of bounds read security issue has been found in the storage component of the chromium browser before 85.0.4183.121. - CVE-2020-15961 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 85.0.4183.121 - CVE-2020-15962 (access restriction bypass) An insufficient policy enforcement security issue has been found in the serial component of the chromium browser before 85.0.4183.121. - CVE-2020-15963 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 85.0.4183.121. - CVE-2020-15964 (arbitrary code execution) An out of bounds write security issue has been found in the V8 component of the chromium browser before 85.0.4183.121. - CVE-2020-15965 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 85.0.4183.121. - CVE-2020-15966 (insufficient validation) An insufficient data validation security issue has been found in the media component of the chromium browser before 85.0.4183.121. Impact ====== A remote attacker might be able to bypass security restrictions, access sensitive information or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-des… https://crbug.com/1100136 https://crbug.com/1114636 https://crbug.com/1121836 https://crbug.com/1113558 https://crbug.com/1126249 https://crbug.com/1113565 https://crbug.com/1121414 https://security.archlinux.org/CVE-2020-15960 https://security.archlinux.org/CVE-2020-15961 https://security.archlinux.org/CVE-2020-15962 https://security.archlinux.org/CVE-2020-15963 https://security.archlinux.org/CVE-2020-15964 https://security.archlinux.org/CVE-2020-15965 https://security.archlinux.org/CVE-2020-15966

1 0

[ASA-202009-8] libvirt: privilege escalation
by Morten Linderud 29 Sep '20

29 Sep '20

Arch Linux Security Advisory ASA-202009-8 ========================================= Severity: High Date : 2020-09-22 CVE-ID : CVE-2020-14339 Package : libvirt Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1232 Summary ======= The package libvirt before version 6.5.0-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 6.5.0-2. # pacman -Syu "libvirt>=6.5.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privileged operations to happen against the device-mapper on the host. This flaw allows a malicious guest user or process to perform operations outside of their standard permissions, potentially causing serious damage to the host operating system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== A local user can escalate privileges on the host operating system. References ========== https://bugs.archlinux.org/task/67807 https://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=22494556542c676d1b9e7… https://security.archlinux.org/CVE-2020-14339

1 0

[ASA-202009-7] netbeans: arbitrary code execution
by Morten Linderud 17 Sep '20

17 Sep '20

Arch Linux Security Advisory ASA-202009-7 ========================================= Severity: Critical Date : 2020-09-14 CVE-ID : CVE-2020-11986 Package : netbeans Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1221 Summary ======= The package netbeans before version 12.0_u1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 12.0_u1-1. # pacman -Syu "netbeans>=12.0_u1-1" The problem has been fixed upstream in version 12.0_u1. Workaround ========== None. Description =========== Opening a Gradle project with Apache NetBeans <= 12.0 executes a foreign script immediately. Impact ====== An attacker can trick the user to run code with a malicious gradle project. References ========== https://www.openwall.com/lists/oss-security/2020/09/07/2 https://security.archlinux.org/CVE-2020-11986

1 0

[ASA-202009-6] chromium: multiple issues
by Morten Linderud 17 Sep '20

17 Sep '20

Arch Linux Security Advisory ASA-202009-6 ========================================= Severity: High Date : 2020-09-09 CVE-ID : CVE-2020-6573 CVE-2020-6574 CVE-2020-6575 CVE-2020-6576 CVE-2020-6579 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1225 Summary ======= The package chromium before version 85.0.4183.102-1 is vulnerable to multiple issues including access restriction bypass and arbitrary code execution. Resolution ========== Upgrade to 85.0.4183.102-1. # pacman -Syu "chromium>=85.0.4183.102-1" The problems have been fixed upstream in version 85.0.4183.102. Workaround ========== None. Description =========== - CVE-2020-6573 (arbitrary code execution) A use after free security issue has been found in the video component of the chromium browser before 85.0.4183.102. - CVE-2020-6574 (access restriction bypass) An insufficient policy enforcement security issue has been found in the installer component of the chromium browser before 85.0.4183.102. - CVE-2020-6575 (access restriction bypass) A race security issue has been found in the Mojo component of the chromium browser before 85.0.4183.102. - CVE-2020-6576 (arbitrary code execution) A use after free security issue has been found in the offscreen canvas component of the chromium browser before 85.0.4183.102. - CVE-2020-6579 (access restriction bypass) An insufficient policy enforcement security issue has been found in the networking component of the chromium browser before 85.0.4183.102. Impact ====== A remote attacker might be able to bypass security measures or execute arbitrary code. References ========== https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-des… https://crbug.com/1116304 https://crbug.com/1102196 https://crbug.com/1081874 https://crbug.com/1111737 https://crbug.com/1122684 https://security.archlinux.org/CVE-2020-6573 https://security.archlinux.org/CVE-2020-6574 https://security.archlinux.org/CVE-2020-6575 https://security.archlinux.org/CVE-2020-6576 https://security.archlinux.org/CVE-2020-6579

1 0

[ASA-202009-5] gnupg: arbitrary code execution
by Morten Linderud 09 Sep '20

09 Sep '20

Arch Linux Security Advisory ASA-202009-5 ========================================= Severity: Critical Date : 2020-09-07 CVE-ID : CVE-2020-25125 Package : gnupg Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1218 Summary ======= The package gnupg before version 2.2.23-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.2.23-1. # pacman -Syu "gnupg>=2.2.23-1" The problem has been fixed upstream in version 2.2.23. Workaround ========== None. Description =========== Importing an OpenPGP key having a preference list for AEAD algorithms will lead to an array overflow and thus often to a crash or other undefined behaviour. Importing an arbitrary key can often easily be triggered by an attacker and thus triggering this bug. Exploiting the bug aside from crashes is not trivial but likely possible for a dedicated attacker. The major hurdle for an attacker is that only every second byte is under their control with every first byte having a fixed value of 0x04. Software distribution verification should not be affected by this bug because such a system uses a curated list of keys. Impact ====== A remote attacker might be able to execute arbitrary code by tricking a legitimate user into importing a crafted OpenPGP key. References ========== https://lists.gnupg.org/pipermail/gnupg-announce/2020q3/000448.html https://dev.gnupg.org/T5050 https://security.archlinux.org/CVE-2020-25125

1 0

[ASA-202009-4] python-django: multiple issues
by Morten Linderud 09 Sep '20

09 Sep '20

Arch Linux Security Advisory ASA-202009-4 ========================================= Severity: Medium Date : 2020-09-03 CVE-ID : CVE-2020-24583 CVE-2020-24584 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1217 Summary ======= The package python-django before version 3.1.1-1 is vulnerable to multiple issues including access restriction bypass and insufficient validation. Resolution ========== Upgrade to 3.1.1-1. # pacman -Syu "python-django>=3.1.1-1" The problems have been fixed upstream in version 3.1.1. Workaround ========== None. Description =========== - CVE-2020-24583 (access restriction bypass) An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate- level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command. - CVE-2020-24584 (insufficient validation) An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077. Impact ====== A remote attacker is able to upload and overwrite files. References ========== https://bugs.archlinux.org/task/67794 https://www.djangoproject.com/weblog/2020/sep/01/security-releases/ https://github.com/django/django/commit/934430d22aa5d90c2ba33495ff69a6a1d99… https://github.com/django/django/commit/2b099caa5923afa8cfb5f1e8c0d56b6e0e8… https://security.archlinux.org/CVE-2020-24583 https://security.archlinux.org/CVE-2020-24584

1 0

[ASA-202009-3] go: cross-site scripting
by Morten Linderud 09 Sep '20

09 Sep '20

Arch Linux Security Advisory ASA-202009-3 ========================================= Severity: Medium Date : 2020-09-03 CVE-ID : CVE-2020-24553 Package : go Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1215 Summary ======= The package go before version 1.15.1-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.15.1-1. # pacman -Syu "go>=1.15.1-1" The problem has been fixed upstream in version 1.15.1. Workaround ========== None. Description =========== In Go versions before 1.15.1 and 1.14.8 if the Content-Type header of a Handler was not explicitly set the net/http/cgi and net/http/fcgi packages would default to “text/html”, which could cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response. Impact ====== A remote attacker is able to execute javascript or create html content by sending specially crafted web content. References ========== https://github.com/golang/go/issues/40928 https://www.redteam-pentesting.de/advisories/rt-sa-2020-004 https://groups.google.com/g/golang-announce/c/8wqlSbkLdPs/m/UccMwBPUBAAJ https://github.com/golang/go/commit/eb07103a083237414145a45f029c873d57037e06 https://security.archlinux.org/CVE-2020-24553

1 0

[ASA-202009-2] ark: arbitrary filesystem access
by Morten Linderud 09 Sep '20

09 Sep '20

Arch Linux Security Advisory ASA-202009-2 ========================================= Severity: High Date : 2020-09-03 CVE-ID : CVE-2020-24654 Package : ark Type : arbitrary filesystem access Remote : No Link : https://security.archlinux.org/AVG-1216 Summary ======= The package ark before version 20.08.0-2 is vulnerable to arbitrary filesystem access. Resolution ========== Upgrade to 20.08.0-2. # pacman -Syu "ark>=20.08.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory. Impact ====== An attacker can overwrite local files by tricking a legitimate user into extracting a specially crafted TAR archive. References ========== https://kde.org/info/security/advisory-20200827-1.txt https://invent.kde.org/utilities/ark/-/commit/8bf8c5ef07b0ac5e914d752681e47… https://security.archlinux.org/CVE-2020-24654

1 0

[ASA-202009-1] opendmarc: denial of service
by Morten Linderud 09 Sep '20

09 Sep '20

Arch Linux Security Advisory ASA-202009-1 ========================================= Severity: Medium Date : 2020-09-01 CVE-ID : CVE-2020-12460 Package : opendmarc Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1208 Summary ======= The package opendmarc before version 1.3.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.3.3-1. # pacman -Syu "opendmarc>=1.3.3-1" The problem has been fixed upstream in version 1.3.3. Workaround ========== None. Description =========== OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag. Impact ====== A remote attacker might be able to cause a denial of service or possibly execute arbitrary code. References ========== https://github.com/trusteddomainproject/OpenDMARC/issues/64 https://security.archlinux.org/CVE-2020-12460

1 0

[ASA-202007-6] libjcat: insufficient validation
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-6 ========================================= Severity: High Date : 2020-07-31 CVE-ID : CVE-2020-10759 Package : libjcat Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1185 Summary ======= The package libjcat before version 0.1.3-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 0.1.3-1. # pacman -Syu "libjcat>=0.1.3-1" The problem has been fixed upstream in version 0.1.3. Workaround ========== None. Description =========== A PGP signature verification bypass has been found in fwupd prior to 1.4.0, and in libjcat <= 0.1.2. The issue is that if a detached signature is actually a PGP message, gpgme_op_verify() returns the rather perplexing GPG_ERR_NO_ERROR, and then gpgme_op_verify_result() builds an empty list. Impact ====== A local attacker could pass signature validation with a crafted message. References ========== https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_… https://github.com/hughsie/libjcat/commit/839b89f https://security.archlinux.org/CVE-2020-10759

1 0