- Arch-security - lists.archlinux.org

[ASA-202006-1] firefox: multiple issues
by Morten Linderud 09 Jun '20

09 Jun '20

Arch Linux Security Advisory ASA-202006-1 ========================================= Severity: High Date : 2020-06-02 CVE-ID : CVE-2020-12399 CVE-2020-12405 CVE-2020-12406 CVE-2020-12407 CVE-2020-12408 CVE-2020-12409 CVE-2020-12410 CVE-2020-12411 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1173 Summary ======= The package firefox before version 77.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, private key recovery and content spoofing. Resolution ========== Upgrade to 77.0-1. # pacman -Syu "firefox>=77.0-1" The problems have been fixed upstream in version 77.0. Workaround ========== None. Description =========== - CVE-2020-12399 (private key recovery) NSS before 3.52.1, as used in Firefox before 77.0 and Thunderbird before 68.9.0, has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. - CVE-2020-12405 (denial of service) When browsing a malicious page in Firefox before 77.0 and Thunderbird before 68.9.0, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. - CVE-2020-12406 (arbitrary code execution) Mozilla Developer Iain Ireland discovered a missing type check in Firefox before 77.0 and Thunderbird before 68.9.0 during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. - CVE-2020-12407 (denial of service) Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visible screen. The leaked memory content was visible to the user, but not observable from web content. - CVE-2020-12408 (content spoofing) When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. - CVE-2020-12409 (content spoofing) When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. - CVE-2020-12410 (arbitrary code execution) Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 76, Firefox ESR 68.8 and Thunderbird before 68.9.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-12411 (arbitrary code execution) Mozilla developers :Gijs (he/him), Randell Jesup reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to recover private keys, spoof content, execute arbitrary code or crash the application. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-20/ https://bugzilla.mozilla.org/show_bug.cgi?id=1631576 https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429… https://bugzilla.mozilla.org/show_bug.cgi?id=1631618 https://bugzilla.mozilla.org/show_bug.cgi?id=1639590 https://bugzilla.mozilla.org/show_bug.cgi?id=1637112 https://bugzilla.mozilla.org/show_bug.cgi?id=1623888 https://bugzilla.mozilla.org/show_bug.cgi?id=1629506 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717 https://bugzilla.mozilla.org/show_bug.cgi?id=1506173 https://security.archlinux.org/CVE-2020-12399 https://security.archlinux.org/CVE-2020-12405 https://security.archlinux.org/CVE-2020-12406 https://security.archlinux.org/CVE-2020-12407 https://security.archlinux.org/CVE-2020-12408 https://security.archlinux.org/CVE-2020-12409 https://security.archlinux.org/CVE-2020-12410 https://security.archlinux.org/CVE-2020-12411

1 0

[ASA-202005-16] freerdp: information disclosure
by Morten Linderud 01 Jun '20

01 Jun '20

Arch Linux Security Advisory ASA-202005-16 ========================================== Severity: High Date : 2020-05-23 CVE-ID : CVE-2020-13396 CVE-2020-13397 CVE-2020-13398 Package : freerdp Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1172 Summary ======= The package freerdp before version 2:2.1.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2:2.1.1-1. # pacman -Syu "freerdp>=2:2.1.1-1" The problems have been fixed upstream in version 2.1.1. Workaround ========== None. Description =========== - CVE-2020-13396 (information disclosure) An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. - CVE-2020-13397 (information disclosure) An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value. - CVE-2020-13398 (information disclosure) An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. Impact ====== A local malicious user can send crafted network traffic and leak information from the host. References ========== https://github.com/FreeRDP/FreeRDP/commit/48361c411e50826cb602c7aab773a8a20… https://github.com/FreeRDP/FreeRDP/commit/8fb6336a4072abcee8ce5bd6ae9110462… https://github.com/FreeRDP/FreeRDP/commit/d6cd14059b257318f176c0ba3ee0a3488… https://github.com/FreeRDP/FreeRDP/commit/8305349a943c68b1bc8c158f431dc6076… https://security.archlinux.org/CVE-2020-13396 https://security.archlinux.org/CVE-2020-13397 https://security.archlinux.org/CVE-2020-13398

1 0

[ASA-202005-15] ant: arbitrary command execution
by Morten Linderud 01 Jun '20

01 Jun '20

Arch Linux Security Advisory ASA-202005-15 ========================================== Severity: Medium Date : 2020-05-20 CVE-ID : CVE-2020-1945 Package : ant Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-1159 Summary ======= The package ant before version 1.10.8-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 1.10.8-1. # pacman -Syu "ant>=1.10.8-1" The problem has been fixed upstream in version 1.10.8. Workaround ========== None. Description =========== Apache Ant uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process. Impact ====== A local malicious user can inject code into the ant build process. References ========== https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78… https://security.archlinux.org/CVE-2020-1945

1 0

[ASA-202005-14] unbound: denial of service
by Morten Linderud 01 Jun '20

01 Jun '20

Arch Linux Security Advisory ASA-202005-14 ========================================== Severity: High Date : 2020-05-20 CVE-ID : CVE-2020-12662 CVE-2020-12663 Package : unbound Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1164 Summary ======= The package unbound before version 1.10.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.10.1-1. # pacman -Syu "unbound>=1.10.1-1" The problems have been fixed upstream in version 1.10.1. Workaround ========== None. Description =========== - CVE-2020-12662 (denial of service) An issue has been found in unbound before 1.10.1, that makes it possible to have a single incoming query result in a large number of outgoing queries. This amplification makes it possible for Unbound to be used in a denial of service attack. The researchers discovering this called this attack the NXNSattack.This attack makes use of cache bypassing using random subdomains in the NSDNAME in NS records. When these delegation records are received during iteration, and the answer does not contain glue records, a resolver has to send out a query to the get the IP address for one of the names. When this query fails (for example because the random name does not exist) a resolver will try the next one. A large set of NS records with random names can result in a large number of outgoing queries going to the same target. - CVE-2020-12663 (denial of service) A security issue has been found in Unbound before 1.1.0.1, in the parser of received answers. Malformed answers received from upstream servers can result in Unbound entering an infinite loop and thereby becoming unresponsive. Impact ====== A remote attacker can use the recursor has an amplification vector to cause a denial of service via a crafted reply. In addition, a remote attacker can crash the application via a crafted request. References ========== https://nlnetlabs.nl/projects/unbound/security-advisories/ https://nlnetlabs.nl/downloads/unbound/patch_cve_2020-12662_2020-12663.diff http://www.nxnsattack.com/ https://security.archlinux.org/CVE-2020-12662 https://security.archlinux.org/CVE-2020-12663

1 0

[ASA-202005-13] bind: denial of service
by Morten Linderud 01 Jun '20

01 Jun '20

Arch Linux Security Advisory ASA-202005-13 ========================================== Severity: High Date : 2020-05-20 CVE-ID : CVE-2020-8616 CVE-2020-8617 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1165 Summary ======= The package bind before version 9.16.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.16.3-1. # pacman -Syu "bind>=9.16.3-1" The problems have been fixed upstream in version 9.16.3. Workaround ========== None. Description =========== - CVE-2020-8616 (denial of service) An issue has been found in bind before 9.16.3, which does not sufficiently limit the number of fetches which may be performed while processing a referral response. A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: the performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and the attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor. - CVE-2020-8617 (denial of service) An error in bind before 9.16.3 in the code which checks the validity of messages containing TSIG resource records can be exploited by an attacker to trigger an assertion failure in tsig.c, resulting in denial of service to clients. Impact ====== A remote attacker can use the recursor has an amplification vector to cause a denial of service via a crafted reply. In addition, a remote attacker can crash the application by guessing the TSIG key name. References ========== https://kb.isc.org/docs/cve-2020-8616 https://kb.isc.org/docs/cve-2020-8617 https://kb.isc.org/docs/cve-2020-8617-faq-and-supplemental-information http://www.nxnsattack.com/ https://security.archlinux.org/CVE-2020-8616 https://security.archlinux.org/CVE-2020-8617

1 0

[ASA-202005-12] chromium: multiple issues
by Morten Linderud 23 May '20

23 May '20

Arch Linux Security Advisory ASA-202005-12 ========================================== Severity: High Date : 2020-05-20 CVE-ID : CVE-2020-6465 CVE-2020-6466 CVE-2020-6467 CVE-2020-6468 CVE-2020-6469 CVE-2020-6470 CVE-2020-6471 CVE-2020-6472 CVE-2020-6473 CVE-2020-6474 CVE-2020-6475 CVE-2020-6476 CVE-2020-6477 CVE-2020-6478 CVE-2020-6479 CVE-2020-6480 CVE-2020-6481 CVE-2020-6482 CVE-2020-6483 CVE-2020-6484 CVE-2020-6485 CVE-2020-6486 CVE-2020-6487 CVE-2020-6488 CVE-2020-6489 CVE-2020-6490 CVE-2020-6491 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1167 Summary ======= The package chromium before version 83.0.4103.61-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, content spoofing and insufficient validation. Resolution ========== Upgrade to 83.0.4103.61-1. # pacman -Syu "chromium>=83.0.4103.61-1" The problems have been fixed upstream in version 83.0.4103.61. Workaround ========== None. Description =========== - CVE-2020-6465 (arbitrary code execution) A use-after-free security issue has been found in the reader mode of the chromium browser before 83.0.4103.61 - CVE-2020-6466 (arbitrary code execution) A use-after-free security issue has been found in the media component of the chromium browser before 83.0.4103.61. - CVE-2020-6467 (arbitrary code execution) A use-after-free security issue has been found in the WebRTC component of the chromium browser before 83.0.4103.61 - CVE-2020-6468 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the chromium browser before 83.0.4103.61. - CVE-2020-6469 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6470 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the clipboard component of the chromium browser before 83.0.4103.61 - CVE-2020-6471 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6472 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6473 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Blink component of the chromium browser before 83.0.4103.61. - CVE-2020-6474 (arbitrary code execution) A use-after-free security issue has been found in the Blink component of the chromium browser before 83.0.4103.61. - CVE-2020-6475 (content spoofing) An incorrect security UI security issue has been found in the full screen component of the chromium browser before 83.0.4103.61. - CVE-2020-6476 (access restriction bypass) An insufficient policy enforcement security issue has been found in the tab strip component of the chromium browser before 83.0.4103.61. - CVE-2020-6477 (access restriction bypass) An inappropriate implementation security issue has been found in the installer component of the chromium browser before 83.0.4103.61. - CVE-2020-6478 (access restriction bypass) An inappropriate implementation security issue has been found in the full screen component of the chromium browser before 83.0.4103.61. - CVE-2020-6479 (access restriction bypass) An inappropriate implementation security issue has been found in the sharing component of the chromium browser before 83.0.4103.61. - CVE-2020-6480 (access restriction bypass) An insufficient policy enforcement security issue has been found in the enterprise component of the chromium browser before 83.0.4103.61. - CVE-2020-6481 (access restriction bypass) An insufficient policy enforcement security issue has been found in the URL formatting component of the chromium browser before 83.0.4103.61. - CVE-2020-6482 (access restriction bypass) An insufficient policy enforcement security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6483 (access restriction bypass) An insufficient policy enforcement security issue has been found in the payments component of the chromium browser before 83.0.4103.61. - CVE-2020-6484 (insufficient validation) An insufficient data validation security issue has been found in the ChromeDriver component of the chromium browser before 83.0.4103.61. - CVE-2020-6485 (insufficient validation) An insufficient data validation security issue has been found in the media router component of the chromium browser before 83.0.4103.61. - CVE-2020-6486 (access restriction bypass) An insufficient policy enforcement security issue has been found in the navigations component of the chromium browser before 83.0.4103.61. - CVE-2020-6487 (access restriction bypass) A insufficient policy enforcement security issue has been found in the downloads component of the chromium browser before 83.0.4103.61. - CVE-2020-6488 (access restriction bypass) An insufficient policy enforcement security issue has been found in the downloads component of the chromium browser before 83.0.4103.61. - CVE-2020-6489 (access restriction bypass) An inappropriate implementation security issue has been found in the developer tools component of the chromium browser before 83.0.4103.61. - CVE-2020-6490 (insufficient validation) An insufficient data validation security issue has been found in the loader component of the chromium browser before 83.0.4103.61. - CVE-2020-6491 (content spoofing) A incorrect security UI security issue has been found in the site information component of the chromium browser before 83.0.4103.61. Impact ====== A remote attacker might be able to spoof content, bypass security restrictions or validations checks, or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-des… https://crbug.com/1073015 https://crbug.com/1074706 https://crbug.com/1068084 https://crbug.com/1076708 https://crbug.com/1067382 https://crbug.com/1065761 https://crbug.com/1059577 https://crbug.com/1064519 https://crbug.com/1049510 https://crbug.com/1059533 https://crbug.com/1020026 https://crbug.com/1035315 https://crbug.com/946156 https://crbug.com/1037730 https://crbug.com/1041749 https://crbug.com/1054966 https://crbug.com/1068531 https://crbug.com/795595 https://crbug.com/966507 https://crbug.com/1045787 https://crbug.com/1047285 https://crbug.com/1055524 https://crbug.com/539938 https://crbug.com/1044277 https://crbug.com/1050756 https://crbug.com/1035887 https://crbug.com/1050011 https://security.archlinux.org/CVE-2020-6465 https://security.archlinux.org/CVE-2020-6466 https://security.archlinux.org/CVE-2020-6467 https://security.archlinux.org/CVE-2020-6468 https://security.archlinux.org/CVE-2020-6469 https://security.archlinux.org/CVE-2020-6470 https://security.archlinux.org/CVE-2020-6471 https://security.archlinux.org/CVE-2020-6472 https://security.archlinux.org/CVE-2020-6473 https://security.archlinux.org/CVE-2020-6474 https://security.archlinux.org/CVE-2020-6475 https://security.archlinux.org/CVE-2020-6476 https://security.archlinux.org/CVE-2020-6477 https://security.archlinux.org/CVE-2020-6478 https://security.archlinux.org/CVE-2020-6479 https://security.archlinux.org/CVE-2020-6480 https://security.archlinux.org/CVE-2020-6481 https://security.archlinux.org/CVE-2020-6482 https://security.archlinux.org/CVE-2020-6483 https://security.archlinux.org/CVE-2020-6484 https://security.archlinux.org/CVE-2020-6485 https://security.archlinux.org/CVE-2020-6486 https://security.archlinux.org/CVE-2020-6487 https://security.archlinux.org/CVE-2020-6488 https://security.archlinux.org/CVE-2020-6489 https://security.archlinux.org/CVE-2020-6490 https://security.archlinux.org/CVE-2020-6491

1 0

[ASA-202005-11] openconnect: arbitrary code execution
by Morten Linderud 23 May '20

23 May '20

Arch Linux Security Advisory ASA-202005-11 ========================================== Severity: Low Date : 2020-05-19 CVE-ID : CVE-2020-12823 Package : openconnect Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1157 Summary ======= The package openconnect before version 1:8.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:8.10-1. # pacman -Syu "openconnect>=1:8.10-1" The problem has been fixed upstream in version 8.10. Workaround ========== None. Description =========== OpenConnect 8.09 has a buffer overflow in get_cert_name in gnutls.c, causing a denial of service (application crash) or possibly unspecified other impact, via crafted data in a local certificate. Impact ====== An attacker can cause the application to crash, or possibly execute arbitrary code, by tricking a user into using a specially crafted certificate. References ========== https://gitlab.com/openconnect/openconnect/-/merge_requests/108 https://security.archlinux.org/CVE-2020-12823

1 0

[ASA-202005-10] powerdns-recursor: multiple issues
by Morten Linderud 23 May '20

23 May '20

Arch Linux Security Advisory ASA-202005-10 ========================================== Severity: Medium Date : 2020-05-19 CVE-ID : CVE-2020-10995 CVE-2020-12244 Package : powerdns-recursor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1163 Summary ======= The package powerdns-recursor before version 4.2.2-1 is vulnerable to multiple issues including denial of service and insufficient validation. Resolution ========== Upgrade to 4.2.2-1. # pacman -Syu "powerdns-recursor>=4.2.2-1" The problems have been fixed upstream in version 4.2.2. Workaround ========== None. Description =========== - CVE-2020-10995 (denial of service) An issue has been found in PowerDNS Recursor before 4.3.1 and 4.2.2. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. The effect was already limited in PowerDNS Recursor because of existing mitigations, but additional mitigations relative to this specific attack have been added. - CVE-2020-12244 (insufficient validation) An issue has been found in PowerDNS Recursor before 4.3.1 and 4.2.2 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer. This would allow an attacker in position of man-in-the-middle to send a NXDOMAIN answer for a name that does exist, bypassing DNSSEC validation. Impact ====== A remote attacker can use the recursor has an amplification vector to cause a denial of service via a crafted reply. In addition, a remote attacker in position of man-in-the-middle can bypass DNSSEC validation via a crafted reply. References ========== https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://github.com/PowerDNS/pdns/commit/86f95f85295696c0b264455472b8e270fcc… http://www.nxnsattack.com/ https://github.com/PowerDNS/pdns/commit/4bba0ec04aacbec08fe585ad790e2e8e0cb… https://security.archlinux.org/CVE-2020-10995 https://security.archlinux.org/CVE-2020-12244

1 0

[ASA-202005-9] dovecot: multiple issues
by Morten Linderud 23 May '20

23 May '20

Arch Linux Security Advisory ASA-202005-9 ========================================= Severity: High Date : 2020-05-19 CVE-ID : CVE-2020-10957 CVE-2020-10958 CVE-2020-10967 Package : dovecot Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1162 Summary ======= The package dovecot before version 2.3.10.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.3.10.1-1. # pacman -Syu "dovecot>=2.3.10.1-1" The problems have been fixed upstream in version 2.3.10.1. Workaround ========== None. Description =========== - CVE-2020-10957 (denial of service) A NULL-pointer dereference issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. A client can crash the server by sending a NOOP command with an invalid string parameter. This occurs particularly for a parameter that doesn't start with a double quote. This applies to all SMTP services, including submission-login, which makes it possible to crash the submission service without authentication. - CVE-2020-10958 (arbitrary code execution) A security issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. Sending many invalid or unknown commands can cause the server to access freed memory, which can lead to a server crash. This happens when the server closes the connection with a "421 Too many invalid commands" error. The bad command limit depends on the service (lmtp or submission) and varies between 10 to 20 bad commands. - CVE-2020-10967 (denial of service) A security issue has been found in Dovecot before 2.3.10.1 in the lmtp/submission component. An authenticated attacker could send an e-mail via the submission service with empty quoted localpart which would cause the submission or lmtp component to crash. An unauthenticated attacker could send an e-mail with a bad sender or recipient address, causing the e-mail to be passed to LMTP for delivery and then crash the LMTP component unless some kind of filtering has been set up on the MTA level. Impact ====== A remote, unauthenticated attacker can crash the server, causing a denial of service. Under certain circumstances it might be possible for a remote attacker to execute arbitrary code on the affected host. References ========== https://dovecot.org/pipermail/dovecot-news/2020-May/000437.html https://dovecot.org/pipermail/dovecot-news/2020-May/000438.html https://github.com/dovecot/core/commit/d143ca6b7ee1196ae3eafffbf6dee71a95a5… https://github.com/dovecot/core/commit/606724bd528b92347dce580d3ab48fc1e3c2… https://github.com/dovecot/core/commit/aedb205c79395de77127fb7166b29b09319d… https://github.com/dovecot/core/commit/874817b169d19a4ae51d80ad5798a396bfe9… https://github.com/dovecot/core/commit/5efeccc10beccbf8d7700adec1278f97d416… https://github.com/dovecot/core/commit/2b4f1e47a4ca8a192bf3f7e944c0ad07b21b… https://github.com/dovecot/core/commit/563bf21d8228a3c06c63b3f289a90ca3d0c5… https://github.com/dovecot/core/commit/18d5837748d3eafe56e080653d5ed0b3e221… https://github.com/dovecot/core/commit/063462d588eaea6f266596fae5f5470792dc… https://github.com/dovecot/core/commit/b34002a4ca301ed94cd944ee3504287ed7e5… https://github.com/dovecot/core/commit/92d9690da195b6ceaa878ab1df6c7c31a75f… https://github.com/dovecot/core/commit/cbab48f174580bfb8d49321d8d336f96a231… https://security.archlinux.org/CVE-2020-10957 https://security.archlinux.org/CVE-2020-10958 https://security.archlinux.org/CVE-2020-10967

1 0

[ASA-202005-8] keycloak: arbitrary code execution
by Remi Gacogne 20 May '20

20 May '20

Arch Linux Security Advisory ASA-202005-8 ========================================= Severity: High Date : 2020-05-16 CVE-ID : CVE-2020-1714 Package : keycloak Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1158 Summary ======= The package keycloak before version 10.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 10.0.1-1. # pacman -Syu "keycloak>=10.0.1-1" The problem has been fixed upstream in version 10.0.1. Workaround ========== None. Description =========== A flaw was found in Keycloak, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution. Impact ====== An authenticated remote attacker could execute arbitrary code by injecting values into a custom attribute. References ========== https://bugs.archlinux.org/task/66642 https://github.com/keycloak/keycloak/pull/7053 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714 https://security.archlinux.org/CVE-2020-1714

1 0