- Arch-security - lists.archlinux.org

[ASA-202009-1] opendmarc: denial of service
by Morten Linderud 09 Sep '20

09 Sep '20

Arch Linux Security Advisory ASA-202009-1 ========================================= Severity: Medium Date : 2020-09-01 CVE-ID : CVE-2020-12460 Package : opendmarc Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1208 Summary ======= The package opendmarc before version 1.3.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.3.3-1. # pacman -Syu "opendmarc>=1.3.3-1" The problem has been fixed upstream in version 1.3.3. Workaround ========== None. Description =========== OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag. Impact ====== A remote attacker might be able to cause a denial of service or possibly execute arbitrary code. References ========== https://github.com/trusteddomainproject/OpenDMARC/issues/64 https://security.archlinux.org/CVE-2020-12460

1 0

[ASA-202007-6] libjcat: insufficient validation
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-6 ========================================= Severity: High Date : 2020-07-31 CVE-ID : CVE-2020-10759 Package : libjcat Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-1185 Summary ======= The package libjcat before version 0.1.3-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 0.1.3-1. # pacman -Syu "libjcat>=0.1.3-1" The problem has been fixed upstream in version 0.1.3. Workaround ========== None. Description =========== A PGP signature verification bypass has been found in fwupd prior to 1.4.0, and in libjcat <= 0.1.2. The issue is that if a detached signature is actually a PGP message, gpgme_op_verify() returns the rather perplexing GPG_ERR_NO_ERROR, and then gpgme_op_verify_result() builds an empty list. Impact ====== A local attacker could pass signature validation with a crafted message. References ========== https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_… https://github.com/hughsie/libjcat/commit/839b89f https://security.archlinux.org/CVE-2020-10759

1 0

[ASA-202007-5] mbedtls: private key recovery
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-5 ========================================= Severity: Medium Date : 2020-07-31 CVE-ID : CVE-2020-10932 Package : mbedtls Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-1141 Summary ======= The package mbedtls before version 2.16.7-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 2.16.7-1. # pacman -Syu "mbedtls>=2.16.7-1" The problem has been fixed upstream in version 2.16.7. Workaround ========== None. Description =========== A side channel attack has been found on the ECDSA implementation of Mbed TLS before 2.22.0, 2.16.6 and 2.7.15, allowing a local attacker with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to fully recover an ECDSA private key after observing a number of signature operations. Impact ====== A remote attacker is able to recover an ECDSA private key. References ========== https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advi… https://security.archlinux.org/CVE-2020-10932

1 0

[ASA-202007-4] ffmpeg: arbitrary code execution
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-4 ========================================= Severity: High Date : 2020-07-31 CVE-ID : CVE-2020-13904 Package : ffmpeg Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1180 Summary ======= The package ffmpeg before version 2:4.3.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2:4.3.1-1. # pacman -Syu "ffmpeg>=2:4.3.1-1" The problem has been fixed upstream in version 4.3.1. Workaround ========== None. Description =========== A use-after-free via a crafted EXTINF duration in an m3u8 file has been found in ffmpeg <= 4.2.3, because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c Impact ====== An attacker can execute arbitrary code on the affected host via crafted multimedia content. References ========== https://trac.ffmpeg.org/ticket/8673 https://patchwork.ffmpeg.org/project/ffmpeg/patch/20200529033905.41926-1-lq… https://security.archlinux.org/CVE-2020-13904

1 0

[ASA-202007-3] tcpreplay: information disclosure
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-3 ========================================= Severity: Medium Date : 2020-07-31 CVE-ID : CVE-2020-12740 Package : tcpreplay Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1154 Summary ======= The package tcpreplay before version 4.3.3-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 4.3.3-1. # pacman -Syu "tcpreplay>=4.3.3-1" The problem has been fixed upstream in version 4.3.3. Workaround ========== None. Description =========== tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ipv6_next() at common/get.c. Impact ====== A remote attacker is able to disclose information on the affected host with a crafted pcap file. References ========== https://github.com/appneta/tcpreplay/issues/576 https://security.archlinux.org/CVE-2020-12740

1 0

[ASA-202007-2] wireshark-cli: denial of service
by Morten Linderud 31 Jul '20

31 Jul '20

Arch Linux Security Advisory ASA-202007-2 ========================================= Severity: Low Date : 2020-07-18 CVE-ID : CVE-2020-15466 Package : wireshark-cli Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1198 Summary ======= The package wireshark-cli before version 3.2.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.2.5-1. # pacman -Syu "wireshark-cli>=3.2.5-1" The problem has been fixed upstream in version 3.2.5. Workaround ========== None. Description =========== An infinite loop has been found in the GVCP dissector of Wireshark before 3.2.5. It may be possible to make Wireshark consume excessive CPU resources by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker is able use specially crafted packets to perform a denial of service attack. References ========== https://www.wireshark.org/security/wnpa-sec-2020-09 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16029 https://code.wireshark.org/review/#/c/37618/ https://security.archlinux.org/CVE-2020-15466

1 0

[ASA-202007-1] webkit2gtk: multiple issues
by Morten Linderud 29 Jul '20

29 Jul '20

Arch Linux Security Advisory ASA-202007-1 ========================================= Severity: Critical Date : 2020-07-14 CVE-ID : CVE-2020-9802 CVE-2020-9803 CVE-2020-9805 CVE-2020-9806 CVE-2020-9807 CVE-2020-9843 CVE-2020-9850 CVE-2020-13753 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1203 Summary ======= The package webkit2gtk before version 2.28.3-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting and sandbox escape. Resolution ========== Upgrade to 2.28.3-1. # pacman -Syu "webkit2gtk>=2.28.3-1" The problems have been fixed upstream in version 2.28.3. Workaround ========== None. Description =========== - CVE-2020-9802 (arbitrary code execution) A memory corruption issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-9803 (arbitrary code execution) A memory corruption issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-9805 (cross-site scripting) A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2020-9806 (arbitrary code execution) A memory corruption issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-9807 (arbitrary code execution) A memory corruption issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-9843 (cross-site scripting) An issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, where processing maliciously crafted web content may lead to a cross site scripting attack. - CVE-2020-9850 (arbitrary code execution) A logic issue has been found in WebKitGTK before 2.28.3 and WPE WebKit before 2.2.8.3, allowing a remote attacker to execute arbitrary code. - CVE-2020-13753 (sandbox escape) The bubblewrap sandbox of WebKitGTK and WPE WebKit, prior to 2.28.3, failed to properly block access to CLONE_NEWUSER and the TIOCSTI ioctl. CLONE_NEWUSER could potentially be used to confuse xdg- desktop-portal, which allows access outside the sandbox. TIOCSTI can be used to directly execute commands outside the sandbox by writing to the controlling terminal’s input buffer, similar to CVE-2017-5226. Impact ====== A remote attacker might be able to trigger cross-site scripting, bypass the sandbox and execute arbitrary code on the affected host. References ========== https://webkitgtk.org/security/WSA-2020-0006.html https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9802 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9803 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9805 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9806 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9807 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9843 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-9850 https://webkitgtk.org/security/WSA-2020-0006.html#CVE-2020-13753 https://security.archlinux.org/CVE-2020-9802 https://security.archlinux.org/CVE-2020-9803 https://security.archlinux.org/CVE-2020-9805 https://security.archlinux.org/CVE-2020-9806 https://security.archlinux.org/CVE-2020-9807 https://security.archlinux.org/CVE-2020-9843 https://security.archlinux.org/CVE-2020-9850 https://security.archlinux.org/CVE-2020-13753

1 0

[ASA-202006-16] tomcat8: denial of service
by Morten Linderud 30 Jun '20

30 Jun '20

Arch Linux Security Advisory ASA-202006-16 ========================================== Severity: Medium Date : 2020-06-28 CVE-ID : CVE-2020-11996 Package : tomcat8 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1197 Summary ======= The package tomcat8 before version 8.5.56-1 is vulnerable to denial of service. Resolution ========== Upgrade to 8.5.56-1. # pacman -Syu "tomcat8>=8.5.56-1" The problem has been fixed upstream in version 8.5.56. Workaround ========== None. Description =========== A denial of service has been found in Apache Tomcat before 9.0.36 and 8.5.56, where a specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. Impact ====== A remote attacker might be able to cause a denial of service via a specially crafted sequence of HTTP/2 requests. References ========== https://www.openwall.com/lists/oss-security/2020/06/25/6 https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.36 https://github.com/apache/tomcat/commit/9a0231683a77e2957cea0fdee88b193b30b… https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.56 https://github.com/apache/tomcat/commit/c8acd2ab7371e39aeca7c306f3b5380f00a… https://security.archlinux.org/CVE-2020-11996

1 0

[ASA-202006-15] freerdp: multiple issues
by Morten Linderud 30 Jun '20

30 Jun '20

Arch Linux Security Advisory ASA-202006-15 ========================================== Severity: High Date : 2020-06-28 CVE-ID : CVE-2020-4030 CVE-2020-4031 CVE-2020-4032 CVE-2020-4033 CVE-2020-11095 CVE-2020-11096 CVE-2020-11097 CVE-2020-11098 CVE-2020-11099 Package : freerdp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1193 Summary ======= The package freerdp before version 2:2.1.2-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 2:2.1.2-1. # pacman -Syu "freerdp>=2:2.1.2-1" The problems have been fixed upstream in version 2.1.2. Workaround ========== None. Description =========== - CVE-2020-4030 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, where logging might bypass string length checks due to an integer overflow. - CVE-2020-4031 (arbitrary code execution) A use-after-free vulnerability has been found in FreeRDP before 2.1.2, in gdi_SelectObject(). Clients using compatibility mode enabled with /relax-order-checks are affected. - CVE-2020-4032 (information disclosure) An integer casting vulnerability leading to an out-of-bounds read has been found in FreeRDP before 2.1.2, in update_recv_secondary_order(), on clients with +glyph-cache or /relax-order-checks options enabled. - CVE-2020-4033 (information disclosure) An out-of-bounds read of up to 4 bytes has been found in FreeRDP before 2.1.2, affecting all FreeRDP based clients with sessions with color depth < 32. - CVE-2020-11095 (information disclosure) A global out-of-bounds read has been found in FreeRDP before 2.1.2, in update_recv_primary_order. - CVE-2020-11096 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, in update_read_cache_bitmap_v3_order(). - CVE-2020-11097 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, in ntlm_av_pair_get(). - CVE-2020-11098 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, in glyph_cache_put. This issue only exists when glyph-cache is enabled, which is not the case by default. - CVE-2020-11099 (information disclosure) An out-of-bounds read has been found in FreeRDP before 2.1.2, in license_read_new_or_upgrade_license_packet(). Impact ====== A remote attacker might be able to access sensitive information or crash the application via a crafted RDP session. A malicious server, or an attacker in position of man-in-the-middle might be able to execute arbitrary code on the affected host. References ========== http://www.freerdp.com/2020/06/22/2_1_2-released https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fjr5-97f5-qq98 https://github.com/FreeRDP/FreeRDP/commit/05cd9ea2290d23931f615c1b004d4b2e6… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74g https://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3898-mc89-x2vc https://github.com/FreeRDP/FreeRDP/commit/e7bffa64ef5ed70bac94f823e2b952626… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-7rhj-856w-82p8 https://github.com/FreeRDP/FreeRDP/commit/0a98c450c58ec150e44781c89aa6f8e7e… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-563r-pvh7-4fw2 https://github.com/FreeRDP/FreeRDP/commit/733ee3208306b1ea32697b356c0215180… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mjw7-3mq2-996x https://github.com/FreeRDP/FreeRDP/commit/b8beb55913471952f92770c90c372139d… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c8x2-c3c9-9r3f https://github.com/FreeRDP/FreeRDP/commit/58a3122250d54de3a944c487776bcd4d1… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jr57-f58x-hjmv https://github.com/FreeRDP/FreeRDP/commit/c0fd449ec0870b050d350d6d844b1ea6d… https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-977w-866x-4v5h https://github.com/FreeRDP/FreeRDP/commit/6ade7b4cbfd71c54b3d724e8f2d6ac76a… https://security.archlinux.org/CVE-2020-4030 https://security.archlinux.org/CVE-2020-4031 https://security.archlinux.org/CVE-2020-4032 https://security.archlinux.org/CVE-2020-4033 https://security.archlinux.org/CVE-2020-11095 https://security.archlinux.org/CVE-2020-11096 https://security.archlinux.org/CVE-2020-11097 https://security.archlinux.org/CVE-2020-11098 https://security.archlinux.org/CVE-2020-11099

1 0

[ASA-202006-14] imagemagick: information disclosure
by Morten Linderud 30 Jun '20

30 Jun '20

Arch Linux Security Advisory ASA-202006-14 ========================================== Severity: Medium Date : 2020-06-28 CVE-ID : CVE-2020-13902 Package : imagemagick Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1181 Summary ======= The package imagemagick before version 7.0.10.20-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 7.0.10.20-1. # pacman -Syu "imagemagick>=7.0.10.20-1" The problem has been fixed upstream in version 7.0.10.20. Workaround ========== None. Description =========== An out-of-bounds read has been found in the TIFF image decoding part of imagemagick <= 7.0.10-17, in BlobToStringInfo in MagickCore/string.c. Impact ====== A remote attacker might be able to access sensitive information or crash the application via a crafted TIFF file. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20920 https://github.com/ImageMagick/ImageMagick/discussions/2132 https://github.com/ImageMagick/ImageMagick/commit/824f344ceb823e156ad6e8531… https://security.archlinux.org/CVE-2020-13902

1 0