- Arch-security - lists.archlinux.org

[ASA-202005-7] thunderbird: multiple issues
by Remi Gacogne 20 May '20

20 May '20

Arch Linux Security Advisory ASA-202005-7 ========================================= Severity: Critical Date : 2020-05-09 CVE-ID : CVE-2020-6831 CVE-2020-12387 CVE-2020-12392 CVE-2020-12395 CVE-2020-12397 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1155 Summary ======= The package thunderbird before version 68.8.0-1 is vulnerable to multiple issues including arbitrary code execution and content spoofing. Resolution ========== Upgrade to 68.8.0-1. # pacman -Syu "thunderbird>=68.8.0-1" The problems have been fixed upstream in version 68.8.0. Workaround ========== None. Description =========== - CVE-2020-6831 (arbitrary code execution) A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC, in Firefox before 76.0, Thunderbird before 68.8.0 and chromium before 81.0.4044.138. This could have led to memory corruption and a potentially exploitable crash. - CVE-2020-12387 (arbitrary code execution) A race condition has been found in Firefox before 76.0 and Thunderbird before 68.8.0, when running shutdown code for Web Worker, leading to a use-after-free vulnerability. This results in a potentially exploitable crash. - CVE-2020-12392 (content spoofing) The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request in Firefox before 76.0 and Thunderbird before 68.8.0, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. - CVE-2020-12395 (arbitrary code execution) Several memory safety bugs has been found in Firefox before 76.0, Firefox ESR before 68.8 and Thunderbird before 68.8.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-12397 (content spoofing) An spoofing email address issue has been found in Thunderbird before 68.8.0. By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. Impact ====== A remote attacker can spoof an e-mail address and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/ https://bugzilla.mozilla.org/show_bug.cgi?id=1632241 https://crbug.com/1073602 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831 https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-6831 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1545345 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1614468 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704… https://www.mozilla.org/en-US/security/advisories/mfsa2020-18/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1617370 https://security.archlinux.org/CVE-2020-6831 https://security.archlinux.org/CVE-2020-12387 https://security.archlinux.org/CVE-2020-12392 https://security.archlinux.org/CVE-2020-12395 https://security.archlinux.org/CVE-2020-12397

1 0

[ASA-202005-6] qemu: multiple issues
by Remi Gacogne 20 May '20

20 May '20

Arch Linux Security Advisory ASA-202005-6 ========================================= Severity: High Date : 2020-05-07 CVE-ID : CVE-2019-20382 CVE-2020-1711 CVE-2020-7039 Package : qemu Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1110 Summary ======= The package qemu before version 5.0.0-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.0.0-1. # pacman -Syu "qemu>=5.0.0-1" The problems have been fixed upstream in version 5.0.0. Workaround ========== None. Description =========== - CVE-2019-20382 (denial of service) A memory leak has been found in in the way VNC display driver of QEMU <= 4.2.0 handled connection disconnect, when ZRLE, Tight encoding is enabled. It creates two vncState objects, one of which allocates memory for Zlib's data object. This allocated memory is not free'd upon disconnection resulting in the said memory leakage issue. A user able to connect to the VNC server could use this flaw to leak host memory leading to a potential DoS scenario. - CVE-2020-1711 (arbitrary code execution) An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. - CVE-2020-7039 (arbitrary code execution) A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcp_emu() routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process. Impact ====== A remote attacker can crash the QEMU process, and potentially execute arbitrary code on the host. References ========== https://www.openwall.com/lists/oss-security/2020/03/05/1 https://git.qemu.org/?p=qemu.git;a=commitdiff;h=6bf21f3d83e95bcc4ba35a7a07c… https://www.openwall.com/lists/oss-security/2020/01/23/3 https://www.openwall.com/lists/oss-security/2020/01/16/2 https://security.archlinux.org/CVE-2019-20382 https://security.archlinux.org/CVE-2020-1711 https://security.archlinux.org/CVE-2020-7039

1 0

[ASA-202005-5] qutebrowser: certificate verification bypass
by Morten Linderud 11 May '20

11 May '20

Arch Linux Security Advisory ASA-202005-5 ========================================= Severity: Low Date : 2020-05-07 CVE-ID : CVE-2020-11054 Package : qutebrowser Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-1152 Summary ======= The package qutebrowser before version 1.11.1-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 1.11.1-1. # pacman -Syu "qutebrowser>=1.11.1-1" The problem has been fixed upstream in version 1.11.1. Workaround ========== * Treat any host with a certificate exception as insecure, ignoring the URL color * Or set content.ssl_strict to True (instead of 'ask'), preventing certificate exceptions in the configuration Description =========== In qutebrowser before version 1.11.1 there is an issue where after a certificate error was overridden by the user, qutebrowser displays the URL as yellow (colors.statusbar.url.warn.fg). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (colors.statusbar.url.success_https). While the user already has seen a certificate error prompt at this point (or set content.ssl_strict to false which is not recommended), this could still provide a false sense of security. Impact ====== The user might think the webpage is secure, when in reality it has an invalid certificate. References ========== https://github.com/qutebrowser/qutebrowser/commit/6821c236f9ae23adf21d46ce0… https://github.com/qutebrowser/qutebrowser/commit/556fe81b3146e5cd2e77df9d8… https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-4rcq-jv… https://security.archlinux.org/CVE-2020-11054

1 0

[ASA-202005-4] a2ps: multiple issues
by Morten Linderud 11 May '20

11 May '20

Arch Linux Security Advisory ASA-202005-4 ========================================= Severity: High Date : 2020-05-06 CVE-ID : CVE-2014-0466 CVE-2015-8107 Package : a2ps Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1150 Summary ======= The package a2ps before version 4.14-9 is vulnerable to multiple issues including arbitrary command execution and arbitrary code execution. Resolution ========== Upgrade to 4.14-9. # pacman -Syu "a2ps>=4.14-9" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2014-0466 (arbitrary command execution) The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file. - CVE-2015-8107 (arbitrary code execution) A format string vulnerability in GNU a2ps 4.14 allows remote attackers to execute arbitrary code. Impact ====== A remote attacker can send crafted Postscript files which can execute arbitrary commands or delete files from the system. References ========== https://github.com/akimd/a2ps/commit/5ea5ff8bc0094ca1eda0dd0e011d860e994c0a… https://github.com/akimd/a2ps/commit/90b876cb480ca9e092490c825663f23909c617… https://security.archlinux.org/CVE-2014-0466 https://security.archlinux.org/CVE-2015-8107

1 0

[ASA-202005-3] firefox: multiple issues
by Remi Gacogne 09 May '20

09 May '20

Arch Linux Security Advisory ASA-202005-3 ========================================= Severity: Critical Date : 2020-05-06 CVE-ID : CVE-2020-6831 CVE-2020-12387 CVE-2020-12390 CVE-2020-12391 CVE-2020-12392 CVE-2020-12394 CVE-2020-12395 CVE-2020-12396 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1148 Summary ======= The package firefox before version 76.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and insufficient validation. Resolution ========== Upgrade to 76.0-1. # pacman -Syu "firefox>=76.0-1" The problems have been fixed upstream in version 76.0. Workaround ========== None. Description =========== - CVE-2020-6831 (arbitrary code execution) A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC, in Firefox before 76.0 and chromium before 81.0.4044.138. This could have led to memory corruption and a potentially exploitable crash. - CVE-2020-12387 (arbitrary code execution) A race condition has been found in Firefox before 76.0, when running shutdown code for Web Worker, leading to a use-after-free vulnerability. This results in a potentially exploitable crash. - CVE-2020-12390 (insufficient validation) An incorrect origin serialization of URLs with IPv6 addresses issue has been found in Firefox before 76.0, and could lead to incorrect security checks. - CVE-2020-12391 (arbitrary code execution) Documents formed using data: URLs in an object element failed to inherit the CSP of the creating context in Firefox before 76.0. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. - CVE-2020-12392 (content spoofing) The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request in Firefox before 76.0, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. - CVE-2020-12394 (content spoofing) A logic flaw has been found in the location bar implementation of Firefox before 76.0, and could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element. - CVE-2020-12395 (arbitrary code execution) Several memory safety bugs has been found in Firefox before 76.0 and Firefox ESR before 68.8. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-12396 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 76.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to spoof content, bypass security checks and execute arbitrary code on the affected host. References ========== https://bugzilla.mozilla.org/show_bug.cgi?id=1632241 https://crbug.com/1073602 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1545345 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1141959 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1457100 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1614468 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/show_bug.cgi?id=1628288 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704… https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-123… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1339601%2C1611938%2C1620488… https://security.archlinux.org/CVE-2020-6831 https://security.archlinux.org/CVE-2020-12387 https://security.archlinux.org/CVE-2020-12390 https://security.archlinux.org/CVE-2020-12391 https://security.archlinux.org/CVE-2020-12392 https://security.archlinux.org/CVE-2020-12394 https://security.archlinux.org/CVE-2020-12395 https://security.archlinux.org/CVE-2020-12396

1 0

[ASA-202005-2] chromium: arbitrary code execution
by Remi Gacogne 09 May '20

09 May '20

Arch Linux Security Advisory ASA-202005-2 ========================================= Severity: High Date : 2020-05-06 CVE-ID : CVE-2020-6464 CVE-2020-6831 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1149 Summary ======= The package chromium before version 81.0.4044.138-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 81.0.4044.138-1. # pacman -Syu "chromium>=81.0.4044.138-1" The problems have been fixed upstream in version 81.0.4044.138. Workaround ========== None. Description =========== - CVE-2020-6464 (arbitrary code execution) A type confusion issue has been found in the Blink component of the chromium browser before 81.0.4044.138. - CVE-2020-6831 (arbitrary code execution) A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC, in Firefox before 76.0 and chromium before 81.0.4044.138. This could have led to memory corruption and a potentially exploitable crash. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/05/stable-channel-update-for-des… https://crbug.com/1071059 https://bugzilla.mozilla.org/show_bug.cgi?id=1632241 https://crbug.com/1073602 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831 https://security.archlinux.org/CVE-2020-6464 https://security.archlinux.org/CVE-2020-6831

1 0

[ASA-202005-1] salt: multiple issues
by Morten Linderud 05 May '20

05 May '20

Arch Linux Security Advisory ASA-202005-1 ========================================= Severity: Critical Date : 2020-05-05 CVE-ID : CVE-2020-11651 CVE-2020-11652 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1147 Summary ======= The package salt before version 2019.2.4-1 is vulnerable to multiple issues including arbitrary command execution and arbitrary filesystem access. Resolution ========== Upgrade to 2019.2.4-1. # pacman -Syu "salt>=2019.2.4-1" The problems have been fixed upstream in version 2019.2.4. Workaround ========== Do not expose salt-master to the internet. Description =========== - CVE-2020-11651 (arbitrary command execution) An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. - CVE-2020-11652 (arbitrary filesystem access) An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. Impact ====== A remote unauthenticated user can execute arbitrary commands and access files on the affected host. References ========== https://docs.saltstack.com/en/latest/topics/releases/2019.2.4.html https://github.com/saltstack/salt/blob/v3000.2_docs/doc/topics/releases/300… https://github.com/saltstack/salt/commit/a67d76b15615983d467ed81371b38b4a17… https://github.com/saltstack/salt/commit/cce7abad9c22d9d50ccee2813acabff8de… https://security.archlinux.org/CVE-2020-11651 https://security.archlinux.org/CVE-2020-11652

1 0

[ASA-202004-24] libmicrodns: multiple issues
by Morten Linderud 05 May '20

05 May '20

Arch Linux Security Advisory ASA-202004-24 ========================================== Severity: Critical Date : 2020-04-30 CVE-ID : CVE-2020-6071 CVE-2020-6072 CVE-2020-6073 CVE-2020-6077 CVE-2020-6078 CVE-2020-6079 CVE-2020-6080 Package : libmicrodns Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1136 Summary ======= The package libmicrodns before version 0.1.2-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 0.1.2-1. # pacman -Syu "libmicrodns>=0.1.2-1" The problems have been fixed upstream in version 0.1.2. Workaround ========== None. Description =========== - CVE-2020-6071 (denial of service) An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6072 (arbitrary code execution) An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return value is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6073 (information disclosure) An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing the RDATA section in a TXT record in mDNS messages, multiple integer overflows can be triggered, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6077 (information disclosure) An exploitable denial-of-service vulnerability exists in the message- parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages, the implementation does not properly keep track of the available data in the message, possibly leading to an out-of-bounds read that would result in a denial of service. An attacker can send an mDNS message to trigger this vulnerability. - CVE-2020-6078 (denial of service) An exploitable denial-of-service vulnerability exists in the message- parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_recv, the return value of the mdns_read_header function is not checked, leading to an uninitialized variable usage that eventually results in a null pointer dereference, leading to service crash. An attacker can send a series of mDNS messages to trigger this vulnerability. - CVE-2020-6079 (denial of service) Multiple exploitable denial-of-service vulnerabilities exist in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger these vulnerabilities. - CVE-2020-6080 (denial of service) Multiple exploitable denial-of-service vulnerabilities exist in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger these vulnerabilities. Impact ====== A remote attacker can provide crafted DNS responses to crash the service, disclose data or execute arbitrary code. References ========== https://github.com/videolabs/libmicrodns/releases/tag/0.1.1 https://talosintelligence.com/vulnerability_reports/TALOS-2020-0994 https://github.com/videolabs/libmicrodns/commit/0103f40371cd6e5f034d1ea5674… https://talosintelligence.com/vulnerability_reports/TALOS-2020-0995 https://github.com/videolabs/libmicrodns/commit/219b180c3cea9ad674a5512412f… https://talosintelligence.com/vulnerability_reports/TALOS-2020-0996 https://github.com/videolabs/libmicrodns/commit/f0e8a723ef2d0a7ef9e200a8fd7… https://talosintelligence.com/vulnerability_reports/TALOS-2020-1000 https://github.com/videolabs/libmicrodns/commit/80860fad7e046959b730a0e37fd… https://talosintelligence.com/vulnerability_reports/TALOS-2020-1001 https://github.com/videolabs/libmicrodns/commit/4fb18284bea9a4f5eaf7745d729… https://talosintelligence.com/vulnerability_reports/TALOS-2020-1002 https://github.com/videolabs/libmicrodns/commit/9768bdbeb8ea6b7849a97af4362… https://security.archlinux.org/CVE-2020-6071 https://security.archlinux.org/CVE-2020-6072 https://security.archlinux.org/CVE-2020-6073 https://security.archlinux.org/CVE-2020-6077 https://security.archlinux.org/CVE-2020-6078 https://security.archlinux.org/CVE-2020-6079 https://security.archlinux.org/CVE-2020-6080

1 0

[ASA-202004-23] webkit2gtk: arbitrary code execution
by Remi Gacogne 30 Apr '20

30 Apr '20

Arch Linux Security Advisory ASA-202004-23 ========================================== Severity: Critical Date : 2020-04-28 CVE-ID : CVE-2020-3899 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1144 Summary ======= The package webkit2gtk before version 2.28.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.28.2-1. # pacman -Syu "webkit2gtk>=2.28.2-1" The problem has been fixed upstream in version 2.28.2. Workaround ========== None. Description =========== A memory handling issue has been found in WebKitGTK before 2.28.2 and WPE WebKit before 2.28.2. Impact ====== A remote attacker might be able to execute arbitrary code via crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0005.html https://webkitgtk.org/security/WSA-2020-0005.html#CVE-2020-3899 https://security.archlinux.org/CVE-2020-3899

1 0

[ASA-202004-22] chromium: arbitrary code execution
by Remi Gacogne 30 Apr '20

30 Apr '20

Arch Linux Security Advisory ASA-202004-22 ========================================== Severity: High Date : 2020-04-28 CVE-ID : CVE-2020-6461 CVE-2020-6462 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1143 Summary ======= The package chromium before version 81.0.4044.129-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 81.0.4044.129-1. # pacman -Syu "chromium>=81.0.4044.129-1" The problems have been fixed upstream in version 81.0.4044.129. Workaround ========== None. Description =========== - CVE-2020-6461 (arbitrary code execution) A use-after-free vulnerability has been found in the storage component of the chromium browser before 81.0.4044.129. - CVE-2020-6462 (arbitrary code execution) A use-after-free vulnerability has been found in the task scheduling component of the chromium browser before 81.0.4044.129. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-des… https://crbug.com/1072983 https://crbug.com/1064891 https://security.archlinux.org/CVE-2020-6461 https://security.archlinux.org/CVE-2020-6462

1 0