- Arch-security - lists.archlinux.org

[ASA-202004-21] git: information disclosure
by Remi Gacogne 30 Apr '20

30 Apr '20

Arch Linux Security Advisory ASA-202004-21 ========================================== Severity: High Date : 2020-04-22 CVE-ID : CVE-2020-11008 Package : git Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1138 Summary ======= The package git before version 2.26.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.26.2-1. # pacman -Syu "git>=2.26.2-1" The problem has been fixed upstream in version 2.26.2. Workaround ========== None. Description =========== A vulnerability has been found in git before 2.26.2. With a crafted URL that contains a newline or empty host, or lacks a scheme, the credential helper machinery can be fooled into providing credential information that is not appropriate for the protocol in use and host being contacted. Unlike the vulnerability CVE-2020-5260 fixed in v2.26.1, the credentials are not for a host of the attacker's choosing; instead, they are for some unspecified host (based on how the configured credential helper handles an absent "host" parameter). The attack has been made impossible by refusing to work with under- specified credential patterns. Impact ====== A remote attacker might be able to retrieve passwords or other credentials by tricking a user into cloning from a crafted URL, either directly or via Git submodules, or package systems built around Git. References ========== https://github.com/git/git/security/advisories/GHSA-hjc9-x69f-jqj7 https://github.com/git/git/compare/v2.17.4...v2.17.5 https://security.archlinux.org/CVE-2020-11008

1 0

[ASA-202004-20] chromium: multiple issues
by Remi Gacogne 24 Apr '20

24 Apr '20

Arch Linux Security Advisory ASA-202004-20 ========================================== Severity: High Date : 2020-04-22 CVE-ID : CVE-2020-6458 CVE-2020-6459 CVE-2020-6460 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1140 Summary ======= The package chromium before version 81.0.4044.122-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 81.0.4044.122-1. # pacman -Syu "chromium>=81.0.4044.122-1" The problems have been fixed upstream in version 81.0.4044.122. Workaround ========== None. Description =========== - CVE-2020-6458 (arbitrary code execution) An out of bounds read and write security issue has been found in the PDFium component of the chromium browser before 81.0.4044.122. - CVE-2020-6459 (arbitrary code execution) A use-after-free security issue has been found in the payments component of the chromium browser before 81.0.4044.122. - CVE-2020-6460 (insufficient validation) An insufficient data validation security issue has been found in the URL formatting component of the chromium browser before 81.0.4044.122. Impact ====== A remote attacker might be able to bypass restrictions, access sensitive information or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-des… https://crbug.com/1067270 https://crbug.com/1065298 https://crbug.com/1063566 https://security.archlinux.org/CVE-2020-6458 https://security.archlinux.org/CVE-2020-6459 https://security.archlinux.org/CVE-2020-6460

1 0

[ASA-202004-19] lib32-openssl: denial of service
by Santiago Torres-Arias 23 Apr '20

23 Apr '20

Arch Linux Security Advisory ASA-202004-19 ========================================== Severity: High Date : 2020-04-22 CVE-ID : CVE-2020-1967 Package : lib32-openssl Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1142 Summary ======= The package lib32-openssl before version 1.1.1.g-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.1.1.g-1. # pacman -Syu "lib32-openssl>=1.1.1.g-1" The problem has been fixed upstream in version 1.1.1.g. Workaround ========== None. Description =========== A NULL pointer dereference has been found in OpenSSL versions 1.1.1d, 1.1.1e and 1.1.1f. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. Impact ====== A malicious server or client may crash an openssl/libssl process by providing a maliciously-crafted SSL handshake References ========== https://www.openssl.org/news/secadv/20200421.txt https://github.com/openssl/openssl/commit/eb563247aef3e83dda7679c43f9649270… https://security.archlinux.org/CVE-2020-1967

1 0

[ASA-202004-18] openssl: denial of service
by Santiago Torres-Arias 22 Apr '20

22 Apr '20

Arch Linux Security Advisory ASA-202004-18 ========================================== Severity: High Date : 2020-04-21 CVE-ID : CVE-2020-1967 Package : openssl Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1139 Summary ======= The package openssl before version 1.1.1.g-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.1.1.g-1. # pacman -Syu "openssl>=1.1.1.g-1" The problem has been fixed upstream in version 1.1.1.g. Workaround ========== None. Description =========== A NULL pointer dereference has been found in OpenSSL versions 1.1.1d, 1.1.1e and 1.1.1f. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. Impact ====== A malicious server or client may crash an openssl/libssl process by providing a maliciously-crafted SSL handshake References ========== https://www.openssl.org/news/secadv/20200421.txt https://github.com/openssl/openssl/commit/eb563247aef3e83dda7679c43f9649270… https://security.archlinux.org/CVE-2020-1967

1 0

[ASA-202004-17] webkit2gtk: arbitrary code execution
by Remi Gacogne 21 Apr '20

21 Apr '20

Arch Linux Security Advisory ASA-202004-17 ========================================== Severity: Critical Date : 2020-04-19 CVE-ID : CVE-2020-11793 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1137 Summary ======= The package webkit2gtk before version 2.28.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.28.1-1. # pacman -Syu "webkit2gtk>=2.28.1-1" The problem has been fixed upstream in version 2.28.1. Workaround ========== None. Description =========== A use-after-free has been found in WebKitGTK before 2.2.8.1, where processing maliciously crafted web content may lead to arbitrary code execution or application crash (denial of service). Impact ====== A remote attacker can execute arbitrary code on the affected host via crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0004.html https://webkitgtk.org/security/WSA-2020-0004.html#CVE-2020-11793 https://security.archlinux.org/CVE-2020-11793

1 0

[ASA-202004-16] openvpn: denial of service
by Remi Gacogne 19 Apr '20

19 Apr '20

Arch Linux Security Advisory ASA-202004-16 ========================================== Severity: Medium Date : 2020-04-17 CVE-ID : CVE-2020-11810 Package : openvpn Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1135 Summary ======= The package openvpn before version 2.4.9-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.4.9-1. # pacman -Syu "openvpn>=2.4.9-1" The problem has been fixed upstream in version 2.4.9. Workaround ========== None. Description =========== A security issue has been found in OpenVPN before 2.4.9, where a 'peer- id' check is not performed correctly during a small amount of time after a connection has been established. A rogue client sending a data channel packet during that time, from a different source address and with the same 'peer-id', would cause the client data to float to that new address, effectively sopping the VPN traffic of the first, legitimate client. Impact ====== A remote attacker might be able to cause the legitimate VPN session of another client to stall, by sending a crafted packet right at the beginning of the VPN session. References ========== https://github.com/OpenVPN/openvpn/commit/37bc691e7d26ea4eb61a8a434ebd7a9ae… https://community.openvpn.net/openvpn/ticket/1272 https://security.archlinux.org/CVE-2020-11810

1 0

[ASA-202004-15] chromium: arbitrary code execution
by Remi Gacogne 17 Apr '20

17 Apr '20

Arch Linux Security Advisory ASA-202004-15 ========================================== Severity: Critical Date : 2020-04-16 CVE-ID : CVE-2020-6457 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1134 Summary ======= The package chromium before version 81.0.4044.113-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 81.0.4044.113-1. # pacman -Syu "chromium>=81.0.4044.113-1" The problem has been fixed upstream in version 81.0.4044.113. Workaround ========== None. Description =========== A use-after-free security issue has been found in the speech recognizer component of chromium before 81.0.4044.113. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-des… https://crbug.com/1067851 https://security.archlinux.org/CVE-2020-6457

1 0

[ASA-202004-14] apache: multiple issues
by Remi Gacogne 17 Apr '20

17 Apr '20

Arch Linux Security Advisory ASA-202004-14 ========================================== Severity: Low Date : 2020-04-15 CVE-ID : CVE-2020-1927 CVE-2020-1934 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1126 Summary ======= The package apache before version 2.4.43-1 is vulnerable to multiple issues including information disclosure and open redirect. Resolution ========== Upgrade to 2.4.43-1. # pacman -Syu "apache>=2.4.43-1" The problems have been fixed upstream in version 2.4.43. Workaround ========== None. Description =========== - CVE-2020-1927 (open redirect) A security issue has been found in Apache HTTP Server from 2.4.0 up to and including 2.4.41, in the mod_rewrite module, where redirects that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. This is the same defect as CVE-2019-10098. The fix for CVE-2019-10098 was ineffective. Possible mitigations are the use of anchor captures as back-references, or prefixing self-referential redirects with / or scheme, host, and port. - CVE-2020-1934 (information disclosure) The use of an uninitialized value has been found in Apache HTTP Server from 2.4.0 up to and including 2.4.41, in the mod_proxy_ftp module, when proxying to a malicious FTP server. Impact ====== A remote attacker is able to cause a redirect via a crafted HTTP request, or disclose information when proxying to an FTP server. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://seclists.org/oss-sec/2020/q2/3 https://seclists.org/oss-sec/2020/q2/4 https://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_ftp… https://security.archlinux.org/CVE-2020-1927 https://security.archlinux.org/CVE-2020-1934

1 0

[ASA-202004-13] git: information disclosure
by Levente Polyak 15 Apr '20

15 Apr '20

Arch Linux Security Advisory ASA-202004-13 ========================================== Severity: High Date : 2020-04-14 CVE-ID : CVE-2020-5260 Package : git Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1133 Summary ======= The package git before version 2.26.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.26.1-1. # pacman -Syu "git>=2.26.1-1" The problem has been fixed upstream in version 2.26.1. Workaround ========== The most complete workaround is to disable credential helpers altogether: git config --unset credential.helper git config --global --unset credential.helper git config --system --unset credential.helper An alternative is to avoid malicious URLs: 1. Examine the hostname and username portion of URLs fed to git clone for the presence of encoded newlines (%0a) or evidence of credential- protocol injections (e.g., host=github.com) 2. Avoid using submodules with untrusted repositories (don't use clone --recurse-submodules; use git submodule update only after examining the URLs found in .gitmodules) 3. Avoid tools which may run git clone on untrusted URLs under the hood Description =========== Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com) resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1. Impact ====== A remote attacker could trick Git into returning credential information for a wrong host by providing a malicious URL. References ========== https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q https://lore.kernel.org/git/xmqqy2qy7xn8.fsf@gitster.c.googlers.com/ https://git.kernel.org/pub/scm/git/git.git/commit/?id=9a6bbee8006c24b46a85d… https://git.kernel.org/pub/scm/git/git.git/commit/?id=c716fe4bd917e013bf376… https://git.kernel.org/pub/scm/git/git.git/commit/?id=07259e74ec1237c836874… https://bugs.chromium.org/p/project-zero/issues/detail?id=2021 https://security.archlinux.org/CVE-2020-5260

1 0

[ASA-202004-12] thunderbird: multiple issues
by Jelle van der Waa 13 Apr '20

13 Apr '20

Arch Linux Security Advisory ASA-202004-12 ========================================== Severity: Critical Date : 2020-04-13 CVE-ID : CVE-2020-6815 CVE-2020-6819 CVE-2020-6820 CVE-2020-6821 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1132 Summary ======= The package thunderbird before version 68.7.0-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 68.7.0-1. # pacman -Syu "thunderbird>=68.7.0-1" The problems have been fixed upstream in version 68.7.0. Workaround ========== None. Description =========== - CVE-2020-6815 (arbitrary code execution) Several memory safety and script safety bugs have been found in Firefox before 74 and Thunderbird before 68.7.0. Some of these bugs showed evidence of memory corruption or escalation of privilege and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-6819 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 74.0.1 and Thunderbird before 68.7.0 where under certain conditions, when running the nsDocShell destructor, a race condition can cause a use- after-free. Mozilla is aware of targeted attacks in the wild abusing this flaw. - CVE-2020-6820 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 74.0.1 and Thunderbird before 68.7.0 where, under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. Mozilla is aware of targeted attacks in the wild abusing this flaw. - CVE-2020-6821 (information disclosure) An information disclosure issue has been found in Firefox before 75.0 and Thunderbird before 68.7.0. When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-14/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-08/#CVE-2020-6815 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1181957%2C1557732%2C1557739… https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/#CVE-2020-6819 https://bugzilla.mozilla.org/show_bug.cgi?id=1620818 https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/#CVE-2020-6820 https://bugzilla.mozilla.org/show_bug.cgi?id=1626728 https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6821 https://bugzilla.mozilla.org/show_bug.cgi?id=1625404 https://security.archlinux.org/CVE-2020-6815 https://security.archlinux.org/CVE-2020-6819 https://security.archlinux.org/CVE-2020-6820 https://security.archlinux.org/CVE-2020-6821

1 0