- Arch-security - lists.archlinux.org

[ASA-202004-11] libssh: denial of service
by Remi Gacogne 10 Apr '20

10 Apr '20

Arch Linux Security Advisory ASA-202004-11 ========================================== Severity: Medium Date : 2020-04-09 CVE-ID : CVE-2020-1730 Package : libssh Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1130 Summary ======= The package libssh before version 0.9.4-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.9.4-1. # pacman -Syu "libssh>=0.9.4-1" The problem has been fixed upstream in version 0.9.4. Workaround ========== This issue can be mitigated by disabling AES-CTR ciphers. Description =========== A malicious client or server could crash the counterpart implemented with libssh before 0.9.4. When AES-CTR ciphers are used and don't get fully initialized, libssh will crash when it tries to cleanup the AES- CTR ciphers when closing the connection. Impact ====== A malicious client or server could crash the counterpart via a crafted SSH connection. References ========== https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-re… https://www.libssh.org/security/advisories/CVE-2020-1730.txt https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.9&id=958afb1c… https://security.archlinux.org/CVE-2020-1730

1 0

[ASA-202004-10] wireshark-cli: arbitrary code execution
by Remi Gacogne 10 Apr '20

10 Apr '20

Arch Linux Security Advisory ASA-202004-10 ========================================== Severity: Critical Date : 2020-04-09 CVE-ID : CVE-2020-11647 Package : wireshark-cli Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1129 Summary ======= The package wireshark-cli before version 3.2.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.2.3-1. # pacman -Syu "wireshark-cli>=3.2.3-1" The problem has been fixed upstream in version 3.2.3. Workaround ========== None. Description =========== A stack overflow has been found in the fAbstractSyntaxNType function of the BACApp dissector of Wireshark versions prior to 3.2.3, which could be triggered by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. Impact ====== A remote attacker might be able to execute arbitrary code or crash wireshark via a crafted network packet or a capture file. References ========== https://www.wireshark.org/security/wnpa-sec-2020-07 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16474 https://security.archlinux.org/CVE-2020-11647

1 0

[ASA-202004-9] chromium: multiple issues
by Remi Gacogne 10 Apr '20

10 Apr '20

Arch Linux Security Advisory ASA-202004-9 ========================================= Severity: High Date : 2020-04-08 CVE-ID : CVE-2020-6423 CVE-2020-6430 CVE-2020-6431 CVE-2020-6432 CVE-2020-6433 CVE-2020-6434 CVE-2020-6435 CVE-2020-6436 CVE-2020-6437 CVE-2020-6438 CVE-2020-6439 CVE-2020-6440 CVE-2020-6441 CVE-2020-6442 CVE-2020-6443 CVE-2020-6444 CVE-2020-6445 CVE-2020-6446 CVE-2020-6447 CVE-2020-6448 CVE-2020-6454 CVE-2020-6455 CVE-2020-6456 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1128 Summary ======= The package chromium before version 81.0.4044.92-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, access restriction bypass and insufficient validation. Resolution ========== Upgrade to 81.0.4044.92-1. # pacman -Syu "chromium>=81.0.4044.92-1" The problems have been fixed upstream in version 81.0.4044.92. Workaround ========== None. Description =========== - CVE-2020-6423 (arbitrary code execution) A use after free security issue has been found in the audio component of the chromium browser before 81.0.4044.92. - CVE-2020-6430 (arbitrary code execution) A type confusion security issue has been found in the V8 component of the chromium browser before 81.0.4044.92. - CVE-2020-6431 (access restriction bypass) An insufficient policy enforcement security issue has been found in the full screen component of the chromium browser before 81.0.4044.92. - CVE-2020-6432 (access restriction bypass) An insufficient policy enforcement security issue has been found in the navigations component of the chromium browser before 81.0.4044.92. - CVE-2020-6433 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 81.0.4044.92. - CVE-2020-6434 (arbitrary code execution) A use-after-free security issue has been found in the devtools component of the chromium browser before 81.0.4044.92. - CVE-2020-6435 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 81.0.4044.92. - CVE-2020-6436 (arbitrary code execution) A use-after-free security issue has been found in the window management component of the chromium browser before 81.0.4044.92. - CVE-2020-6437 (access restriction bypass) An inappropriate implementation security issue has been found in the WebView component of the chromium browser before 81.0.4044.92. - CVE-2020-6438 (access restriction bypass) An insufficient policy enforcement security issue has been found in the extensions component of the chromium browser before 81.0.4044.92. - CVE-2020-6439 (access restriction bypass) An insufficient policy enforcement security issue has been found in the navigations component of the chromium browser before 81.0.4044.92. - CVE-2020-6440 (access restriction bypass) An inappropriate implementation security issue has been found in the extensions component of the chromium browser before 81.0.4044.92. - CVE-2020-6441 (access restriction bypass) An insufficient policy enforcement security issue has been found in the omnibox component of the chromium browser before 81.0.4044.92. - CVE-2020-6442 (access restriction bypass) An inappropriate implementation security issue has been found in the cache component of the chromium browser before 81.0.4044.92. - CVE-2020-6443 (insufficient validation) An insufficient data validation security issue has been found in the developer tools component of the chromium browser before 81.0.4044.92. - CVE-2020-6444 (information disclosure) An uninitialized memory use issue has been found in the WebRTC component of the chromium browser before 81.0.4044.92. - CVE-2020-6445 (access restriction bypass) An insufficient policy enforcement security issue has been found in the trusted types component of the chromium browser before 81.0.4044.92. - CVE-2020-6446 (access restriction bypass) An insufficient policy enforcement security issue has been found in the trusted types component of the chromium browser before 81.0.4044.92. - CVE-2020-6447 (access restriction bypass) An inappropriate implementation security issue has been found in the developer tools component of the chromium browser before 81.0.4044.92. - CVE-2020-6448 (arbitrary code execution) A use-after-free security issue has been found in the V8 component of the chromium browser before 81.0.4044.92. - CVE-2020-6454 (arbitrary code execution) A use after free security issue has been found in the extensions component of the chromium browser before 81.0.4044.92. - CVE-2020-6455 (information disclosure) A out of bounds read security issue has been found in the WebSQL component of the chromium browser before 81.0.4044.92. - CVE-2020-6456 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the clipboard component of the chromium browser before 81.0.4044.92. Impact ====== A remote attacker might be able to access sensitive information, bypass security measures or execute arbitrary code. References ========== https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-des… https://crbug.com/1043446 https://crbug.com/1031479 https://crbug.com/852645 https://crbug.com/965611 https://crbug.com/1043965 https://crbug.com/1048555 https://crbug.com/1032158 https://crbug.com/1034519 https://crbug.com/639173 https://crbug.com/714617 https://crbug.com/868145 https://crbug.com/894477 https://crbug.com/959571 https://crbug.com/1013906 https://crbug.com/1040080 https://crbug.com/922882 https://crbug.com/933171 https://crbug.com/933172 https://crbug.com/991217 https://crbug.com/1037872 https://crbug.com/1019161 https://crbug.com/1059669 https://crbug.com/1040755 https://security.archlinux.org/CVE-2020-6423 https://security.archlinux.org/CVE-2020-6430 https://security.archlinux.org/CVE-2020-6431 https://security.archlinux.org/CVE-2020-6432 https://security.archlinux.org/CVE-2020-6433 https://security.archlinux.org/CVE-2020-6434 https://security.archlinux.org/CVE-2020-6435 https://security.archlinux.org/CVE-2020-6436 https://security.archlinux.org/CVE-2020-6437 https://security.archlinux.org/CVE-2020-6438 https://security.archlinux.org/CVE-2020-6439 https://security.archlinux.org/CVE-2020-6440 https://security.archlinux.org/CVE-2020-6441 https://security.archlinux.org/CVE-2020-6442 https://security.archlinux.org/CVE-2020-6443 https://security.archlinux.org/CVE-2020-6444 https://security.archlinux.org/CVE-2020-6445 https://security.archlinux.org/CVE-2020-6446 https://security.archlinux.org/CVE-2020-6447 https://security.archlinux.org/CVE-2020-6448 https://security.archlinux.org/CVE-2020-6454 https://security.archlinux.org/CVE-2020-6455 https://security.archlinux.org/CVE-2020-6456

1 0

[ASA-202004-8] firefox: multiple issues
by Remi Gacogne 10 Apr '20

10 Apr '20

Arch Linux Security Advisory ASA-202004-8 ========================================= Severity: Critical Date : 2020-04-08 CVE-ID : CVE-2020-6821 CVE-2020-6823 CVE-2020-6824 CVE-2020-6825 CVE-2020-6826 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1127 Summary ======= The package firefox before version 75.0-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and access restriction bypass. Resolution ========== Upgrade to 75.0-1. # pacman -Syu "firefox>=75.0-1" The problems have been fixed upstream in version 75.0. Workaround ========== None. Description =========== - CVE-2020-6821 (information disclosure) An information disclosure issue has been found in Firefox before 75.0. When reading from areas partially or fully outside the source resource with WebGL's copyTexSubImage method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. - CVE-2020-6823 (access restriction bypass) A security issue has been found in Firefox before 75.0, where a malicious extension could have called browser.identity.launchWebAuthFlow, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. - CVE-2020-6824 (information disclosure) A security issue has been found in Firefox before 75.0, where generated passwords may be identical on the same site between separate private browsing sessions. Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwords would have been identical, rather than independent. - CVE-2020-6825 (arbitrary code execution) Several memory safety issues have been found in Firefox before 75.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-6826 (arbitrary code execution) Several memory safety issues have been found in Firefox before 75.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to access sensitive information, bypass security restrictions or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6821 https://bugzilla.mozilla.org/show_bug.cgi?id=1625404 https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6823 https://bugzilla.mozilla.org/show_bug.cgi?id=1614919 https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6824 https://bugzilla.mozilla.org/show_bug.cgi?id=1621853 https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6825 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1572541%2C1620193%2C1620203 https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/#CVE-2020-6826 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1613009%2C1613195%2C1616734… https://security.archlinux.org/CVE-2020-6821 https://security.archlinux.org/CVE-2020-6823 https://security.archlinux.org/CVE-2020-6824 https://security.archlinux.org/CVE-2020-6825 https://security.archlinux.org/CVE-2020-6826

1 0

[ASA-202004-7] haproxy: arbitrary code execution
by Remi Gacogne 10 Apr '20

10 Apr '20

Arch Linux Security Advisory ASA-202004-7 ========================================= Severity: Critical Date : 2020-04-08 CVE-ID : CVE-2020-11100 Package : haproxy Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1124 Summary ======= The package haproxy before version 2.1.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.1.4-1. # pacman -Syu "haproxy>=2.1.4-1" The problem has been fixed upstream in version 2.1.4. Workaround ========== None. Description =========== An out-of-bounds memory write has been found in HAProxy before 2.1.4, in the HPACK table management code. Impact ====== A remote attacker might be able to execute code via a crafted HTTP/2 request. References ========== https://git.haproxy.org/?p=haproxy-2.1.git;a=commitdiff;h=f17f86304f187b0f1… https://security.archlinux.org/CVE-2020-11100

1 0

[ASA-202004-6] firefox: arbitrary code execution
by Remi Gacogne 07 Apr '20

07 Apr '20

Arch Linux Security Advisory ASA-202004-6 ========================================= Severity: Critical Date : 2020-04-04 CVE-ID : CVE-2020-6819 CVE-2020-6820 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1125 Summary ======= The package firefox before version 74.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 74.0.1-1. # pacman -Syu "firefox>=74.0.1-1" The problems have been fixed upstream in version 74.0.1. Workaround ========== None. Description =========== - CVE-2020-6819 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 74.0.1 where under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. Mozilla is aware of targeted attacks in the wild abusing this flaw. - CVE-2020-6820 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 74.0.1 where, under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. Mozilla is aware of targeted attacks in the wild abusing this flaw. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/#CVE-2020-6819 https://bugzilla.mozilla.org/show_bug.cgi?id=1620818 https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/#CVE-2020-6820 https://bugzilla.mozilla.org/show_bug.cgi?id=1626728 https://security.archlinux.org/CVE-2020-6819 https://security.archlinux.org/CVE-2020-6820

1 0

[ASA-202004-5] pam-krb5: arbitrary code execution
by Levente Polyak 01 Apr '20

01 Apr '20

Arch Linux Security Advisory ASA-202004-5 ========================================= Severity: Medium Date : 2020-04-01 CVE-ID : CVE-2020-10595 Package : pam-krb5 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1119 Summary ======= The package pam-krb5 before version 4.9-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.9-1. # pacman -Syu "pam-krb5>=4.9-1" The problem has been fixed upstream in version 4.9. Workaround ========== None. Description =========== pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerberos library. It may overflow a buffer provided by the underlying Kerberos library by a single '\0' byte if an attacker responds to a prompt with an answer of a carefully chosen length. The effect may range from heap corruption to stack corruption depending on the structure of the underlying Kerberos library, with unknown effects but possibly including code execution. This code path is not used for normal authentication, but only when the Kerberos library does supplemental prompting, such as with PKINIT or when using the non-standard no_prompt PAM configuration option. Impact ====== A remote attacker is able to execute arbitrary code on the affected host. References ========== https://mailman.mit.edu/pipermail/kerberos/2020-March/022444.html https://www.openwall.com/lists/oss-security/2020/03/31/1 https://www.eyrie.org/~eagle/software/pam-krb5/security/2020-03-30.html https://github.com/rra/pam-krb5/commit/b57c2ee992ae2309e7866e89caef2a487072… https://security.archlinux.org/CVE-2020-10595

1 0

[ASA-202004-4] linux: privilege escalation
by Levente Polyak 01 Apr '20

01 Apr '20

Arch Linux Security Advisory ASA-202004-4 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-8835 Package : linux Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1122 Summary ======= The package linux before version 5.5.13.arch2-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.5.13.arch2-1. # pacman -Syu "linux>=5.5.13.arch2-1" The problem has been fixed upstream in version 5.5.13.arch2. Workaround ========== BPF access can be restricted to privileged users by setting kernel.unprivileged_bpf_disabled to 1: # sysctl -w kernel.unprivileged_bpf_disabled=1 Description =========== An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking 32-bit instructions in an eBPF program occurs. This flaw allows an unprivileged user or process to execute eBPF programs to crash the kernel, resulting in a denial of service or potentially gaining root privileges on the system. Impact ====== An unprivileged local user or process can crash the kernel, resulting in a denial of service, or potentially gain root privileges on the system. References ========== https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results https://lore.kernel.org/bpf/20200330160324.15259-1-daniel@iogearbox.net/T/ https://www.openwall.com/lists/oss-security/2020/03/30/3 https://security.archlinux.org/CVE-2020-8835

1 0

[ASA-202004-3] linux-lts: privilege escalation
by Levente Polyak 01 Apr '20

01 Apr '20

Arch Linux Security Advisory ASA-202004-3 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-8835 Package : linux-lts Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1121 Summary ======= The package linux-lts before version 5.4.28-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.4.28-2. # pacman -Syu "linux-lts>=5.4.28-2" The problem has been fixed upstream but no release is available yet. Workaround ========== BPF access can be restricted to privileged users by setting kernel.unprivileged_bpf_disabled to 1: # sysctl -w kernel.unprivileged_bpf_disabled=1 Description =========== An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking 32-bit instructions in an eBPF program occurs. This flaw allows an unprivileged user or process to execute eBPF programs to crash the kernel, resulting in a denial of service or potentially gaining root privileges on the system. Impact ====== An unprivileged local user or process can crash the kernel, resulting in a denial of service, or potentially gain root privileges on the system. References ========== https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results https://lore.kernel.org/bpf/20200330160324.15259-1-daniel@iogearbox.net/T/ https://www.openwall.com/lists/oss-security/2020/03/30/3 https://security.archlinux.org/CVE-2020-8835

1 0

[ASA-202004-2] linux-hardened: privilege escalation
by Levente Polyak 01 Apr '20

01 Apr '20

Arch Linux Security Advisory ASA-202004-2 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-8835 Package : linux-hardened Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1120 Summary ======= The package linux-hardened before version 5.5.13.b-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.5.13.b-1. # pacman -Syu "linux-hardened>=5.5.13.b-1" The problem has been fixed upstream in version 5.5.13.b. Workaround ========== By default linux-hardened is safe as it restricts BPF access to privileged users. In case the kernel.unprivileged_bpf_disabled setting has been explicitly changed, it can be restricted again: # sysctl -w kernel.unprivileged_bpf_disabled=1 Description =========== An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking 32-bit instructions in an eBPF program occurs. This flaw allows an unprivileged user or process to execute eBPF programs to crash the kernel, resulting in a denial of service or potentially gaining root privileges on the system. Impact ====== An unprivileged local user or process can crash the kernel, resulting in a denial of service, or potentially gain root privileges on the system in case the default BPF access has been changed to allow unprivileged users. References ========== https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results https://lore.kernel.org/bpf/20200330160324.15259-1-daniel@iogearbox.net/T/ https://www.openwall.com/lists/oss-security/2020/03/30/3 https://security.archlinux.org/CVE-2020-8835

1 0