- Arch-security - lists.archlinux.org

[ASA-202003-4] golang-golang-x-crypto: denial of service
by Morten Linderud 12 Mar '20

12 Mar '20

Arch Linux Security Advisory ASA-202003-4 ========================================= Severity: Medium Date : 2020-03-08 CVE-ID : CVE-2020-9283 Package : golang-golang-x-crypto Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1109 Summary ======= The package golang-golang-x-crypto before version 0.0.20200303-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.0.20200303-1. # pacman -Syu "golang-golang-x-crypto>=0.0.20200303-1" The problem has been fixed upstream in version 0.0.20200303. Workaround ========== None. Description =========== A security issue has been found in golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975. An attacker can craft an ssh- ed25519 or sk-ssh-ed25519(a)openssh.com public key, such that the library will panic when trying to verify a signature with it. Clients can deliver such a public key and signature to any golang.org/x/crypto/ssh server with a PublicKeyCallback, and servers can deliver them to any golang.org/x/crypto/ssh client. Impact ====== A remote unauthenticated attacker can serve a malicious SSH public key and crash the service. References ========== https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY https://github.com/golang/crypto/commit/bac4c82f69751a6dd76e702d54b3ceb88ad… https://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service… https://security.archlinux.org/CVE-2020-9283

1 0

[ASA-202003-3] ppp: arbitrary code execution
by Morten Linderud 12 Mar '20

12 Mar '20

Arch Linux Security Advisory ASA-202003-3 ========================================= Severity: Medium Date : 2020-03-07 CVE-ID : CVE-2020-8597 Package : ppp Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1101 Summary ======= The package ppp before version 2.4.7-7 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.4.7-7. # pacman -Syu "ppp>=2.4.7-7" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A buffer overflow flaw was found in the ppp package in versions 2.4.2 through 2.4.8. The bounds check for the rhostname was improperly constructed in the EAP request and response functions which could allow a buffer overflow to occur. Data confidentiality and integrity, as well as system availability, are all at risk with this vulnerability. Impact ====== A remote unauthenticated user can crash or possibly execute code on the host by sending malicious authentication data. References ========== https://lists.debian.org/debian-lts-announce/2020/02/msg00005.html https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787… https://seclists.org/fulldisclosure/2020/Mar/6 https://security.archlinux.org/CVE-2020-8597

1 0

[ASA-202003-2] opensc: denial of service
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202003-2 ========================================= Severity: Medium Date : 2020-03-04 CVE-ID : CVE-2019-6502 CVE-2019-15945 CVE-2019-15946 CVE-2019-19479 CVE-2019-19480 CVE-2019-19481 Package : opensc Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1106 Summary ======= The package opensc before version 0.20.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.20.0-1. # pacman -Syu "opensc>=0.20.0-1" The problems have been fixed upstream in version 0.20.0. Workaround ========== None. Description =========== - CVE-2019-6502 (denial of service) sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. - CVE-2019-15945 (denial of service) OpenSC before 0.20.0 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c. - CVE-2019-15946 (denial of service) OpenSC before 0.20.0 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c. - CVE-2019-19479 (denial of service) An issue was discovered in OpenSC before 0.20.0. libopensc/card- setcos.c has an incorrect read operation during parsing of a SETCOS file attribute. - CVE-2019-19480 (denial of service) An issue was discovered in OpenSC before 0.20.0. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry. - CVE-2019-19481 (denial of service) An issue was discovered in OpenSC before 0.20.0. libopensc/card-cac1.c mishandles buffer limits for CAC certificates, leading to an out-of- bounds read. Impact ====== A local attacker is able to crash the application with a malformed certificate. References ========== https://bugs.archlinux.org/task/65082 https://github.com/OpenSC/OpenSC/issues/1586 https://github.com/OpenSC/OpenSC/commit/0d7967549751b7032f22b437106b41444af… https://github.com/OpenSC/OpenSC/commit/412a6142c27a5973c61ba540e33cdc22d56… https://github.com/OpenSC/OpenSC/compare/f1691fc...12218d4 https://github.com/OpenSC/OpenSC/commit/a3fc7693f3a035a8a7921cffb98432944bb… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18693 https://github.com/OpenSC/OpenSC/commit/c3f23b836e5a1766c36617fe1da30d22f7b… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18478 https://github.com/OpenSC/OpenSC/commit/6ce6152284c47ba9b1d4fe8ff9d2e6a3f5e… https://github.com/OpenSC/OpenSC/commit/b75c002cfb1fd61cd20ec938ff4937d7b1a… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18618 https://security.archlinux.org/CVE-2019-6502 https://security.archlinux.org/CVE-2019-15945 https://security.archlinux.org/CVE-2019-15946 https://security.archlinux.org/CVE-2019-19479 https://security.archlinux.org/CVE-2019-19480 https://security.archlinux.org/CVE-2019-19481

1 0

[ASA-202003-1] chromium: access restriction bypass
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202003-1 ========================================= Severity: High Date : 2020-03-04 CVE-ID : CVE-2020-6420 Package : chromium Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-1107 Summary ======= The package chromium before version 80.0.3987.132-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 80.0.3987.132-1. # pacman -Syu "chromium>=80.0.3987.132-1" The problem has been fixed upstream in version 80.0.3987.132. Workaround ========== None. Description =========== An insufficient policy enforcement issue has been found in the media component of chromium before 80.0.3987.132. Impact ====== A remote attacker can bypass security restrictions. References ========== https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-des… https://crbug.com/1050996 https://security.archlinux.org/CVE-2020-6420

1 0

[ASA-202002-13] opensmtpd: arbitrary command execution
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202002-13 ========================================== Severity: Critical Date : 2020-02-29 CVE-ID : CVE-2020-8794 Package : opensmtpd Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1105 Summary ======= The package opensmtpd before version 6.6.4p1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 6.6.4p1-1. # pacman -Syu "opensmtpd>=6.6.4p1-1" The problem has been fixed upstream in version 6.6.4p1. Workaround ========== None. Description =========== An out-of-bounds read vulnerability has been found in the client-side code of OpenSMTPD <= 6.6.3p1, leading to arbitrary command execution via a crafted SMTP transaction. Impact ====== A remote attacker is able to execute arbitrary commands as root on the affected host. References ========== https://www.qualys.com/2020/02/24/cve-2020-8794/lpe-rce-opensmtpd-default-i… https://security.archlinux.org/CVE-2020-8794

1 0

[ASA-202002-12] weechat: multiple issues
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202002-12 ========================================== Severity: Critical Date : 2020-02-25 CVE-ID : CVE-2020-8955 CVE-2020-9759 CVE-2020-9760 Package : weechat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1103 Summary ======= The package weechat before version 2.7.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.7.1-1. # pacman -Syu "weechat>=2.7.1-1" The problems have been fixed upstream in version 2.7.1. Workaround ========== None. Description =========== - CVE-2020-8955 (arbitrary code execution) A heap-based out-of-bounds write has been found in the IRC plugin of Weechat before 2.7.1, in irc-mode.c, when receiving a malformed IRC message 324 (channel mode). - CVE-2020-9759 (denial of service) A heap-based out-of-bounds read has been found in Weechat before 2.7.1, when receiving a malformed IRC message 352 (WHO). It could lead to a off-by-one read resulting in denial of service (crash). - CVE-2020-9760 (arbitrary code execution) A heap-based out-of-bounds write has been found in Weechat before 2.7.1, when a new IRC message 005 is received with longer nick prefixes. It could lead to writing out of the allocated prefixes array when setting a prefix, resulting in denial of service (crash) or even arbitrary code execution. Impact ====== A remote attacker can crash the client and execute code remotely via a malformed message. References ========== https://weechat.org/news/113/20200220-Version-2.7.1-security-release/ https://github.com/weechat/weechat/commit/51a739df615f8ec66fbe1e9682ec3c321… https://github.com/weechat/weechat/commit/c827d6fa864e2c0b79cea640c45272e83… https://github.com/weechat/weechat/commit/694b5c9f874d7337cd2e03761e0de4352… https://security.archlinux.org/CVE-2020-8955 https://security.archlinux.org/CVE-2020-9759 https://security.archlinux.org/CVE-2020-9760

1 0

[ASA-202002-11] chromium: multiple issues
by Morten Linderud 29 Feb '20

29 Feb '20

Arch Linux Security Advisory ASA-202002-11 ========================================== Severity: High Date : 2020-02-25 CVE-ID : CVE-2020-6407 CVE-2020-6418 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1102 Summary ======= The package chromium before version 80.0.3987.122-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 80.0.3987.122-1. # pacman -Syu "chromium>=80.0.3987.122-1" The problems have been fixed upstream in version 80.0.3987.122. Workaround ========== None. Description =========== - CVE-2020-6407 (information disclosure) An out-of-bounds memory access vulnerability has been found in the streams component of chromium before 80.0.3987.122. - CVE-2020-6418 (arbitrary code execution) A type confusion vulnerability has been found in the V8 component of chromium before 80.0.3987.122. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-des… https://crbug.com/1045931 https://crbug.com/1053604 https://security.archlinux.org/CVE-2020-6407 https://security.archlinux.org/CVE-2020-6418

1 0

[ASA-202002-10] webkit2gtk: multiple issues
by Morten Linderud 29 Feb '20

29 Feb '20

Arch Linux Security Advisory ASA-202002-10 ========================================== Severity: High Date : 2020-02-17 CVE-ID : CVE-2020-3862 CVE-2020-3864 CVE-2020-3865 CVE-2020-3867 CVE-2020-3868 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1100 Summary ======= The package webkit2gtk before version 2.26.4-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, sandbox escape, denial of service and same-origin policy bypass. Resolution ========== Upgrade to 2.26.4-1. # pacman -Syu "webkit2gtk>=2.26.4-1" The problems have been fixed upstream in version 2.26.4. Workaround ========== None. Description =========== - CVE-2020-3862 (denial of service) A malicious website may be able to cause a denial of service. - CVE-2020-3864 (same-origin policy bypass) A DOM object context may not have had a unique security origin. - CVE-2020-3865 (sandbox escape) A top-level DOM object context may have incorrectly been considered secure. - CVE-2020-3867 (cross-site scripting) Processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2020-3868 (arbitrary code execution) Processing maliciously crafted web content may lead to arbitrary code execution. Credit to Marcin Towalski of Cisco Talos. Impact ====== A remote attacker can bypass security restrictions via universal cross- site scripting or execute arbitrary code via crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0002.html https://security.archlinux.org/CVE-2020-3862 https://security.archlinux.org/CVE-2020-3864 https://security.archlinux.org/CVE-2020-3865 https://security.archlinux.org/CVE-2020-3867 https://security.archlinux.org/CVE-2020-3868

1 0

[ASA-202002-9] thunderbird: multiple issues
by Morten Linderud 17 Feb '20

17 Feb '20

Arch Linux Security Advisory ASA-202002-9 ========================================= Severity: Critical Date : 2020-02-13 CVE-ID : CVE-2020-6792 CVE-2020-6793 CVE-2020-6794 CVE-2020-6795 CVE-2020-6798 CVE-2020-6800 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1099 Summary ======= The package thunderbird before version 68.5.0-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, denial of service and information disclosure. Resolution ========== Upgrade to 68.5.0-1. # pacman -Syu "thunderbird>=68.5.0-1" The problems have been fixed upstream in version 68.5.0. Workaround ========== None. Description =========== - CVE-2020-6792 (information disclosure) An information disclosure issue has bee found in Thunderbird before 68.5. When deriving an Message ID identifier for an email message, uninitialized memory was used in addition to the message contents. - CVE-2020-6793 (information disclosure) An out-of-bounds read has been found in Thunderbird before 68.5, when processing an e-mail message with an ill-formed envelope. - CVE-2020-6794 (information disclosure) It has been found that setting a master password post-Thunderbird 52 does not delete unencrypted previously stored passwords before Thunderbird 68.5. If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. - CVE-2020-6795 (denial of service) A null-pointer dereference has been found in Thunderbird before 68.5, when processing a message that contains multiple S/MIME signatures. - CVE-2020-6798 (cross-site scripting) An incorrect parsing of template could result in Javascript injection in Firefox before 73.0 and Thunderbird before 68.5. If a <template> tag was used in a <select%gt; tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. - CVE-2020-6800 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 73.0 and Thunderbird before 68.5. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker can access sensitive information, bypass security measures, crash the application or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6792 https://bugzilla.mozilla.org/show_bug.cgi?id=1609607 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6793 https://bugzilla.mozilla.org/show_bug.cgi?id=1608539 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6794 https://bugzilla.mozilla.org/show_bug.cgi?id=1606619 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6795 https://bugzilla.mozilla.org/show_bug.cgi?id=1611105 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6798 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6798 https://bugzilla.mozilla.org/show_bug.cgi?id=1602944 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6800 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6800 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595786%2C1596706%2C1598543… https://security.archlinux.org/CVE-2020-6792 https://security.archlinux.org/CVE-2020-6793 https://security.archlinux.org/CVE-2020-6794 https://security.archlinux.org/CVE-2020-6795 https://security.archlinux.org/CVE-2020-6798 https://security.archlinux.org/CVE-2020-6800

1 0

[ASA-202002-8] systemd: privilege escalation
by Morten Linderud 17 Feb '20

17 Feb '20

Arch Linux Security Advisory ASA-202002-8 ========================================= Severity: High Date : 2020-02-12 CVE-ID : CVE-2020-1712 Package : systemd Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1094 Summary ======= The package systemd before version 244.2-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 244.2-1. # pacman -Syu "systemd>=244.2-1" The problem has been fixed upstream in version 244.2. Workaround ========== None. Description =========== A heap use-after-free vulnerability was found in systemd before version 244.2, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages. Impact ====== A local unprivileged attacker is able to crash the system or execute arbitrary code as root by abusing polkit caching mechanisms. References ========== https://github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cccf97e… https://github.com/systemd/systemd-stable/commit/e2d4cb9843c50eff76e9104fec… https://security.archlinux.org/CVE-2020-1712

1 0