- Arch-security - lists.archlinux.org

[ASA-202002-7] webkit2gtk: arbitrary code execution
by Remi Gacogne 13 Feb '20

13 Feb '20

Arch Linux Security Advisory ASA-202002-7 ========================================= Severity: Critical Date : 2020-02-12 CVE-ID : CVE-2019-8835 CVE-2019-8844 CVE-2019-8846 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1098 Summary ======= The package webkit2gtk before version 2.26.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.26.3-1. # pacman -Syu "webkit2gtk>=2.26.3-1" The problems have been fixed upstream in version 2.26.3. Workaround ========== None. Description =========== - CVE-2019-8835 (arbitrary code execution) Multiple memory corruption issues have been found in WebKitGTK before 2.26.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8844 (arbitrary code execution) Multiple memory corruption issues have been found in WebKitGTK before 2.26.3, where processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8846 (arbitrary code execution) Multiple memory corruption issues have been found in WebKitGTK before 2.26.3, where processing maliciously crafted web content may lead to arbitrary code execution. Impact ====== A remote attacker can execute code on the affected host via maliciously crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0001.html https://webkitgtk.org/security/WSA-2020-0001.html#CVE-2019-8835 https://webkitgtk.org/security/WSA-2020-0001.html#CVE-2019-8844 https://webkitgtk.org/security/WSA-2020-0001.html#CVE-2019-8846 https://security.archlinux.org/CVE-2019-8835 https://security.archlinux.org/CVE-2019-8844 https://security.archlinux.org/CVE-2019-8846

1 0

[ASA-202002-6] dovecot: denial of service
by Remi Gacogne 13 Feb '20

13 Feb '20

Arch Linux Security Advisory ASA-202002-6 ========================================= Severity: Medium Date : 2020-02-12 CVE-ID : CVE-2020-7046 CVE-2020-7957 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1097 Summary ======= The package dovecot before version 2.3.9.3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.3.9.3-1. # pacman -Syu "dovecot>=2.3.9.3-1" The problems have been fixed upstream in version 2.3.9.3. Workaround ========== None. Description =========== - CVE-2020-7046 (denial of service) A denial of service has been found in Dovecot before 2.3.9.3, where lib-smtp doesn't handle truncated command parameters properly, resulting in infinite loop taking 100% CPU for the process. This happens for LMTP (where it doesn't matter so much) and also for submission-login where unauthenticated users can trigger it. - CVE-2020-7957 (denial of service) A denial of service have been found in Dovecot before 2.3.9.3, where a specially crafted e-mail can cause a mailbox to have permanently inaccessible mail, or the e-mail itself can be stuck in delivery. This happens because the snippet generation crashes if a message is large enough that message-parser returns multiple body blocks, the first block(s) don't contain the full snippet (e.g. full of whitespace) and the input ends with '>'. Impact ====== A remote, unauthenticated user can cause a denial of service via a crafted message. References ========== https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html https://security.archlinux.org/CVE-2020-7046 https://security.archlinux.org/CVE-2020-7957

1 0

[ASA-202002-5] firefox: multiple issues
by Remi Gacogne 13 Feb '20

13 Feb '20

Arch Linux Security Advisory ASA-202002-5 ========================================= Severity: Critical Date : 2020-02-11 CVE-ID : CVE-2020-6796 CVE-2020-6798 CVE-2020-6800 CVE-2020-6801 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1096 Summary ======= The package firefox before version 73.0-1 is vulnerable to multiple issues including arbitrary code execution and cross-site scripting. Resolution ========== Upgrade to 73.0-1. # pacman -Syu "firefox>=73.0-1" The problems have been fixed upstream in version 73.0. Workaround ========== None. Description =========== - CVE-2020-6796 (arbitrary code execution) A missing bounds check on shared memory read in the parent process has been found in Firefox before 73.0. A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable crash. - CVE-2020-6798 (cross-site scripting) An incorrect parsing of template could result in Javascript injection in Firefox before 73.0 and Thunderbird before 68.5. If a <template> tag was used in a <select%gt; tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. - CVE-2020-6800 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 73.0 and Thunderbird before 68.5. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-6801 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 73.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker can inject javascript on a vulnerable site, and execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-05 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6796 https://bugzilla.mozilla.org/show_bug.cgi?id=1610426 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6798 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6798 https://bugzilla.mozilla.org/show_bug.cgi?id=1602944 https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6800 https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6800 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595786%2C1596706%2C1598543… https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6801 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1601024%2C1601712%2C1604836… https://security.archlinux.org/CVE-2020-6796 https://security.archlinux.org/CVE-2020-6798 https://security.archlinux.org/CVE-2020-6800 https://security.archlinux.org/CVE-2020-6801

1 0

[ASA-202002-4] ksh: arbitrary command execution
by Morten Linderud 12 Feb '20

12 Feb '20

Arch Linux Security Advisory ASA-202002-4 ========================================= Severity: High Date : 2020-02-08 CVE-ID : CVE-2019-14868 Package : ksh Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-1095 Summary ======= The package ksh before version 2020.0.0-2 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2020.0.0-2. # pacman -Syu "ksh>=2020.0.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw was found in ksh version 2020.0.0 in the evaluation of certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely. Impact ====== An attacker is able to execute arbitrary commands that are blacklisted on the affected host. References ========== https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2 https://security.archlinux.org/CVE-2019-14868

1 0

[ASA-202002-3] chromium: multiple issues
by Remi Gacogne 07 Feb '20

07 Feb '20

Arch Linux Security Advisory ASA-202002-3 ========================================= Severity: Critical Date : 2020-02-06 CVE-ID : CVE-2019-18197 CVE-2019-19880 CVE-2019-19923 CVE-2019-19925 CVE-2019-19926 CVE-2020-6381 CVE-2020-6382 CVE-2020-6385 CVE-2020-6387 CVE-2020-6388 CVE-2020-6389 CVE-2020-6390 CVE-2020-6391 CVE-2020-6392 CVE-2020-6393 CVE-2020-6394 CVE-2020-6395 CVE-2020-6396 CVE-2020-6397 CVE-2020-6398 CVE-2020-6399 CVE-2020-6400 CVE-2020-6401 CVE-2020-6402 CVE-2020-6403 CVE-2020-6404 CVE-2020-6405 CVE-2020-6406 CVE-2020-6408 CVE-2020-6409 CVE-2020-6410 CVE-2020-6411 CVE-2020-6412 CVE-2020-6413 CVE-2020-6414 CVE-2020-6415 CVE-2020-6416 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1092 Summary ======= The package chromium before version 80.0.3987.87-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure, insufficient validation and content spoofing. Resolution ========== Upgrade to 80.0.3987.87-1. # pacman -Syu "chromium>=80.0.3987.87-1" The problems have been fixed upstream in version 80.0.3987.87. Workaround ========== None. Description =========== - CVE-2019-18197 (insufficient validation) Multiple vulnerabilities have been found in the xml component of the chromium browser before 80.0.3987.8. - CVE-2019-19880 (insufficient validation) Multiple vulnerabilities have been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2019-19923 (information disclosure) An out of bounds memory access has been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2019-19925 (insufficient validation) Multiple vulnerabilities have been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2019-19926 (insufficient validation) An inappropriate implementation security issue has been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2020-6381 (arbitrary code execution) An integer overflow security issue has been found in the javascript component of the chromium browser before 80.0.3987.8. - CVE-2020-6382 (arbitrary code execution) A type confusion security issue has been found in the javascript component of the chromium browser before 80.0.3987.8. - CVE-2020-6385 (access restriction bypass) An insufficient policy enforcement security issue has been found in the storage component of the chromium browser before 80.0.3987.8. - CVE-2020-6387 (arbitrary code execution) An out of bounds write has been found in the WebRTC component of the chromium browser before 80.0.3987.8. - CVE-2020-6388 (information disclosure) An out of bounds memory access has been found in the WebAudio component of the chromium browser before 80.0.3987.8. - CVE-2020-6389 (arbitrary code execution) An out of bounds write has been found in the WebRTC component of the chromium browser before 80.0.3987.8. - CVE-2020-6390 (information disclosure) An out of bounds memory access has been found in the streams component of the chromium browser before 80.0.3987.8. - CVE-2020-6391 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6392 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Extensions component of the chromium browser before 80.0.3987.8. - CVE-2020-6393 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6394 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6395 (information disclosure) An out of bounds read has been found in the javascript component of the chromium browser before 80.0.3987.8. - CVE-2020-6396 (access restriction bypass) An inappropriate implementation security issue has been found in the Skia component of the chromium browser before 80.0.3987.8. - CVE-2020-6397 (content spoofing) An incorrect security UI issue has been found in the sharing component of the chromium browser before 80.0.3987.8. - CVE-2020-6398 (information disclosure) An uninitialized use has been found in the PDFium component of the chromium browser before 80.0.3987.8. - CVE-2020-6399 (access restriction bypass) An insufficient policy enforcement issue has been found in the AppCache component of the chromium browser before 80.0.3987.8. - CVE-2020-6400 (access restriction bypass) An inappropriate implementation issue has been found in the CORS component of the chromium browser before 80.0.3987.8. - CVE-2020-6401 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6402 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Downloads component of the chromium browser before 80.0.3987.8. - CVE-2020-6403 (content spoofing) A incorrect security UI issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6404 (access restriction bypass) An inappropriate implementation security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6405 (information disclosure) An out of bounds read has been found in the SQLite component of the chromium browser before 80.0.3987.8. - CVE-2020-6406 (arbitrary code execution) A use-after-free security issue has been found in the Audio component of the chromium browser before 80.0.3987.8. - CVE-2020-6408 (access restriction bypass) An insufficient policy enforcement security issue has been found in the CORS component of the chromium browser before 80.0.3987.8. - CVE-2020-6409 (access restriction bypass) An inappropriate implementation security issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6410 (access restriction bypass) An insufficient policy enforcement security issue has been found in the navigation component of the chromium browser before 80.0.3987.8. - CVE-2020-6411 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6412 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the OmniBox component of the chromium browser before 80.0.3987.8. - CVE-2020-6413 (access restriction bypass) An inappropriate implementation security issue has been found in the Blink component of the chromium browser before 80.0.3987.8. - CVE-2020-6414 (access restriction bypass) An insufficient policy enforcement security issue has been found in the Safe Browsing component of the chromium browser before 80.0.3987.8. - CVE-2020-6415 (access restriction bypass) An inappropriate implementation security issue has been found in the javascript component of the chromium browser before 80.0.3987.8. - CVE-2020-6416 (insufficient validation) An insufficient data validation security issue has been found in the streams component of the chromium browser before 80.0.3987.8. Impact ====== A remote attacker can bypass security measures, access sensitive information, spoof the content of parts of the UI or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-des… https://crbug.com/1020745 https://crbug.com/1038863 https://crbug.com/1042578 https://crbug.com/1042700 https://crbug.com/1034394 https://crbug.com/1031909 https://crbug.com/1035399 https://crbug.com/1042535 https://crbug.com/1042879 https://crbug.com/1042933 https://crbug.com/1045874 https://crbug.com/1017871 https://crbug.com/1030411 https://crbug.com/1035058 https://crbug.com/1014371 https://crbug.com/1022855 https://crbug.com/1035271 https://crbug.com/1027408 https://crbug.com/1032090 https://crbug.com/1039869 https://crbug.com/1038036 https://crbug.com/1017707 https://crbug.com/1029375 https://crbug.com/1006012 https://crbug.com/1024256 https://crbug.com/1042145 https://crbug.com/1042254 https://crbug.com/1026546 https://crbug.com/1037889 https://crbug.com/881675 https://crbug.com/929711 https://crbug.com/968505 https://crbug.com/1005713 https://crbug.com/1021855 https://crbug.com/1029576 https://crbug.com/1031895 https://security.archlinux.org/CVE-2019-18197 https://security.archlinux.org/CVE-2019-19880 https://security.archlinux.org/CVE-2019-19923 https://security.archlinux.org/CVE-2019-19925 https://security.archlinux.org/CVE-2019-19926 https://security.archlinux.org/CVE-2020-6381 https://security.archlinux.org/CVE-2020-6382 https://security.archlinux.org/CVE-2020-6385 https://security.archlinux.org/CVE-2020-6387 https://security.archlinux.org/CVE-2020-6388 https://security.archlinux.org/CVE-2020-6389 https://security.archlinux.org/CVE-2020-6390 https://security.archlinux.org/CVE-2020-6391 https://security.archlinux.org/CVE-2020-6392 https://security.archlinux.org/CVE-2020-6393 https://security.archlinux.org/CVE-2020-6394 https://security.archlinux.org/CVE-2020-6395 https://security.archlinux.org/CVE-2020-6396 https://security.archlinux.org/CVE-2020-6397 https://security.archlinux.org/CVE-2020-6398 https://security.archlinux.org/CVE-2020-6399 https://security.archlinux.org/CVE-2020-6400 https://security.archlinux.org/CVE-2020-6401 https://security.archlinux.org/CVE-2020-6402 https://security.archlinux.org/CVE-2020-6403 https://security.archlinux.org/CVE-2020-6404 https://security.archlinux.org/CVE-2020-6405 https://security.archlinux.org/CVE-2020-6406 https://security.archlinux.org/CVE-2020-6408 https://security.archlinux.org/CVE-2020-6409 https://security.archlinux.org/CVE-2020-6410 https://security.archlinux.org/CVE-2020-6411 https://security.archlinux.org/CVE-2020-6412 https://security.archlinux.org/CVE-2020-6413 https://security.archlinux.org/CVE-2020-6414 https://security.archlinux.org/CVE-2020-6415 https://security.archlinux.org/CVE-2020-6416

1 0

[ASA-202002-2] sudo: privilege escalation
by Morten Linderud 06 Feb '20

06 Feb '20

Arch Linux Security Advisory ASA-202002-2 ========================================= Severity: High Date : 2020-02-06 CVE-ID : CVE-2019-18634 Package : sudo Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1093 Summary ======= The package sudo before version 1.8.31-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.8.31-1. # pacman -Syu "sudo>=1.8.31-1" The problem has been fixed upstream in version 1.8.31. Workaround ========== Ensure pwfeedback is disabled in /etc/sshd/sshd_config with: Defaults !pwfeedback Description =========== A flaw was found in the Sudo before version 1.8.31 application when the ’pwfeedback' option is set to true on the sudoers file. An authenticated user can use this vulnerability to trigger a stack-based buffer overflow under certain conditions even without Sudo privileges. The buffer overflow may allow an attacker to expose or corrupt memory information, crash the Sudo application, or possibly inject code to be run as a root user. Impact ====== An authenticated user is capable of escalating to root privileges. References ========== https://www.sudo.ws/alerts/pwfeedback.html https://www.sudo.ws/repos/sudo/rev/84640592b0ff https://security.archlinux.org/CVE-2019-18634

1 1

[ASA-202002-1] python-django: sql injection
by Morten Linderud 06 Feb '20

06 Feb '20

Arch Linux Security Advisory ASA-202002-1 ========================================= Severity: Medium Date : 2020-02-03 CVE-ID : CVE-2020-7471 Package : python-django Type : sql injection Remote : Yes Link : https://security.archlinux.org/AVG-1091 Summary ======= The package python-django before version 3.0.3-1 is vulnerable to sql injection. Resolution ========== Upgrade to 3.0.3-1. # pacman -Syu "python-django>=3.0.3-1" The problem has been fixed upstream in version 3.0.3. Workaround ========== None. Description =========== django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter. Impact ====== A remote attacker is able to perform a SQL injection using a specially crafted request. References ========== https://www.djangoproject.com/weblog/2020/feb/03/security-releases/ https://security.archlinux.org/CVE-2020-7471

1 0

[ASA-202001-7] salt: arbitrary command execution
by Morten Linderud 04 Feb '20

04 Feb '20

Arch Linux Security Advisory ASA-202001-7 ========================================= Severity: Medium Date : 2020-01-29 CVE-ID : CVE-2019-17361 Package : salt Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1087 Summary ======= The package salt before version 2019.2.3-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 2019.2.3-1. # pacman -Syu "salt>=2019.2.3-1" The problem has been fixed upstream in version 2019.2.3. Workaround ========== None. Description =========== With the Salt NetAPI enabled in addition to having a SSH roster defined, unauthenticated access is possible when specifying the client as SSH. Additionally, when the raw_shell option is specified any arbitrary command may be run on the Salt master when specifying SSH options. Impact ====== A remote unauthenticated attacker is able to execute arbitrary code on the affected host. References ========== https://docs.saltstack.com/en/latest/topics/releases/2019.2.3.html https://github.com/saltstack/salt/commit/bca115f3f00fbde564dd2f12bf036b5d2f… https://security.archlinux.org/CVE-2019-17361

1 0

[ASA-202001-6] opensmtpd: arbitrary command execution
by Levente Polyak 31 Jan '20

31 Jan '20

Arch Linux Security Advisory ASA-202001-6 ========================================= Severity: Critical Date : 2020-01-29 CVE-ID : CVE-2020-7247 Package : opensmtpd Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1090 Summary ======= The package opensmtpd before version 6.6.2p1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 6.6.2p1-1. # pacman -Syu "opensmtpd>=6.6.2p1-1" The problem has been fixed upstream in version 6.6.2p1. Workaround ========== None. Description =========== smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation. Impact ====== A remote attacker is able to execute arbitrary commands as root on the affected host. References ========== https://www.openwall.com/lists/oss-security/2020/01/28/3 https://github.com/OpenSMTPD/OpenSMTPD/commit/d2688c097e0ff53037c7403e09426… https://github.com/openbsd/src/commit/9dcfda045474d8903224d175907bfc29761dc… https://security.archlinux.org/CVE-2020-7247

1 0

[ASA-202001-5] chromium: multiple issues
by Remi Gacogne 17 Jan '20

17 Jan '20

Arch Linux Security Advisory ASA-202001-5 ========================================= Severity: Critical Date : 2020-01-17 CVE-ID : CVE-2020-6378 CVE-2020-6379 CVE-2020-6380 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1088 Summary ======= The package chromium before version 79.0.3945.130-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 79.0.3945.130-1. # pacman -Syu "chromium>=79.0.3945.130-1" The problems have been fixed upstream in version 79.0.3945.130. Workaround ========== None. Description =========== - CVE-2020-6378 (arbitrary code execution) A use-after-free vulnerability has been found in the speech recognizer component of the chromium browser before 79.0.3945.130. - CVE-2020-6379 (arbitrary code execution) A use-after-free vulnerability has been found in the speech recognizer component of the chromium browser before 79.0.3945.130. - CVE-2020-6380 (insufficient validation) An extension message verification error has been found in the chromium browser before 79.0.3945.130. Impact ====== A remote attacker can bypass security measures or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-des… https://crbug.com/1018677 https://crbug.com/1033407 https://crbug.com/1032170 https://security.archlinux.org/CVE-2020-6378 https://security.archlinux.org/CVE-2020-6379 https://security.archlinux.org/CVE-2020-6380

1 0