- Arch-security - lists.archlinux.org

[ASA-201906-15] linux-zen: denial of service
by Morten Linderud 18 Jun '19

18 Jun '19

Arch Linux Security Advisory ASA-201906-15 ========================================== Severity: High Date : 2019-06-18 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux-zen Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-985 Summary ======= The package linux-zen before version 5.1.11.zen1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.1.11.zen1-1. # pacman -Syu "linux-zen>=5.1.11.zen1-1" The problems have been fixed upstream in version 5.1.11.zen1. Workaround ========== - CVE-2019-11477 and CVE-2019-11478 $ sudo sysctl -w net.ipv4.tcp_sack=0 The mitigation described below for CVE-2019-11479 is also sufficient for CVE-2019-11477 and CVE-2019-11478 if disabling TCP SACK support is not viable. - CVE-2019-11479 $ sudo iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP The net.ipv4.tcp_mtu_probing sysctl must be disabled (set to 0) when using the iptables rules shown above. Description =========== - CVE-2019-11477 (denial of service) An integer overflow has been discovered in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A sequence of SACKs may be crafted such that one can trigger a kernel panic. A remote attacker could use this to cause a denial of service (system crash). - CVE-2019-11478 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection. - CVE-2019-11479 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP segments. If the Maximum Segment Size (MSS) of a TCP connection was set to low values, such as 48 bytes, it can leave as little as 8 bytes for the user data, which significantly increases the Linux kernel's resource (CPU, Memory, and Bandwidth) utilization. A remote attacker could use this flaw to cause a denial of service (DoS) by repeatedly sending network traffic on a TCP connection with low TCP MSS. Impact ====== A remote attacker is able to crash the system by sending specially crafted TCP packets. References ========== https://www.openwall.com/lists/oss-security/2019/06/17/5 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-11477 https://security.archlinux.org/CVE-2019-11478 https://security.archlinux.org/CVE-2019-11479

1 0

[ASA-201906-14] linux-lts: denial of service
by Morten Linderud 18 Jun '19

18 Jun '19

Arch Linux Security Advisory ASA-201906-14 ========================================== Severity: High Date : 2019-06-18 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux-lts Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-984 Summary ======= The package linux-lts before version 4.19.52-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.19.52-1. # pacman -Syu "linux-lts>=4.19.52-1" The problems have been fixed upstream in version 4.19.52. Workaround ========== - CVE-2019-11477 and CVE-2019-11478 $ sudo sysctl -w net.ipv4.tcp_sack=0 The mitigation described below for CVE-2019-11479 is also sufficient for CVE-2019-11477 and CVE-2019-11478 if disabling TCP SACK support is not viable. - CVE-2019-11479 $ sudo iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP The net.ipv4.tcp_mtu_probing sysctl must be disabled (set to 0) when using the iptables rules shown above. Description =========== - CVE-2019-11477 (denial of service) An integer overflow has been discovered in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A sequence of SACKs may be crafted such that one can trigger a kernel panic. A remote attacker could use this to cause a denial of service (system crash). - CVE-2019-11478 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection. - CVE-2019-11479 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP segments. If the Maximum Segment Size (MSS) of a TCP connection was set to low values, such as 48 bytes, it can leave as little as 8 bytes for the user data, which significantly increases the Linux kernel's resource (CPU, Memory, and Bandwidth) utilization. A remote attacker could use this flaw to cause a denial of service (DoS) by repeatedly sending network traffic on a TCP connection with low TCP MSS. Impact ====== A remote attacker is able to crash the system by sending specially crafted TCP packets. References ========== https://www.openwall.com/lists/oss-security/2019/06/17/5 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-11477 https://security.archlinux.org/CVE-2019-11478 https://security.archlinux.org/CVE-2019-11479

1 0

[ASA-201906-13] linux: denial of service
by Morten Linderud 18 Jun '19

18 Jun '19

Arch Linux Security Advisory ASA-201906-13 ========================================== Severity: High Date : 2019-06-18 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-983 Summary ======= The package linux before version 5.1.11.arch1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.1.11.arch1-1. # pacman -Syu "linux>=5.1.11.arch1-1" The problems have been fixed upstream in version 5.1.11.arch1. Workaround ========== - CVE-2019-11477 and CVE-2019-11478 $ sudo sysctl -w net.ipv4.tcp_sack=0 The mitigation described below for CVE-2019-11479 is also sufficient for CVE-2019-11477 and CVE-2019-11478 if disabling TCP SACK support is not viable. - CVE-2019-11479 $ sudo iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP The net.ipv4.tcp_mtu_probing sysctl must be disabled (set to 0) when using the iptables rules shown above. Description =========== - CVE-2019-11477 (denial of service) An integer overflow has been discovered in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A sequence of SACKs may be crafted such that one can trigger a kernel panic. A remote attacker could use this to cause a denial of service (system crash). - CVE-2019-11478 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection. - CVE-2019-11479 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP segments. If the Maximum Segment Size (MSS) of a TCP connection was set to low values, such as 48 bytes, it can leave as little as 8 bytes for the user data, which significantly increases the Linux kernel's resource (CPU, Memory, and Bandwidth) utilization. A remote attacker could use this flaw to cause a denial of service (DoS) by repeatedly sending network traffic on a TCP connection with low TCP MSS. Impact ====== A remote attacker is able to crash the system by sending specially crafted TCP packets. References ========== https://www.openwall.com/lists/oss-security/2019/06/17/5 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-11477 https://security.archlinux.org/CVE-2019-11478 https://security.archlinux.org/CVE-2019-11479

1 0

[ASA-201906-12] linux-hardened: denial of service
by Levente Polyak 18 Jun '19

18 Jun '19

Arch Linux Security Advisory ASA-201906-12 ========================================== Severity: High Date : 2019-06-17 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux-hardened Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-986 Summary ======= The package linux-hardened before version 5.1.11.a-1 is vulnerable to denial of service. Resolution ========== Upgrade to 5.1.11.a-1. # pacman -Syu "linux-hardened>=5.1.11.a-1" The problems have been fixed upstream in version 5.1.11.a. Workaround ========== - CVE-2019-11477 and CVE-2019-11478 $ sudo sysctl -w net.ipv4.tcp_sack=0 The mitigation described below for CVE-2019-11479 is also sufficient for CVE-2019-11477 and CVE-2019-11478 if disabling TCP SACK support is not viable. - CVE-2019-11479 $ sudo iptables -A INPUT -p tcp -m tcpmss --mss 1:500 -j DROP The net.ipv4.tcp_mtu_probing sysctl must be disabled (set to 0) when using the iptables rules shown above. Description =========== - CVE-2019-11477 (denial of service) An integer overflow has been discovered in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A sequence of SACKs may be crafted such that one can trigger a kernel panic. A remote attacker could use this to cause a denial of service (system crash). - CVE-2019-11478 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection. - CVE-2019-11479 (denial of service) An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP segments. If the Maximum Segment Size (MSS) of a TCP connection was set to low values, such as 48 bytes, it can leave as little as 8 bytes for the user data, which significantly increases the Linux kernel's resource (CPU, Memory, and Bandwidth) utilization. A remote attacker could use this flaw to cause a denial of service (DoS) by repeatedly sending network traffic on a TCP connection with low TCP MSS. Impact ====== A remote attacker is able to crash the system by sending specially crafted TCP packets. References ========== https://www.openwall.com/lists/oss-security/2019/06/17/5 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-11477 https://security.archlinux.org/CVE-2019-11478 https://security.archlinux.org/CVE-2019-11479

1 0

[ASA-201906-11] chromium: arbitrary code execution
by Remi Gacogne 14 Jun '19

14 Jun '19

Arch Linux Security Advisory ASA-201906-11 ========================================== Severity: High Date : 2019-06-14 CVE-ID : CVE-2019-5842 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-981 Summary ======= The package chromium before version 75.0.3770.90-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 75.0.3770.90-1. # pacman -Syu "chromium>=75.0.3770.90-1" The problem has been fixed upstream in version 75.0.3770.90. Workaround ========== None. Description =========== A use-after-free vulnerability has been found in the Blink component of the chromium browser before 75.0.3770.90. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-des… https://crbug.com/961413 https://security.archlinux.org/CVE-2019-5842

1 0

[ASA-201906-10] thunderbird: multiple issues
by Remi Gacogne 14 Jun '19

14 Jun '19

Arch Linux Security Advisory ASA-201906-10 ========================================== Severity: High Date : 2019-06-14 CVE-ID : CVE-2019-11703 CVE-2019-11704 CVE-2019-11705 CVE-2019-11706 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-980 Summary ======= The package thunderbird before version 60.7.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 60.7.1-1. # pacman -Syu "thunderbird>=60.7.1-1" The problems have been fixed upstream in version 60.7.1. Workaround ========== None. Description =========== - CVE-2019-11703 (arbitrary code execution) A flaw in Thunderbird's implementation of iCal before 60.7.1 causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable crash. - CVE-2019-11704 (arbitrary code execution) A flaw in Thunderbird's implementation of iCal before 60.7.1 causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially exploitable crash. - CVE-2019-11705 (arbitrary code execution) A flaw in Thunderbird's implementation of iCal before 60.7.1 causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially exploitable crash. - CVE-2019-11706 (denial of service) A flaw in Thunderbird's implementation of iCal before 60.7.1 causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulting in a crash. Impact ====== A remote attacker can crash thunderbird or execute arbitrary code on the affected host via a crafted email message. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1553820 https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1553814 https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1553808 https://www.mozilla.org/en-US/security/advisories/mfsa2019-17/#CVE-2019-117… https://security.archlinux.org/CVE-2019-11703 https://security.archlinux.org/CVE-2019-11704 https://security.archlinux.org/CVE-2019-11705 https://security.archlinux.org/CVE-2019-11706

1 0

[ASA-201906-9] gvim: arbitrary code execution
by Morten Linderud 13 Jun '19

13 Jun '19

Arch Linux Security Advisory ASA-201906-9 ========================================= Severity: High Date : 2019-06-11 CVE-ID : CVE-2019-12735 Package : gvim Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-976 Summary ======= The package gvim before version 8.1.1467-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.1.1467-1. # pacman -Syu "gvim>=8.1.1467-1" The problem has been fixed upstream in version 8.1.1467. Workaround ========== Disable modeline support in the vimrc file by setting: set nomodeline Description =========== getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. Impact ====== A remote attacker could execute code with a maliciously written file. References ========== https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040 https://security.archlinux.org/CVE-2019-12735

1 0

[ASA-201906-8] vim: arbitrary code execution
by Morten Linderud 13 Jun '19

13 Jun '19

Arch Linux Security Advisory ASA-201906-8 ========================================= Severity: High Date : 2019-06-11 CVE-ID : CVE-2019-12735 Package : vim Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-975 Summary ======= The package vim before version 8.1.1467-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 8.1.1467-1. # pacman -Syu "vim>=8.1.1467-1" The problem has been fixed upstream in version 8.1.1467. Workaround ========== Disable modeline support in the vimrc file by setting: set nomodeline Description =========== getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim. Impact ====== A remote attacker could execute code with a maliciously written file. References ========== https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040 https://security.archlinux.org/CVE-2019-12735

1 0

[ASA-201906-7] openssl: information disclosure
by Morten Linderud 13 Jun '19

13 Jun '19

Arch Linux Security Advisory ASA-201906-7 ========================================= Severity: Low Date : 2019-06-11 CVE-ID : CVE-2019-1543 Package : openssl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-919 Summary ======= The package openssl before version 1.1.1.c-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.1.1.c-1. # pacman -Syu "openssl>=1.1.1.c-1" The problem has been fixed upstream in version 1.1.1.c. Workaround ========== None. Description =========== An issue has been found in OpenSSL <= 1.1.1b, where an application using ChaCha20-Poly1305 could set a non-default nonce length to be longer than 12 bytes and then mistakenly reuse a nonce. ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. Impact ====== A remote attacker could disclose sensitive information via an invalid nonce. References ========== https://www.openssl.org/news/secadv/20190306.txt https://github.com/openssl/openssl/commit/f426625b6a https://security.archlinux.org/CVE-2019-1543

1 0

[ASA-201906-6] lib32-openssl: information disclosure
by Morten Linderud 13 Jun '19

13 Jun '19

Arch Linux Security Advisory ASA-201906-6 ========================================= Severity: Low Date : 2019-06-11 CVE-ID : CVE-2019-1543 Package : lib32-openssl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-920 Summary ======= The package lib32-openssl before version 1:1.1.1.c-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1:1.1.1.c-1. # pacman -Syu "lib32-openssl>=1:1.1.1.c-1" The problem has been fixed upstream in version 1.1.1.c. Workaround ========== None. Description =========== An issue has been found in OpenSSL <= 1.1.1b, where an application using ChaCha20-Poly1305 could set a non-default nonce length to be longer than 12 bytes and then mistakenly reuse a nonce. ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. Impact ====== A remote attacker could disclose sensitive information via an invalid nonce. References ========== https://www.openssl.org/news/secadv/20190306.txt https://github.com/openssl/openssl/commit/f426625b6a https://security.archlinux.org/CVE-2019-1543

1 0