- Arch-security - lists.archlinux.org

[ASA-201906-5] pam-u2f: information disclosure
by Remi Gacogne 08 Jun '19

08 Jun '19

Arch Linux Security Advisory ASA-201906-5 ========================================= Severity: Medium Date : 2019-06-07 CVE-ID : CVE-2019-12209 CVE-2019-12210 Package : pam-u2f Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-973 Summary ======= The package pam-u2f before version 1.0.8-2 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.0.8-2. # pacman -Syu "pam-u2f>=1.0.8-2" The problems have been fixed upstream in version 1.0.8. Workaround ========== A major mitigation for both issues is to remove the `debug` and `debug_file` options for `pam_u2f.so` in the PAM configuration. Furthermore enabling the `openasuser` option will mitigate the symlink attack in CVE-2019-12209. Description =========== - CVE-2019-12209 (information disclosure) A symbolic link attack has been found in pam-u2f before 1.8.0. The file `$HOME/.config/Yubico/u2f_keys` is blindly followed by the PAM module. It can be a symlink pointing to an arbitrary file. The PAM module only rejects non-regular files and files owned by other users than root or the to-be-authenticated user. Even these checks are only made after open()'ing the file, which may already trigger certain logic in the kernel that is otherwise not reachable to regular users. If the PAM modules' `debug` option is also enabled then most of the content of the file is written either to stdout, stderr, syslog or to the defined debug file. Therefore this can pose an information leak to access e.g. the contents of /etc/shadow, /root/.bash_history or similar sensitive files. Furthermore the symlink attack can be used to use other users' u2f_keys files in the authentication process. - CVE-2019-12210 (information disclosure) A file descriptor leak has been found in pam-u2f before 1.8.0. If the `debug` and `debug_file` options are set then the opened debug file will be inherited to the successfully authenticated user's process. Therefore this user can write further information to it, possibly filling up a privileged file system or manipulating the information found in the debug file. This can leak sensitive information and also, if written to, be used to fill the disk or plant misinformation. Impact ====== An authenticated user can access sensitive information via a crafted symlink or a leaked file descriptor. References ========== https://seclists.org/oss-sec/2019/q2/149 https://bugzilla.suse.com/show_bug.cgi?id=1087061 https://github.com/Yubico/pam-u2f/commit/7db3386fcdb454e33a3ea30dcfb8e8960d… https://github.com/Yubico/pam-u2f/commit/18b1914e32b74ff52000f10e97067e841e… https://security.archlinux.org/CVE-2019-12209 https://security.archlinux.org/CVE-2019-12210

1 0

[ASA-201906-4] chromium: multiple issues
by Remi Gacogne 08 Jun '19

08 Jun '19

Arch Linux Security Advisory ASA-201906-4 ========================================= Severity: Critical Date : 2019-06-07 CVE-ID : CVE-2019-5828 CVE-2019-5829 CVE-2019-5830 CVE-2019-5831 CVE-2019-5832 CVE-2019-5833 CVE-2019-5835 CVE-2019-5836 CVE-2019-5837 CVE-2019-5838 CVE-2019-5839 CVE-2019-5840 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-972 Summary ======= The package chromium before version 75.0.3770.80-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing, incorrect calculation and information disclosure. Resolution ========== Upgrade to 75.0.3770.80-1. # pacman -Syu "chromium>=75.0.3770.80-1" The problems have been fixed upstream in version 75.0.3770.80. Workaround ========== None. Description =========== - CVE-2019-5828 (arbitrary code execution) A use-after-free vulnerability has been found in the ServiceWorker component of the chromium browser before 75.0.3770.80. - CVE-2019-5829 (arbitrary code execution) A use-after-free vulnerability has been found in the Download Manager component of the chromium browser before 75.0.3770.80. - CVE-2019-5830 (access restriction bypass) An incorrectly credentialed requests vulnerability has been found in the CORS component of the chromium browser before 75.0.3770.80. - CVE-2019-5831 (incorrect calculation) An incorrect map processing vulnerability has been found in the V8 component of the chromium browser before 75.0.3770.80. - CVE-2019-5832 (access restriction bypass) An incorrect CORS handling vulnerability has been found in the XHR component of the chromium browser before 75.0.3770.80. - CVE-2019-5833 (content spoofing) An inconsistent security UI placement vulnerability has been found in the chromium browser before 75.0.3770.80. - CVE-2019-5835 (information disclosure) An out-of-bounds read vulnerability has been found in the Swiftshader component of the chromium browser before 75.0.3770.80. - CVE-2019-5836 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the Angle component of the chromium browser before 75.0.3770.80. - CVE-2019-5837 (information disclosure) A cross-origin resources size disclosure vulnerability has been found in the Appcache component of the chromium browser before 75.0.3770.80. - CVE-2019-5838 (access restriction bypass) An overly permissive tab access vulnerability has been found in the Extensions component of the chromium browser before 75.0.3770.80. - CVE-2019-5839 (access restriction bypass) An incorrect handling of certain code points vulnerability has been found in the Blink component of the chromium browser before 75.0.3770.80. - CVE-2019-5840 (access restriction bypass) A popup blocker bypass vulnerability has been found in the chromium browser before 75.0.3770.80. Impact ====== A remote attacker can access sensitive information, bypass security measures, spoof content and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2019/06/stable-channel-update-for-des… https://crbug.com/956597 https://crbug.com/958533 https://crbug.com/665766 https://crbug.com/950328 https://crbug.com/959390 https://crbug.com/945067 https://crbug.com/939239 https://crbug.com/947342 https://crbug.com/918293 https://crbug.com/893087 https://crbug.com/925614 https://crbug.com/951782 https://security.archlinux.org/CVE-2019-5828 https://security.archlinux.org/CVE-2019-5829 https://security.archlinux.org/CVE-2019-5830 https://security.archlinux.org/CVE-2019-5831 https://security.archlinux.org/CVE-2019-5832 https://security.archlinux.org/CVE-2019-5833 https://security.archlinux.org/CVE-2019-5835 https://security.archlinux.org/CVE-2019-5836 https://security.archlinux.org/CVE-2019-5837 https://security.archlinux.org/CVE-2019-5838 https://security.archlinux.org/CVE-2019-5839 https://security.archlinux.org/CVE-2019-5840

1 0

[ASA-201906-3] binutils: multiple issues
by Morten Linderud 05 Jun '19

05 Jun '19

Arch Linux Security Advisory ASA-201906-3 ========================================= Severity: High Date : 2019-06-04 CVE-ID : CVE-2018-19931 CVE-2018-19932 CVE-2018-20002 CVE-2018-20712 Package : binutils Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-832 Summary ======= The package binutils before version 2.32-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.32-1. # pacman -Syu "binutils>=2.32-1" The problems have been fixed upstream in version 2.32. Workaround ========== None. Description =========== - CVE-2018-19931 (arbitrary code execution) An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is a heap-based buffer overflow in bfd_elf32_swap_phdr_in in elfcode.h because the number of program headers is not restricted. - CVE-2018-19932 (denial of service) An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils through 2.31. There is an integer overflow and infinite loop caused by the IS_CONTAINED_BY_LMA macro in elf.c. - CVE-2018-20002 (denial of service) The _bfd_generic_read_minisymbols function in syms.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31, has a memory leak via a crafted ELF file, leading to a denial of service (memory consumption), as demonstrated by nm. - CVE-2018-20712 (denial of service) A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of- service, as demonstrated by c++filt. Impact ====== An attacker is able to crash or execute arbitrary code on a process that uses libbfd functions by providing a malicious object file. References ========== https://www.securityfocus.com/bid/106144 https://www.securityfocus.com/bid/106142 https://sourceware.org/bugzilla/show_bug.cgi?id=23942 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5f60af5d24d18137… https://sourceware.org/bugzilla/show_bug.cgi?id=23932 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=beab453223769279… https://sourceware.org/bugzilla/show_bug.cgi?id=23952 https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c2f5dc30afa34696… http://www.securityfocus.com/bid/106563 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88629 https://sourceware.org/bugzilla/show_bug.cgi?id=24043 https://security.archlinux.org/CVE-2018-19931 https://security.archlinux.org/CVE-2018-19932 https://security.archlinux.org/CVE-2018-20002 https://security.archlinux.org/CVE-2018-20712

1 0

[ASA-201906-2] python-django: cross-site scripting
by Jelle van der Waa 04 Jun '19

04 Jun '19

Arch Linux Security Advisory ASA-201906-2 ========================================= Severity: Medium Date : 2019-06-04 CVE-ID : CVE-2019-11358 CVE-2019-12308 Package : python-django Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-969 Summary ======= The package python-django before version 2.2.2-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 2.2.2-1. # pacman -Syu "python-django>=2.2.2-1" The problems have been fixed upstream in version 2.2.2. Workaround ========== None. Description =========== - CVE-2019-11358 (cross-site scripting) jQuery before 3.4.0, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. The bundled version of jQuery used by the Django admin has been patched to allow for the select2 library's use of jQuery.extend(). - CVE-2019-12308 (cross-site scripting) The clickable "Current URL" link generated by AdminURLFieldWidget displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. AdminURLFieldWidget now validates the provided value using URLValidator before displaying the clickable link. You may customise the validator by passing a validator_class kwarg to AdminURLFieldWidget.__init__(), e.g. when using ModelAdmin.formfield_overrides. Impact ====== A remote attacker is able to execute javascript and create html content in the admin view or by extending the native Object.prototype via jQuery.extend. References ========== https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ https://github.com/django/django/commit/baaf187a4e354bf3976c51e2c83a0d2f8ee… https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b… https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e813… https://security.archlinux.org/CVE-2019-11358 https://security.archlinux.org/CVE-2019-12308

1 0

[ASA-201906-1] python2-django: cross-site scripting
by Jelle van der Waa 04 Jun '19

04 Jun '19

Arch Linux Security Advisory ASA-201906-1 ========================================= Severity: Medium Date : 2019-06-04 CVE-ID : CVE-2019-12308 Package : python2-django Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-970 Summary ======= The package python2-django before version 1.11.21-1 is vulnerable to cross-site scripting. Resolution ========== Upgrade to 1.11.21-1. # pacman -Syu "python2-django>=1.11.21-1" The problem has been fixed upstream in version 1.11.21. Workaround ========== None. Description =========== The clickable "Current URL" link generated by AdminURLFieldWidget displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. AdminURLFieldWidget now validates the provided value using URLValidator before displaying the clickable link. You may customise the validator by passing a validator_class kwarg to AdminURLFieldWidget.__init__(), e.g. when using ModelAdmin.formfield_overrides. Impact ====== A remote attacker is able to execute javascript and create html content in the admin view. References ========== https://www.djangoproject.com/weblog/2019/jun/03/security-releases/ https://github.com/django/django/commit/afddabf8428ddc89a332f7a78d0d21eaf2b… https://github.com/django/django/commit/c238701859a52d584f349cce15d56c8e813… https://security.archlinux.org/CVE-2019-12308

1 0

[ASA-201905-17] live-media: multiple issues
by Remi Gacogne 31 May '19

31 May '19

Arch Linux Security Advisory ASA-201905-17 ========================================== Severity: Critical Date : 2019-05-31 CVE-ID : CVE-2019-7314 CVE-2019-7733 Package : live-media Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-870 Summary ======= The package live-media before version 2019.05.12-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2019.05.12-1. # pacman -Syu "live-media>=2019.05.12-1" The problems have been fixed upstream in version 2019.05.12. Workaround ========== None. Description =========== - CVE-2019-7314 (arbitrary code execution) liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could lead to a use-after-free error that causes the RTSP server to crash (Segmentation fault) or possibly have unspecified other impact. - CVE-2019-7733 (denial of service) In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (username, realm, nonce, uri, or response), only the last instance can ever be freed. Impact ====== A remote attacker can cause a crash or execute arbitrary code on the affected host via a crafted stream packet. References ========== http://lists.live555.com/pipermail/live-devel/2019-February/021143.html http://www.live555.com/liveMedia/public/changelog.txt https://github.com/rgaufman/live555/issues/21 https://security.archlinux.org/CVE-2019-7314 https://security.archlinux.org/CVE-2019-7733

1 0

[ASA-201905-16] curl: arbitrary code execution
by Remi Gacogne 31 May '19

31 May '19

Arch Linux Security Advisory ASA-201905-16 ========================================== Severity: High Date : 2019-05-31 CVE-ID : CVE-2019-5436 Package : curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-964 Summary ======= The package curl before version 7.65.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.65.0-1. # pacman -Syu "curl>=7.65.0-1" The problem has been fixed upstream in version 7.65.0. Workaround ========== None. Description =========== libcurl before 7.65.0 contains a heap buffer overflow in the function (tftp_receive_packet()) that receives data from a TFTP server. It calls recvfrom() with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is entirely controlled by the server. The flaw exists if the user selects to use a "blksize" of 504 or smaller (default is 512). The smaller size that is used, the larger the possible overflow becomes. Users choosing a smaller size than default should be rare as the primary use case for changing the size is to make it larger. Impact ====== A malicious TFTP server can execute arbitrary code on the affected host. References ========== https://curl.haxx.se/docs/CVE-2019-5436.html https://github.com/curl/curl/commit/2576003415625d7b5f0e390902f8097830b82275 https://security.archlinux.org/CVE-2019-5436

1 0

[ASA-201905-15] lib32-curl: arbitrary code execution
by Remi Gacogne 31 May '19

31 May '19

Arch Linux Security Advisory ASA-201905-15 ========================================== Severity: High Date : 2019-05-31 CVE-ID : CVE-2019-5435 CVE-2019-5436 Package : lib32-curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-963 Summary ======= The package lib32-curl before version 7.65.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.65.0-1. # pacman -Syu "lib32-curl>=7.65.0-1" The problems have been fixed upstream in version 7.65.0. Workaround ========== None. Description =========== - CVE-2019-5435 (arbitrary code execution) libcurl before 7.65.0 contains two integer overflows in the curl_url_set() function that if triggered, can lead to a too small buffer allocation and a subsequent heap buffer overflow. The flaws only exist on 32 bit architectures and require excessive string input lengths. - CVE-2019-5436 (arbitrary code execution) libcurl before 7.65.0 contains a heap buffer overflow in the function (tftp_receive_packet()) that receives data from a TFTP server. It calls recvfrom() with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is entirely controlled by the server. The flaw exists if the user selects to use a "blksize" of 504 or smaller (default is 512). The smaller size that is used, the larger the possible overflow becomes. Users choosing a smaller size than default should be rare as the primary use case for changing the size is to make it larger. Impact ====== A malicious TFTP server can execute arbitrary code on the affected host. A remote attacker can execute arbitrary code on the affected host via a crafted URL part of excessive length. References ========== https://curl.haxx.se/docs/CVE-2019-5435.html https://curl.haxx.se/docs/CVE-2019-5436.html https://github.com/curl/curl/commit/5fc28510a4664f4 https://github.com/curl/curl/commit/2576003415625d7b5f0e390902f8097830b82275 https://security.archlinux.org/CVE-2019-5435 https://security.archlinux.org/CVE-2019-5436

1 0

[ASA-201905-14] lib32-libcurl-compat: arbitrary code execution
by Remi Gacogne 31 May '19

31 May '19

Arch Linux Security Advisory ASA-201905-14 ========================================== Severity: High Date : 2019-05-31 CVE-ID : CVE-2019-5435 CVE-2019-5436 Package : lib32-libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-962 Summary ======= The package lib32-libcurl-compat before version 7.65.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.65.0-1. # pacman -Syu "lib32-libcurl-compat>=7.65.0-1" The problems have been fixed upstream in version 7.65.0. Workaround ========== None. Description =========== - CVE-2019-5435 (arbitrary code execution) libcurl before 7.65.0 contains two integer overflows in the curl_url_set() function that if triggered, can lead to a too small buffer allocation and a subsequent heap buffer overflow. The flaws only exist on 32 bit architectures and require excessive string input lengths. - CVE-2019-5436 (arbitrary code execution) libcurl before 7.65.0 contains a heap buffer overflow in the function (tftp_receive_packet()) that receives data from a TFTP server. It calls recvfrom() with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is entirely controlled by the server. The flaw exists if the user selects to use a "blksize" of 504 or smaller (default is 512). The smaller size that is used, the larger the possible overflow becomes. Users choosing a smaller size than default should be rare as the primary use case for changing the size is to make it larger. Impact ====== A malicious TFTP server can execute arbitrary code on the affected host. A remote attacker can execute arbitrary code on the affected host via a crafted URL part of excessive length. References ========== https://curl.haxx.se/docs/CVE-2019-5435.html https://curl.haxx.se/docs/CVE-2019-5436.html https://github.com/curl/curl/commit/5fc28510a4664f4 https://github.com/curl/curl/commit/2576003415625d7b5f0e390902f8097830b82275 https://security.archlinux.org/CVE-2019-5435 https://security.archlinux.org/CVE-2019-5436

1 0

[ASA-201905-13] lib32-libcurl-gnutls: arbitrary code execution
by Remi Gacogne 31 May '19

31 May '19

Arch Linux Security Advisory ASA-201905-13 ========================================== Severity: High Date : 2019-05-31 CVE-ID : CVE-2019-5435 CVE-2019-5436 Package : lib32-libcurl-gnutls Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-961 Summary ======= The package lib32-libcurl-gnutls before version 7.65.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.65.0-1. # pacman -Syu "lib32-libcurl-gnutls>=7.65.0-1" The problems have been fixed upstream in version 7.65.0. Workaround ========== None. Description =========== - CVE-2019-5435 (arbitrary code execution) libcurl before 7.65.0 contains two integer overflows in the curl_url_set() function that if triggered, can lead to a too small buffer allocation and a subsequent heap buffer overflow. The flaws only exist on 32 bit architectures and require excessive string input lengths. - CVE-2019-5436 (arbitrary code execution) libcurl before 7.65.0 contains a heap buffer overflow in the function (tftp_receive_packet()) that receives data from a TFTP server. It calls recvfrom() with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is entirely controlled by the server. The flaw exists if the user selects to use a "blksize" of 504 or smaller (default is 512). The smaller size that is used, the larger the possible overflow becomes. Users choosing a smaller size than default should be rare as the primary use case for changing the size is to make it larger. Impact ====== A malicious TFTP server can execute arbitrary code on the affected host. A remote attacker can execute arbitrary code on the affected host via a crafted URL part of excessive length. References ========== https://curl.haxx.se/docs/CVE-2019-5435.html https://curl.haxx.se/docs/CVE-2019-5436.html https://github.com/curl/curl/commit/5fc28510a4664f4 https://github.com/curl/curl/commit/2576003415625d7b5f0e390902f8097830b82275 https://security.archlinux.org/CVE-2019-5435 https://security.archlinux.org/CVE-2019-5436

1 0