- Arch-security - lists.archlinux.org

[ASA-201905-2] linux: arbitrary code execution
by Santiago Torres-Arias 07 May '19

07 May '19

Arch Linux Security Advisory ASA-201905-2 ========================================= Severity: High Date : 2019-05-06 CVE-ID : CVE-2019-11683 Package : linux Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-955 Summary ======= The package linux before version 5.0.12.arch2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.0.12.arch2-1. # pacman -Syu "linux>=5.0.12.arch2-1" The problem has been fixed upstream in version 5.0.12.arch2. Workaround ========== None. Description =========== udp_gro_receive_segment in net/ipv4/udp_offload.c in the Linux kernel 5.x through 5.0.11 allows remote attackers to cause a denial of service (slab-out-of-bounds memory corruption) or possibly have unspecified other impact via UDP packets with a 0 payload, because of mishandling of padded packets, aka the "GRO packet of death" issue. Impact ====== A remote attacker is able to cause a denial of service possibly leading to remote code execution by sending UDP packets with a special payload. References ========== https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d… http://www.securityfocus.com/bid/108142 http://www.openwall.com/lists/oss-security/2019/05/05/4 http://www.openwall.com/lists/oss-security/2019/05/02/1 https://security.archlinux.org/CVE-2019-11683

1 0

[ASA-201905-1] munin: arbitrary file overwrite
by Santiago Torres-Arias 07 May '19

07 May '19

Arch Linux Security Advisory ASA-201905-1 ========================================= Severity: High Date : 2019-05-06 CVE-ID : CVE-2017-6188 Package : munin Type : arbitrary file overwrite Remote : Yes Link : https://security.archlinux.org/AVG-953 Summary ======= The package munin before version 2.0.47-1 is vulnerable to arbitrary file overwrite. Resolution ========== Upgrade to 2.0.47-1. # pacman -Syu "munin>=2.0.47-1" The problem has been fixed upstream in version 2.0.47. Workaround ========== None. Description =========== A vulnerability in munin allows attackers to overwrite any file accessible to the webserver user by setting multiple upper_limit GET parameters when CGI graphs are enabled. Impact ====== A remote attacker is able to overwrite arbitrary files on the filesystem. References ========== https://bugs.archlinux.org/task/57537 https://www.debian.org/security/2017/dsa-3794 https://github.com/munin-monitoring/munin/pull/797/commits/42ce18f24d3eae8b… https://security.archlinux.org/CVE-2017-6188

1 0

[ASA-201904-12] chromium: multiple issues
by Remi Gacogne 26 Apr '19

26 Apr '19

Arch Linux Security Advisory ASA-201904-12 ========================================== Severity: Critical Date : 2019-04-24 CVE-ID : CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5818 CVE-2019-5819 CVE-2019-5820 CVE-2019-5821 CVE-2019-5822 CVE-2019-5823 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-952 Summary ======= The package chromium before version 74.0.3729.108-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, information disclosure and insufficient validation. Resolution ========== Upgrade to 74.0.3729.108-1. # pacman -Syu "chromium>=74.0.3729.108-1" The problems have been fixed upstream in version 74.0.3729.108. Workaround ========== None. Description =========== - CVE-2019-5805 (arbitrary code execution) A use-after-free vulnerability has been found in the PDFium component of the chromium browser before 74.0.3729.108. - CVE-2019-5806 (arbitrary code execution) An integer overflow vulnerability has been found in the Andle component of the chromium browser before 74.0.3729.108. - CVE-2019-5807 (arbitrary code execution) A memory corruption vulnerability has been found in the V8 component of the chromium browser before 74.0.3729.108. - CVE-2019-5808 (arbitrary code execution) A use-after-free vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5809 (arbitrary code execution) A use-after-free vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5810 (information disclosure) A user information disclosure vulnerability has been found in the Autofill component of the chromium browser before 74.0.3729.108. - CVE-2019-5811 (access restriction bypass) A CORS bypass vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5813 (information disclosure) An out-of-bounds read vulnerability has been found in the V8 component of the chromium browser before 74.0.3729.108. - CVE-2019-5814 (access restriction bypass) A CORS bypass vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5815 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the Blink component of the chromium browser before 74.0.3729.108. - CVE-2019-5818 (information disclosure) An uninitialized value vulnerability has been found in the media reader component of the chromium browser before 74.0.3729.108. - CVE-2019-5819 (insufficient validation) An incorrect escaping vulnerability has been found in the developer tools component of the chromium browser before 74.0.3729.108. - CVE-2019-5820 (arbitrary code execution) An integer overflow vulnerability has been found in the PDFium component of the chromium browser before 74.0.3729.108. - CVE-2019-5821 (arbitrary code execution) An integer overflow vulnerability has been found in the PDFium component of the chromium browser before 74.0.3729.108. - CVE-2019-5822 (access restriction bypass) A CORS bypass vulnerability has been found in the download manager component of the chromium browser before 74.0.3729.108. - CVE-2019-5823 (access restriction bypass) A forced navigation from service worker vulnerability has been found in the chromium browser before 74.0.3729.108. Impact ====== A remote attacker can access sensitive information, bypass security measures and execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-des… https://crbug.com/913320 https://crbug.com/943087 https://crbug.com/945644 https://crbug.com/947029 https://crbug.com/941008 https://crbug.com/916838 https://crbug.com/771815 https://crbug.com/942699 https://crbug.com/930057 https://crbug.com/930663 https://crbug.com/929962 https://crbug.com/919356 https://crbug.com/919635 https://crbug.com/919640 https://crbug.com/926105 https://security.archlinux.org/CVE-2019-5805 https://security.archlinux.org/CVE-2019-5806 https://security.archlinux.org/CVE-2019-5807 https://security.archlinux.org/CVE-2019-5808 https://security.archlinux.org/CVE-2019-5809 https://security.archlinux.org/CVE-2019-5810 https://security.archlinux.org/CVE-2019-5811 https://security.archlinux.org/CVE-2019-5813 https://security.archlinux.org/CVE-2019-5814 https://security.archlinux.org/CVE-2019-5815 https://security.archlinux.org/CVE-2019-5818 https://security.archlinux.org/CVE-2019-5819 https://security.archlinux.org/CVE-2019-5820 https://security.archlinux.org/CVE-2019-5821 https://security.archlinux.org/CVE-2019-5822 https://security.archlinux.org/CVE-2019-5823

1 0

[ASA-201904-11] openssh: multiple issues
by Remi Gacogne 26 Apr '19

26 Apr '19

Arch Linux Security Advisory ASA-201904-11 ========================================== Severity: High Date : 2019-04-24 CVE-ID : CVE-2018-20685 CVE-2019-6109 CVE-2019-6111 Package : openssh Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-951 Summary ======= The package openssh before version 8.0p1-1 is vulnerable to multiple issues including insufficient validation, arbitrary file overwrite and content spoofing. Resolution ========== Upgrade to 8.0p1-1. # pacman -Syu "openssh>=8.0p1-1" The problems have been fixed upstream in version 8.0p1. Workaround ========== None. Description =========== - CVE-2018-20685 (insufficient validation) In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. - CVE-2019-6109 (content spoofing) An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The- Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c. - CVE-2019-6111 (arbitrary file overwrite) An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). Impact ====== A malicious SCP server can overwrite arbitrary files in the scp client target directory. References ========== https://www.openssh.com/txt/release-8.0 https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.1… https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c… https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt https://github.com/openssh/openssh-portable/commit/8976f1c4b2721c26e878151f… https://github.com/openssh/openssh-portable/commit/391ffc4b9d31fa1f4ad56649… https://security.archlinux.org/CVE-2018-20685 https://security.archlinux.org/CVE-2019-6109 https://security.archlinux.org/CVE-2019-6111

1 0

[ASA-201904-10] libpng: denial of service
by Remi Gacogne 26 Apr '19

26 Apr '19

Arch Linux Security Advisory ASA-201904-10 ========================================== Severity: Low Date : 2019-04-24 CVE-ID : CVE-2019-7317 Package : libpng Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-868 Summary ======= The package libpng before version 1.6.37-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.6.37-1. # pacman -Syu "libpng>=1.6.37-1" The problem has been fixed upstream in version 1.6.37. Workaround ========== None. Description =========== png_image_free in png.c in libpng 1.6.36 has a use-after-free because png_image_free_function is called under png_safe_execute. Impact ====== A remote attacker can crash an application using libpng via a crafted image. References ========== https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803 https://github.com/glennrp/libpng/issues/275 https://security.archlinux.org/CVE-2019-7317

1 0

[ASA-201904-9] dovecot: denial of service
by Remi Gacogne 24 Apr '19

24 Apr '19

Arch Linux Security Advisory ASA-201904-9 ========================================= Severity: Medium Date : 2019-04-18 CVE-ID : CVE-2019-10691 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-950 Summary ======= The package dovecot before version 2.3.5.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.3.5.2-1. # pacman -Syu "dovecot>=2.3.5.2-1" The problem has been fixed upstream in version 2.3.5.2. Workaround ========== None. Description =========== JSON encoder in Dovecot 2.3 incorrectly assert-crashes when encountering invalid UTF-8 characters. This can be used to crash dovecot in two ways. Attacker can repeatedly crash Dovecot authentication process by logging in using invalid UTF-8 sequence in username. This requires that auth policy is enabled. Crash can also occur if OX push notification driver is enabled and an email is delivered with invalid UTF-8 sequence in From or Subject header. In 2.2, malformed UTF-8 sequences are forwarded "as-is", and thus do not cause problems in Dovecot itself. Target systems should be checked for possible problems in dealing with such sequences. Impact ====== An attacker is able to crash the dovecot process by making it process a username or email containing an unsupported UTF-8 sequence. References ========== https://wiki.dovecot.org/Authentication/Policy https://security.archlinux.org/CVE-2019-10691

1 0

[ASA-201904-8] flashplugin: multiple issues
by Remi Gacogne 24 Apr '19

24 Apr '19

Arch Linux Security Advisory ASA-201904-8 ========================================= Severity: Critical Date : 2019-04-12 CVE-ID : CVE-2019-7096 CVE-2019-7108 Package : flashplugin Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-949 Summary ======= The package flashplugin before version 32.0.0.171-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 32.0.0.171-1. # pacman -Syu "flashplugin>=32.0.0.171-1" The problems have been fixed upstream in version 32.0.0.171. Workaround ========== None. Description =========== - CVE-2019-7096 (arbitrary code execution) An arbitrary code execution issue has been found in Adobe Flash Player before 32.0.0.171. - CVE-2019-7108 (information disclosure) An out-of-bounds read has been found in Adobe Flash Player before 32.0.0.171. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://helpx.adobe.com/security/products/flash-player/apsb19-19.html https://security.archlinux.org/CVE-2019-7096 https://security.archlinux.org/CVE-2019-7108

1 0

[ASA-201904-7] jenkins: multiple issues
by Remi Gacogne 24 Apr '19

24 Apr '19

Arch Linux Security Advisory ASA-201904-7 ========================================= Severity: Medium Date : 2019-04-11 CVE-ID : CVE-2019-1003049 CVE-2019-1003050 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-948 Summary ======= The package jenkins before version 2.172-1 is vulnerable to multiple issues including access restriction bypass and cross-site scripting. Resolution ========== Upgrade to 2.172-1. # pacman -Syu "jenkins>=2.172-1" The problems have been fixed upstream in version 2.172. Workaround ========== None. Description =========== - CVE-2019-1003049 (access restriction bypass) A security issue has been found in Jenkins before 2.172, where the fix for SECURITY-901 in Jenkins 2.150.2 and 2.160 did not reject existing remoting-based CLI authentication caches. This means that users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated. - CVE-2019-1003050 (cross-site scripting) The f:validateButton form control for the Jenkins UI did not properly escape job URLs. This resulted in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names. Impact ====== A remote attacker is able to bypass access restrictions or perform cross-site scripting. References ========== https://seclists.org/oss-sec/2019/q2/15 https://jenkins.io/security/advisory/2019-04-10/ https://security.archlinux.org/CVE-2019-1003049 https://security.archlinux.org/CVE-2019-1003050

1 0

[ASA-201904-5] ghostscript: sandbox escape
by Remi Gacogne 24 Apr '19

24 Apr '19

Arch Linux Security Advisory ASA-201904-5 ========================================= Severity: High Date : 2019-04-11 CVE-ID : CVE-2019-3835 CVE-2019-3838 Package : ghostscript Type : sandbox escape Remote : Yes Link : https://security.archlinux.org/AVG-929 Summary ======= The package ghostscript before version 9.27-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 9.27-1. # pacman -Syu "ghostscript>=9.27-1" The problems have been fixed upstream in version 9.27. Workaround ========== None. Description =========== - CVE-2019-3835 (sandbox escape) It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. - CVE-2019-3838 (sandbox escape) It was found that the forceput operator could be extracted from the DefineResource method using methods similar to the ones described in CVE-2019-6116. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Impact ====== A remote attacker is able to escape the sandbox via a specially crafted PostScript document. References ========== https://bugs.archlinux.org/task/62102 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d683d1e6 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd95bb01 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e8f95a https://security.archlinux.org/CVE-2019-3835 https://security.archlinux.org/CVE-2019-3838

1 0

[ASA-201904-4] thunderbird: arbitrary code execution
by Remi Gacogne 11 Apr '19

11 Apr '19

Arch Linux Security Advisory ASA-201904-4 ========================================= Severity: Critical Date : 2019-04-06 CVE-ID : CVE-2019-9810 CVE-2019-9813 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-947 Summary ======= The package thunderbird before version 60.6.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 60.6.1-1. # pacman -Syu "thunderbird>=60.6.1-1" The problems have been fixed upstream in version 60.6.1. Workaround ========== None. Description =========== - CVE-2019-9810 (arbitrary code execution) An incorrect alias information in the IonMonkey JIT compiler of Firefox before 66.0.1 and Thunderbird before 60.6.1 for the Array.prototype.slice method may lead to missing bounds check and a buffer overflow. - CVE-2019-9813 (arbitrary code execution) An incorrect handling of __proto__ mutations may lead to type confusion in the IonMonkey JIT code of Firefox before 66.0.1 and Thunderbird before 60.6.1, and can be leveraged for arbitrary memory read and write. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9810 https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9810 https://bugzilla.mozilla.org/show_bug.cgi?id=1537924 https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9813 https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9813 https://bugzilla.mozilla.org/show_bug.cgi?id=1538006 https://security.archlinux.org/CVE-2019-9810 https://security.archlinux.org/CVE-2019-9813

1 0