- Arch-security - lists.archlinux.org

[ASA-201903-9] libelf: denial of service
by Santiago Torres-Arias 20 Mar '19

20 Mar '19

Arch Linux Security Advisory ASA-201903-9 ========================================= Severity: Medium Date : 2019-03-18 CVE-ID : CVE-2019-7148 CVE-2019-7149 CVE-2019-7150 CVE-2019-7664 CVE-2019-7665 Package : libelf Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-863 Summary ======= The package libelf before version 0.176-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.176-1. # pacman -Syu "libelf>=0.176-1" The problems have been fixed upstream in version 0.176. Workaround ========== None. Description =========== - CVE-2019-7148 (denial of service) An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils <= 0.175. Remote attackers could leverage this vulnerability to cause a denial-of- service via crafted elf input, which leads to an out-of-memory exception. - CVE-2019-7149 (denial of service) A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of- service. - CVE-2019-7150 (denial of service) An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service. - CVE-2019-7664 (denial of service) In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash). - CVE-2019-7665 (denial of service) In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes. Impact ====== A remote attacker is able to crash a program that uses libelf by providing it with a crafted ELF file. References ========== https://sourceware.org/bugzilla/show_bug.cgi?id=24085 https://sourceware.org/bugzilla/show_bug.cgi?id=24102 https://sourceware.org/bugzilla/show_bug.cgi?id=24103 https://sourceware.org/bugzilla/show_bug.cgi?id=24084 https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html https://sourceware.org/bugzilla/show_bug.cgi?id=24089 https://security.archlinux.org/CVE-2019-7148 https://security.archlinux.org/CVE-2019-7149 https://security.archlinux.org/CVE-2019-7150 https://security.archlinux.org/CVE-2019-7664 https://security.archlinux.org/CVE-2019-7665

1 0

[ASA-201903-8] chromium: multiple issues
by Remi Gacogne 13 Mar '19

13 Mar '19

Arch Linux Security Advisory ASA-201903-8 ========================================= Severity: High Date : 2019-03-13 CVE-ID : CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5802 CVE-2019-5803 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-923 Summary ======= The package chromium before version 73.0.3683.75-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing and information disclosure. Resolution ========== Upgrade to 73.0.3683.75-1. # pacman -Syu "chromium>=73.0.3683.75-1" The problems have been fixed upstream in version 73.0.3683.75. Workaround ========== None. Description =========== - CVE-2019-5787 (arbitrary code execution) A use-after-free issue has been found in the Canvas component of the chromium browser before 73.0.3683.75. - CVE-2019-5788 (arbitrary code execution) A use-after-free issue has been found in the FileAPI component of the chromium browser before 73.0.3683.75. - CVE-2019-5789 (arbitrary code execution) A use-after-free issue has been found in the WebMIDI component of the chromium browser before 73.0.3683.75. - CVE-2019-5790 (arbitrary code execution) A heap-based buffer overflow has been found in the V8 component of the chromium browser before 73.0.3683.75. - CVE-2019-5791 (arbitrary code execution) A type confusion issue has been found in the V8 component of the chromium browser before 73.0.3683.75. - CVE-2019-5792 (arbitrary code execution) An integer overflow issue has been found in the PDFium component of the chromium browser before 73.0.3683.75. - CVE-2019-5793 (access restriction bypass) An excessive permissions for private API issue has been found in the Extensions component of the chromium browser before 73.0.3683.75. - CVE-2019-5794 (content spoofing) A UI spoofing issue has been found in the chromium browser before 73.0.3683.75. - CVE-2019-5795 (arbitrary code execution) An integer overflow issue has been found in the PDFium component of the chromium browser before 73.0.3683.75. - CVE-2019-5796 (arbitrary code execution) A race condition has been found in the Extensions component of the chromium browser before 73.0.3683.75. - CVE-2019-5797 (arbitrary code execution) A race condition has been found in the DOMStorage component of the chromium browser before 73.0.3683.75. - CVE-2019-5798 (information disclosure) An out-of-bounds read has been found in the Skia component of the chromium browser before 73.0.3683.75. - CVE-2019-5799 (access restriction bypass) A CSP bypass issue with blob URLs has been found in the chromium browser before 73.0.3683.75. - CVE-2019-5800 (access restriction bypass) A CSP bypass issue with blob URLs has been found in the chromium browser before 73.0.3683.75. - CVE-2019-5802 (content spoofing) A UI spoofing issue has been found in the chromium browser before 73.0.3683.75. - CVE-2019-5803 (access restriction bypass) A CSP bypass issue with Javascript URLs has been found in the chromium browser before 73.0.3683.75. Impact ====== A remote attacker can access sensitive information, bypass security restrictions and execute arbitrary code via crafted web content. References ========== https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=913964 https://bugs.chromium.org/p/chromium/issues/detail?id=925864 https://bugs.chromium.org/p/chromium/issues/detail?id=921581 https://bugs.chromium.org/p/chromium/issues/detail?id=914736 https://bugs.chromium.org/p/chromium/issues/detail?id=926651 https://bugs.chromium.org/p/chromium/issues/detail?id=914983 https://bugs.chromium.org/p/chromium/issues/detail?id=937487 https://bugs.chromium.org/p/chromium/issues/detail?id=935175 https://bugs.chromium.org/p/chromium/issues/detail?id=919643 https://bugs.chromium.org/p/chromium/issues/detail?id=918861 https://bugs.chromium.org/p/chromium/issues/detail?id=916523 https://bugs.chromium.org/p/chromium/issues/detail?id=883596 https://bugs.chromium.org/p/chromium/issues/detail?id=905301 https://bugs.chromium.org/p/chromium/issues/detail?id=894228 https://bugs.chromium.org/p/chromium/issues/detail?id=632514 https://bugs.chromium.org/p/chromium/issues/detail?id=909865 https://security.archlinux.org/CVE-2019-5787 https://security.archlinux.org/CVE-2019-5788 https://security.archlinux.org/CVE-2019-5789 https://security.archlinux.org/CVE-2019-5790 https://security.archlinux.org/CVE-2019-5791 https://security.archlinux.org/CVE-2019-5792 https://security.archlinux.org/CVE-2019-5793 https://security.archlinux.org/CVE-2019-5794 https://security.archlinux.org/CVE-2019-5795 https://security.archlinux.org/CVE-2019-5796 https://security.archlinux.org/CVE-2019-5797 https://security.archlinux.org/CVE-2019-5798 https://security.archlinux.org/CVE-2019-5799 https://security.archlinux.org/CVE-2019-5800 https://security.archlinux.org/CVE-2019-5802 https://security.archlinux.org/CVE-2019-5803

1 0

[ASA-201903-7] pacman: arbitrary code execution
by Levente Polyak 11 Mar '19

11 Mar '19

Arch Linux Security Advisory ASA-201903-7 ========================================= Severity: High Date : 2019-03-11 CVE-ID : CVE-2019-9686 Package : pacman Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-921 Summary ======= The package pacman before version 5.1.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.1.3-1. # pacman -Syu "pacman>=5.1.3-1" The problem has been fixed upstream in version 5.1.3. Workaround ========== None. Description =========== pacman prior to version 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c. Impact ====== A remote attacker in the position of man-in-the-middle or a malicious server is able to execute arbitrary code as root when a user installs a remote package via a specified URL. References ========== https://git.archlinux.org/pacman.git/commit/?id=9702703633bec2c007730006de2… https://git.archlinux.org/pacman.git/commit/?id=d197d8ab82cf10650487518fb96… https://git.archlinux.org/pacman.git/commit/?h=release/5.1.x&id=1bf76723436… https://security.archlinux.org/CVE-2019-9686

1 0

[ASA-201903-6] lib32-openssl-1.0: information disclosure
by Morten Linderud 04 Mar '19

04 Mar '19

Arch Linux Security Advisory ASA-201903-6 ========================================= Severity: Medium Date : 2019-03-03 CVE-ID : CVE-2019-1559 Package : lib32-openssl-1.0 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-918 Summary ======= The package lib32-openssl-1.0 before version 1.0.2.r-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.0.2.r-1. # pacman -Syu "lib32-openssl-1.0>=1.0.2.r-1" The problem has been fixed upstream in version 1.0.2.r. Workaround ========== None. Description =========== A padding oracle has been found in OpenSSL versions prior to 1.0.2r. This issue does not impact OpenSSL 1.1.1 or 1.1.0. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). AEAD ciphersuites are not impacted. Impact ====== A remote attacker might be able to use a padding oracle to decrypt confidential data. References ========== https://www.openssl.org/news/secadv/20190226.txt https://security.archlinux.org/CVE-2019-1559

1 0

[ASA-201903-5] file: multiple issues
by Morten Linderud 04 Mar '19

04 Mar '19

Arch Linux Security Advisory ASA-201903-5 ========================================= Severity: High Date : 2019-03-03 CVE-ID : CVE-2019-8904 CVE-2019-8905 CVE-2019-8906 CVE-2019-8907 Package : file Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-907 Summary ======= The package file before version 5.36-1 is vulnerable to multiple issues including information disclosure and denial of service. Resolution ========== Upgrade to 5.36-1. # pacman -Syu "file>=5.36-1" The problems have been fixed upstream in version 5.36. Workaround ========== None. Description =========== - CVE-2019-8904 (information disclosure) do_bid_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printf and file_vprintf. - CVE-2019-8905 (information disclosure) do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360. - CVE-2019-8906 (information disclosure) do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of- bounds read because memcpy is misused. - CVE-2019-8907 (denial of service) do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact. Impact ====== A remote attack is able to display sensitive information within the file process or cause a crash via a crafted ELF file. References ========== https://bugs.astron.com/view.php?id=62 https://bugs.astron.com/view.php?id=63 https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f https://bugs.astron.com/view.php?id=64 https://bugs.astron.com/view.php?id=65 https://security.archlinux.org/CVE-2019-8904 https://security.archlinux.org/CVE-2019-8905 https://security.archlinux.org/CVE-2019-8906 https://security.archlinux.org/CVE-2019-8907

1 0

[ASA-201903-4] pcre: denial of service
by Morten Linderud 04 Mar '19

04 Mar '19

Arch Linux Security Advisory ASA-201903-4 ========================================= Severity: Low Date : 2019-03-03 CVE-ID : CVE-2017-11164 Package : pcre Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-351 Summary ======= The package pcre before version 8.43-1 is vulnerable to denial of service. Resolution ========== Upgrade to 8.43-1. # pacman -Syu "pcre>=8.43-1" The problem has been fixed upstream in version 8.43. Workaround ========== None. Description =========== In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression. Impact ====== A remote attacker can crash the process with a crafted regular expression. References ========== http://seclists.org/oss-sec/2017/q3/111 https://bugzilla.redhat.com/show_bug.cgi?id=1470107 https://security.archlinux.org/CVE-2017-11164

1 0

[ASA-201903-3] gdm: access restriction bypass
by Morten Linderud 04 Mar '19

04 Mar '19

Arch Linux Security Advisory ASA-201903-3 ========================================= Severity: High Date : 2019-03-03 CVE-ID : CVE-2019-3820 CVE-2019-3825 Package : gdm Type : access restriction bypass Remote : No Link : https://security.archlinux.org/AVG-879 Summary ======= The package gdm before version 3.30.3-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 3.30.3-1. # pacman -Syu "gdm>=3.30.3-1" The problems have been fixed upstream in version 3.30.3. Workaround ========== None. Description =========== - CVE-2019-3820 (access restriction bypass) A partial screen lock bypass via keybindings has been found in gdm <= 3.30.2, allowing a local attacker to unlock a session under certain circumstances. - CVE-2019-3825 (access restriction bypass) An issue has been found in gdm <= 3.30.2, allowing a local attacker with valid credentials to unlock the session for a different user than their own. Impact ====== A local attacker can unlock session if they have other valid credentials, or under certain circumstances. References ========== https://gitlab.gnome.org/GNOME/gnome-shell/issues/851 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825 https://gitlab.gnome.org/GNOME/gdm/issues/460 https://security.archlinux.org/CVE-2019-3820 https://security.archlinux.org/CVE-2019-3825

1 0

[ASA-201903-2] openssl-1.0: information disclosure
by Morten Linderud 04 Mar '19

04 Mar '19

Arch Linux Security Advisory ASA-201903-2 ========================================= Severity: Medium Date : 2019-03-02 CVE-ID : CVE-2019-1559 Package : openssl-1.0 Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-917 Summary ======= The package openssl-1.0 before version 1.0.2.r-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.0.2.r-1. # pacman -Syu "openssl-1.0>=1.0.2.r-1" The problem has been fixed upstream in version 1.0.2.r. Workaround ========== None. Description =========== A padding oracle has been found in OpenSSL versions prior to 1.0.2r. This issue does not impact OpenSSL 1.1.1 or 1.1.0. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). AEAD ciphersuites are not impacted. Impact ====== A remote attacker might be able to use a padding oracle to decrypt confidential data. References ========== https://www.openssl.org/news/secadv/20190226.txt https://security.archlinux.org/CVE-2019-1559

1 0

[ASA-201903-1] chromium: arbitrary code execution
by Santiago Torres-Arias 03 Mar '19

03 Mar '19

Arch Linux Security Advisory ASA-201903-1 ========================================= Severity: High Date : 2019-03-02 CVE-ID : CVE-2019-5786 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-916 Summary ======= The package chromium before version 72.0.3626.121-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 72.0.3626.121-1. # pacman -Syu "chromium>=72.0.3626.121-1" The problem has been fixed upstream in version 72.0.3626.121. Workaround ========== None. Description =========== A use-after-free issue has been found in the FileReader component of the chromium browser before 72.0.3626.121. Impact ====== A remote attacker can execute arbitrary code via a crafted file. References ========== https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=936448 https://security.archlinux.org/CVE-2019-5786

1 0

[ASA-201902-28] logstash: information disclosure
by Morten Linderud 26 Feb '19

26 Feb '19

Arch Linux Security Advisory ASA-201902-28 ========================================== Severity: High Date : 2019-02-25 CVE-ID : CVE-2019-7612 Package : logstash Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-913 Summary ======= The package logstash before version 6.6.1-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 6.6.1-1. # pacman -Syu "logstash>=6.6.1-1" The problem has been fixed upstream in version 6.6.1. Workaround ========== None. Description =========== A sensitive data disclosure flaw was found in the way Logstash logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message. Impact ====== A local attacker is able to obtain URL credentials by reading the error log. References ========== https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update… https://security.archlinux.org/CVE-2019-7612

1 0