- Arch-security - lists.archlinux.org

[ASA-202108-10] jupyterlab: cross-site scripting
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-10 ========================================== Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-32797 Package : jupyterlab Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2266 Summary ======= The package jupyterlab before version 3.1.4-1 is vulnerable to cross- site scripting. Resolution ========== Upgrade to 3.1.4-1. # pacman -Syu "jupyterlab>=3.1.4-1" The problem has been fixed upstream in version 3.1.4. Workaround ========== None. Description =========== In JupyterLab before version 3.1.4, untrusted notebooks can execute code on load. In particular JupyterLab doesn't sanitize the action attribute of the HTML <form> element. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. Impact ====== An attacker could perform remote code execution using a maliciously crafted notebook file. References ========== https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q… https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d5293… https://security.archlinux.org/CVE-2021-32797

1 0

[ASA-202108-9] lynx: information disclosure
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-9 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-38165 Package : lynx Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2261 Summary ======= The package lynx before version 2.8.9-4 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.8.9-4. # pacman -Syu "lynx>=2.8.9-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== HTParse in Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data or HTTP headers. Impact ====== A remote attacker could retrieve HTTP Basic Authentication credentials. References ========== https://bugs.archlinux.org/task/71764 https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html https://lynx.invisible-island.net/current/CHANGES.html#index-v2.9.0dev.9 https://github.com/archlinux/svntogit-packages/blob/packages/lynx/trunk/CVE… https://security.archlinux.org/CVE-2021-38165

1 0

[ASA-202108-8] fossil: certificate verification bypass
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-8 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-36377 Package : fossil Type : certificate verification bypass Remote : Yes Link : https://security.archlinux.org/AVG-2146 Summary ======= The package fossil before version 2.16-1 is vulnerable to certificate verification bypass. Resolution ========== Upgrade to 2.16-1. # pacman -Syu "fossil>=2.16-1" The problem has been fixed upstream in version 2.16. Workaround ========== None. Description =========== Fossil before version 2.15.2 often skips the hostname check during TLS certificate validation. Impact ====== A man-in-the-middle attacker could spoof a Fossil repository by presenting any valid certificate for an arbitrary hostname, leading to potential information disclosure. References ========== https://www.fossil-scm.org/forum/forumpost/8d367e16f53d93c789d70bd3bf2c9587… https://www.fossil-scm.org/home/info/aaab2a15d1dfc22f5453c2bad8f25ecf518ed3… https://security.archlinux.org/CVE-2021-36377

1 0

[ASA-202108-7] gitlab: multiple issues
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-7 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-22236 CVE-2021-22237 CVE-2021-22239 CVE-2021-22241 Package : gitlab Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2251 Summary ======= The package gitlab before version 14.1.2-1 is vulnerable to multiple issues including cross-site scripting, access restriction bypass and incorrect calculation. Resolution ========== Upgrade to 14.1.2-1. # pacman -Syu "gitlab>=14.1.2-1" The problems have been fixed upstream in version 14.1.2. Workaround ========== None. Description =========== - CVE-2021-22236 (incorrect calculation) Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. This vulnerability is present in GitLab CE/EE since version 14.1 before version 14.1.2. - CVE-2021-22237 (access restriction bypass) Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab versions before 14.1.2. - CVE-2021-22239 (access restriction bypass) An unauthorized user was able to insert metadata when creating a new issue on GitLab 14.0 and later before version 14.1.2. - CVE-2021-22241 (cross-site scripting) An issue has been discovered in GitLab affecting all versions starting from 13.4 and before 14.1.2. It was possible to exploit a stored cross- site-scripting via a specifically crafted default branch name. Impact ====== A remote attacker could execute arbitrary JavaScript code through a crafted branch name, or bypass access restrictions to perform various actions they are not authorised for. References ========== https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2… https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22241.json https://gitlab.com/gitlab-org/gitlab/-/issues/336460 https://hackerone.com/reports/1256777 https://security.archlinux.org/CVE-2021-22236 https://security.archlinux.org/CVE-2021-22237 https://security.archlinux.org/CVE-2021-22239 https://security.archlinux.org/CVE-2021-22241

1 0

[ASA-202108-6] vivaldi: multiple issues
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-6 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-30590 CVE-2021-30591 CVE-2021-30592 CVE-2021-30593 CVE-2021-30594 CVE-2021-30596 CVE-2021-30597 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2247 Summary ======= The package vivaldi before version 4.1.2369.15-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and content spoofing. Resolution ========== Upgrade to 4.1.2369.15-1. # pacman -Syu "vivaldi>=4.1.2369.15-1" The problems have been fixed upstream in version 4.1.2369.15. Workaround ========== None. Description =========== - CVE-2021-30590 (arbitrary code execution) A heap buffer overflow security issue has been found in the Bookmarks component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30591 (arbitrary code execution) A use after free security issue has been found in the File System API component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30592 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30593 (information disclosure) An out of bounds read security issue has been found in the Tab Strip component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30594 (arbitrary code execution) A use after free security issue has been found in the Page Info UI component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30596 (content spoofing) An incorrect security UI security issue has been found in the Navigation component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30597 (arbitrary code execution) A use after free security issue has been found in the Browser UI component of the Chromium browser engine before version 92.0.4515.131. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, or spoof content through crafted web pages. References ========== https://vivaldi.com/blog/desktop/vivaldi-4-1-rc-1-desktop/ https://vivaldi.com/blog/desktop/minor-update-desktop-4-1/ https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-u… https://crbug.com/1227777 https://crbug.com/1229298 https://crbug.com/1209469 https://crbug.com/1209616 https://crbug.com/1218468 https://crbug.com/1214481 https://crbug.com/1232617 https://security.archlinux.org/CVE-2021-30590 https://security.archlinux.org/CVE-2021-30591 https://security.archlinux.org/CVE-2021-30592 https://security.archlinux.org/CVE-2021-30593 https://security.archlinux.org/CVE-2021-30594 https://security.archlinux.org/CVE-2021-30596 https://security.archlinux.org/CVE-2021-30597

1 0

[ASA-202108-5] opera: multiple issues
by Jonas Witschel 13 Aug '21

13 Aug '21

Arch Linux Security Advisory ASA-202108-5 ========================================= Severity: High Date : 2021-08-10 CVE-ID : CVE-2021-30565 CVE-2021-30566 CVE-2021-30567 CVE-2021-30568 CVE-2021-30569 CVE-2021-30571 CVE-2021-30572 CVE-2021-30573 CVE-2021-30574 CVE-2021-30575 CVE-2021-30576 CVE-2021-30578 CVE-2021-30579 CVE-2021-30581 CVE-2021-30582 CVE-2021-30584 CVE-2021-30585 CVE-2021-30588 CVE-2021-30589 Package : opera Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2203 Summary ======= The package opera before version 78.0.4093.112-1 is vulnerable to multiple issues including access restriction bypass, arbitrary code execution, content spoofing, incorrect calculation, information disclosure and insufficient validation. Resolution ========== Upgrade to 78.0.4093.112-1. # pacman -Syu "opera>=78.0.4093.112-1" The problems have been fixed upstream in version 78.0.4093.112. Workaround ========== None. Description =========== - CVE-2021-30565 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30566 (arbitrary code execution) A stack buffer overflow security issue has been found in the Printing component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30567 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30568 (arbitrary code execution) A heap buffer overflow security issue has been found in the WebGL component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30569 (arbitrary code execution) A use after free security issue has been found in the sqlite component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30571 (access restriction bypass) An insufficient policy enforcement security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30572 (arbitrary code execution) A use after free security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30573 (arbitrary code execution) A use after free security issue has been found in the GPU component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30574 (arbitrary code execution) A use after free security issue has been found in the protocol handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30575 (information disclosure) An out of bounds read security issue has been found in the Autofill component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30576 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30578 (arbitrary code execution) An uninitialized use security issue has been found in the Media component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30579 (arbitrary code execution) A use after free security issue has been found in the UI framework component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30581 (arbitrary code execution) A use after free security issue has been found in the DevTools component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30582 (incorrect calculation) An inappropriate implementation security issue has been found in the Animation component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30584 (content spoofing) An incorrect security UI security issue has been found in the Downloads component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30585 (arbitrary code execution) A use after free security issue has been found in the sensor handling component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30588 (incorrect calculation) A type confusion security issue has been found in the V8 component of the Chromium browser engine before version 92.0.4515.107. - CVE-2021-30589 (insufficient validation) An insufficient validation of untrusted input security issue has been found in the Sharing component of the Chromium browser engine before version 92.0.4515.107. Impact ====== A remote attacker could execute arbitrary code or spoof content through a crafted web page. References ========== https://blogs.opera.com/desktop/changelog-for-77/ https://blogs.opera.com/desktop/changelog-for-78/ https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-des… https://crbug.com/1210985 https://crbug.com/1202661 https://crbug.com/1211326 https://crbug.com/1219886 https://crbug.com/1218707 https://crbug.com/1101897 https://crbug.com/1214234 https://crbug.com/1216822 https://crbug.com/1227315 https://crbug.com/1213313 https://crbug.com/1194896 https://crbug.com/1201074 https://crbug.com/1207277 https://crbug.com/1194431 https://crbug.com/1205981 https://crbug.com/1213350 https://crbug.com/1023503 https://crbug.com/1195650 https://crbug.com/1180510 https://security.archlinux.org/CVE-2021-30565 https://security.archlinux.org/CVE-2021-30566 https://security.archlinux.org/CVE-2021-30567 https://security.archlinux.org/CVE-2021-30568 https://security.archlinux.org/CVE-2021-30569 https://security.archlinux.org/CVE-2021-30571 https://security.archlinux.org/CVE-2021-30572 https://security.archlinux.org/CVE-2021-30573 https://security.archlinux.org/CVE-2021-30574 https://security.archlinux.org/CVE-2021-30575 https://security.archlinux.org/CVE-2021-30576 https://security.archlinux.org/CVE-2021-30578 https://security.archlinux.org/CVE-2021-30579 https://security.archlinux.org/CVE-2021-30581 https://security.archlinux.org/CVE-2021-30582 https://security.archlinux.org/CVE-2021-30584 https://security.archlinux.org/CVE-2021-30585 https://security.archlinux.org/CVE-2021-30588 https://security.archlinux.org/CVE-2021-30589

1 0

[ASA-202108-4] chromium: multiple issues
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-4 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-30590 CVE-2021-30591 CVE-2021-30592 CVE-2021-30593 CVE-2021-30594 CVE-2021-30596 CVE-2021-30597 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2246 Summary ======= The package chromium before version 92.0.4515.131-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and content spoofing. Resolution ========== Upgrade to 92.0.4515.131-1. # pacman -Syu "chromium>=92.0.4515.131-1" The problems have been fixed upstream in version 92.0.4515.131. Workaround ========== None. Description =========== - CVE-2021-30590 (arbitrary code execution) A heap buffer overflow security issue has been found in the Bookmarks component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30591 (arbitrary code execution) A use after free security issue has been found in the File System API component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30592 (arbitrary code execution) An out of bounds write security issue has been found in the Tab Groups component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30593 (information disclosure) An out of bounds read security issue has been found in the Tab Strip component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30594 (arbitrary code execution) A use after free security issue has been found in the Page Info UI component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30596 (content spoofing) An incorrect security UI security issue has been found in the Navigation component of the Chromium browser engine before version 92.0.4515.131. - CVE-2021-30597 (arbitrary code execution) A use after free security issue has been found in the Browser UI component of the Chromium browser engine before version 92.0.4515.131. Impact ====== A remote attacker could execute arbitrary code, disclose sensitive information, or spoof content through crafted web pages. References ========== https://chromereleases.googleblog.com/2021/08/the-stable-channel-has-been-u… https://crbug.com/1227777 https://crbug.com/1229298 https://crbug.com/1209469 https://crbug.com/1209616 https://crbug.com/1218468 https://crbug.com/1214481 https://crbug.com/1232617 https://security.archlinux.org/CVE-2021-30590 https://security.archlinux.org/CVE-2021-30591 https://security.archlinux.org/CVE-2021-30592 https://security.archlinux.org/CVE-2021-30593 https://security.archlinux.org/CVE-2021-30594 https://security.archlinux.org/CVE-2021-30596 https://security.archlinux.org/CVE-2021-30597

1 0

[ASA-202108-3] nodejs-lts-erbium: arbitrary code execution
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-3 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-22930 Package : nodejs-lts-erbium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2241 Summary ======= The package nodejs-lts-erbium before version 12.22.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 12.22.4-1. # pacman -Syu "nodejs-lts-erbium>=12.22.4-1" The problem has been fixed upstream in version 12.22.4. Workaround ========== None. Description =========== Node.js before version 16.6.0, 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Impact ====== A remote attacker could execute arbitrary code through crafted HTTP/2 requests. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/#use… https://github.com/nodejs/node/issues/38964 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91… https://github.com/nodejs/node/commit/d48b91ea2b27828ceea10dab1effa42bc542b… https://github.com/nodejs/node/commit/b263f2585ab53f56e0e22b46cf1f8519a8af8… https://security.archlinux.org/CVE-2021-22930

1 0

[ASA-202108-2] nodejs-lts-fermium: arbitrary code execution
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-2 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-22930 Package : nodejs-lts-fermium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2240 Summary ======= The package nodejs-lts-fermium before version 14.17.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 14.17.4-1. # pacman -Syu "nodejs-lts-fermium>=14.17.4-1" The problem has been fixed upstream in version 14.17.4. Workaround ========== None. Description =========== Node.js before version 16.6.0, 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Impact ====== A remote attacker could execute arbitrary code through crafted HTTP/2 requests. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/#use… https://github.com/nodejs/node/issues/38964 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91… https://github.com/nodejs/node/commit/d48b91ea2b27828ceea10dab1effa42bc542b… https://github.com/nodejs/node/commit/b263f2585ab53f56e0e22b46cf1f8519a8af8… https://security.archlinux.org/CVE-2021-22930

1 0

[ASA-202108-1] nodejs: arbitrary code execution
by Jonas Witschel 03 Aug '21

03 Aug '21

Arch Linux Security Advisory ASA-202108-1 ========================================= Severity: High Date : 2021-08-03 CVE-ID : CVE-2021-22930 Package : nodejs Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2239 Summary ======= The package nodejs before version 16.6.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 16.6.0-1. # pacman -Syu "nodejs>=16.6.0-1" The problem has been fixed upstream in version 16.6.0. Workaround ========== None. Description =========== Node.js before version 16.6.0, 14.17.4 and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Impact ====== A remote attacker could execute arbitrary code through crafted HTTP/2 requests. References ========== https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/#use… https://github.com/nodejs/node/issues/38964 https://github.com/nodejs/node/pull/39423 https://github.com/nodejs/node/commit/9d950a0956bf2c3dd87bacb56807f37e16a91… https://github.com/nodejs/node/commit/d48b91ea2b27828ceea10dab1effa42bc542b… https://github.com/nodejs/node/commit/b263f2585ab53f56e0e22b46cf1f8519a8af8… https://security.archlinux.org/CVE-2021-22930

1 0