- Arch-security - lists.archlinux.org

[ASA-201902-7] libu2f-host: arbitrary code execution
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-7 ========================================= Severity: High Date : 2019-02-11 CVE-ID : CVE-2018-20340 Package : libu2f-host Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-884 Summary ======= The package libu2f-host before version 1.1.7-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.1.7-1. # pacman -Syu "libu2f-host>=1.1.7-1" The problem has been fixed upstream in version 1.1.7. Workaround ========== None. Description =========== Yubico library libu2f-host prior to version 1.1.7 contains an unchecked buffer, which could allow a buffer overflow. Libu2f-host is a library that implements the host party of the U2F protocol. This issue can allow an attacker with a custom made malicious USB device masquerading as a security key, and physical access to a computer where PAM U2F or an application with libu2f-host integrated, to potentially execute arbitrary code on that computer. Users of the YubiKey PAM U2F Tool are the most impacted since the arbitrary code could execute with elevated privileges. Impact ====== A malicious USB device can execute arbitrary code on the host. References ========== https://www.yubico.com/support/security-advisories/ysa-2019-01/ https://security.archlinux.org/CVE-2018-20340

1 0

[ASA-201902-6] runc: privilege escalation
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-6 ========================================= Severity: High Date : 2019-02-11 CVE-ID : CVE-2019-5736 Package : runc Type : privilege escalation Remote : Yes Link : https://security.archlinux.org/AVG-878 Summary ======= The package runc before version 1.0.0rc6-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1.0.0rc6-1. # pacman -Syu "runc>=1.0.0rc6-1" The problem has been fixed upstream in version 1.0.0rc6. Workaround ========== Don't run privileged containers. Description =========== A vulnerability discovered in runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe. Impact ====== A malicious container can escalate privileges to gain access as root on the host system and execute arbitrary code. References ========== https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9d https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef39840581… https://www.openwall.com/lists/oss-security/2019/02/11/2 https://security.archlinux.org/CVE-2019-5736

1 0

[ASA-201902-5] rdesktop: multiple issues
by Levente Polyak 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-5 ========================================= Severity: High Date : 2019-02-11 CVE-ID : CVE-2018-8791 CVE-2018-8792 CVE-2018-8793 CVE-2018-8794 CVE-2018-8795 CVE-2018-8796 CVE-2018-8797 CVE-2018-8798 CVE-2018-8799 CVE-2018-8800 CVE-2018-20174 CVE-2018-20175 CVE-2018-20176 CVE-2018-20177 CVE-2018-20178 CVE-2018-20179 CVE-2018-20180 CVE-2018-20181 CVE-2018-20182 Package : rdesktop Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-871 Summary ======= The package rdesktop before version 1.8.4-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and information disclosure. Resolution ========== Upgrade to 1.8.4-1. # pacman -Syu "rdesktop>=1.8.4-1" The problems have been fixed upstream in version 1.8.4. Workaround ========== None. Description =========== - CVE-2018-8791 (information disclosure) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function rdpdr_process() that results in an information leak. - CVE-2018-8792 (denial of service) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function cssp_read_tsrequest() that results in a denial of service (segfault). - CVE-2018-8793 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution. - CVE-2018-8794 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to an integer overflow that leads to an out-of-bounds write in function process_bitmap_updates() and results in a memory corruption and possibly even a remote code execution. - CVE-2018-8795 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to an integer overflow that leads to a heap-based buffer overflow in function process_bitmap_updates() and results in a memory corruption and probably even a remote code execution. - CVE-2018-8796 (denial of service) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function process_bitmap_updates() that results in a denial of service (segfault). - CVE-2018-8797 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in function process_plane() that results in a memory corruption and probably even a remote code execution. - CVE-2018-8798 (information disclosure) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function rdpsnd_process_ping() that results in an information leak. - CVE-2018-8799 (denial of service) rdesktop before 1.8.4 is vulnerable to an out-of-bounds read in function process_secondary_order() that results in a denial of service (segfault). - CVE-2018-8800 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a heap-based buffer overflow in function ui_clip_handle_data() that results in a memory corruption and probably even a remote code execution. - CVE-2018-20174 (information disclosure) rdesktop before 1.8.4 is vulnerable to an information leak in ui_clip_handle_data(). - CVE-2018-20175 (denial of service) rdesktop before 1.8.4 is vulnerable to denial of service in mcs_recv_connect_response() and mcs_parse_domain_params(). - CVE-2018-20176 (denial of service) rdesktop before 1.8.4 is vulnerable to denial of service in sec_parse_crypt_info() and sec_recv(). - CVE-2018-20177 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to a memory corruption issue in rdp_in_unistr() that could lead to arbitrary code execution. - CVE-2018-20178 (denial of service) rdesktop before 1.8.4 is vulnerable to denial of service in process_demand_active(). - CVE-2018-20179 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in lspci_process(). - CVE-2018-20180 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in rdpsnddbg_process(). - CVE-2018-20181 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in seamless_process(). - CVE-2018-20182 (arbitrary code execution) rdesktop before 1.8.4 is vulnerable to remote code execution in seamless_process_line(). Impact ====== A remote attacker is able to execute arbitrary code, access sensitive information or crash rdesktop when the client connects to a malicious server in control of the attacker. References ========== https://bugs.archlinux.org/task/61652 https://github.com/rdesktop/rdesktop/commit/4dca546d04321a610c1835010b5dad8… https://security.archlinux.org/CVE-2018-8791 https://security.archlinux.org/CVE-2018-8792 https://security.archlinux.org/CVE-2018-8793 https://security.archlinux.org/CVE-2018-8794 https://security.archlinux.org/CVE-2018-8795 https://security.archlinux.org/CVE-2018-8796 https://security.archlinux.org/CVE-2018-8797 https://security.archlinux.org/CVE-2018-8798 https://security.archlinux.org/CVE-2018-8799 https://security.archlinux.org/CVE-2018-8800 https://security.archlinux.org/CVE-2018-20174 https://security.archlinux.org/CVE-2018-20175 https://security.archlinux.org/CVE-2018-20176 https://security.archlinux.org/CVE-2018-20177 https://security.archlinux.org/CVE-2018-20178 https://security.archlinux.org/CVE-2018-20179 https://security.archlinux.org/CVE-2018-20180 https://security.archlinux.org/CVE-2018-20181 https://security.archlinux.org/CVE-2018-20182

1 0

[ASA-201902-4] spice: arbitrary code execution
by Santiago Torres-Arias 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-4 ========================================= Severity: Critical Date : 2019-02-11 CVE-ID : CVE-2019-3813 Package : spice Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-866 Summary ======= The package spice before version 0.14.0-3 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 0.14.0-3. # pacman -Syu "spice>=0.14.0-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of- bounds read due to an off-by-one error in memslot_get_virt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. Impact ====== A remote, unauthenticated attacker might be able to crash the server, or even execute arbitrary code on said server. References ========== https://bugs.archlinux.org/task/61650 https://gitlab.freedesktop.org/spice/spice/commit/a4a16ac42d2f19a17e3655654… https://access.redhat.com/errata/RHSA-2019:0231 https://security.archlinux.org/CVE-2019-3813

1 0

[ASA-201902-3] chromium: multiple issues
by Santiago Torres-Arias 12 Feb '19

12 Feb '19

Arch Linux Security Advisory ASA-201902-3 ========================================= Severity: Critical Date : 2019-02-11 CVE-ID : CVE-2019-5754 CVE-2019-5755 CVE-2019-5756 CVE-2019-5757 CVE-2019-5758 CVE-2019-5759 CVE-2019-5760 CVE-2019-5761 CVE-2019-5762 CVE-2019-5763 CVE-2019-5764 CVE-2019-5765 CVE-2019-5766 CVE-2019-5767 CVE-2019-5768 CVE-2019-5769 CVE-2019-5770 CVE-2019-5771 CVE-2019-5772 CVE-2019-5773 CVE-2019-5774 CVE-2019-5775 CVE-2019-5776 CVE-2019-5777 CVE-2019-5778 CVE-2019-5779 CVE-2019-5780 CVE-2019-5781 CVE-2019-5782 CVE-2019-5783 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-861 Summary ======= The package chromium before version 72.0.3626.81-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing and insufficient validation. Resolution ========== Upgrade to 72.0.3626.81-1. # pacman -Syu "chromium>=72.0.3626.81-1" The problems have been fixed upstream in version 72.0.3626.81. Workaround ========== None. Description =========== - CVE-2019-5754 (arbitrary code execution) A security issue has been found in the QUIC implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5755 (arbitrary code execution) A security issue has been found in the V8 implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5756 (arbitrary code execution) A use after free issue has been found in the PDFium component of the chromium browser before 72.0.3626.81. - CVE-2019-5757 (arbitrary code execution) A type confusion issue has been found in the SVG implementation in the chromium browser before 72.0.3626.81. - CVE-2019-5758 (arbitrary code execution) A use after free issue has been found in the blink component of the chromium browser before 72.0.3626.81. - CVE-2019-5759 (arbitrary code execution) A use after free issue has been found in the HTML select elements component of the chromium browser before 72.0.3626.81. - CVE-2019-5760 (arbitrary code execution) A use after free issue has been found in the WebRTC implementation in the chromium browser before 72.0.3626.81. - CVE-2019-5761 (arbitrary code execution) A use after free issue has been found in the SwiftShader component of the chromium browser before 72.0.3626.81. - CVE-2019-5762 (arbitrary code execution) A use after free issue has been found in the PDFium component of the chromium browser before 72.0.3626.81. - CVE-2019-5763 (arbitrary code execution) A security issue has been found in the V8 implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5764 (arbitrary code execution) A use-after-free vulnerability has been found in the WebRTC component of the chromium browser before 72.0.3626.81. - CVE-2019-5765 (access restriction bypass) An insufficient policy enforcement issue has been found in the chromium browser before 72.0.3626.81. - CVE-2019-5766 (access restriction bypass) An insufficient policy enforcement issue has been found in the Canvas component of the chromium browser before 72.0.3626.81. - CVE-2019-5767 (content spoofing) An incorrect security UI issue has been found in the WebAPKs component of the chromium browser before 72.0.3626.81. - CVE-2019-5768 (access restriction bypass) An insufficient policy enforcement issue has been found in the DevTools component of the chromium browser before 72.0.3626.81. - CVE-2019-5769 (insufficient validation) An insufficient validation of untrusted input issue has been found in the Blink component of the chromium browser before 72.0.3626.81. - CVE-2019-5770 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the WebGL component of the chromium browser before 72.0.3626.81. - CVE-2019-5771 (arbitrary code execution) A heap-based buffer overflow vulnerability has been found in the SwiftShader component of the chromium browser before 72.0.3626.81. - CVE-2019-5772 (arbitrary code execution) A use-after-free vulnerability has been found in the PDFium component of the chromium browser before 72.0.3626.81. - CVE-2019-5773 (insufficient validation) An insufficient data validation issue has been found in the IndexedDB component of the chromium browser before 72.0.3626.81. - CVE-2019-5774 (insufficient validation) An insufficient validation of untrusted input issue has been found in the SafeBrowsing component of the chromium browser before 72.0.3626.81. - CVE-2019-5775 (content spoofing) An insufficient policy enforcement issue has been found in the OmniBox component of the chromium browser before 72.0.3626.81, allowing IDN URL spoofing. - CVE-2019-5776 (content spoofing) An insufficient policy enforcement issue has been found in the OmniBox component of the chromium browser before 72.0.3626.81, allowing IDN URL spoofing. - CVE-2019-5777 (content spoofing) An insufficient policy enforcement issue has been found in the OmniBox component of the chromium browser before 72.0.3626.81, allowing IDN URL spoofing. - CVE-2019-5778 (access restriction bypass) An insufficient policy enforcement issue has been found in the Extensions component of the chromium browser before 72.0.3626.81. - CVE-2019-5779 (access restriction bypass) An insufficient policy enforcement issue has been found in the ServiceWorker component of the chromium browser before 72.0.3626.81. - CVE-2019-5780 (access restriction bypass) A security issue has been found in the chromium browser before 72.0.3626.81 leading to Insufficient policy enforcement. - CVE-2019-5781 (content spoofing) A security issue has been found in the Omnibox implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5782 (arbitrary code execution) A security issue has been found in the V8 implementation of the chromium browser before 72.0.3626.81. - CVE-2019-5783 (insufficient validation) An insufficient validation of untrusted input issue has been found in the DevTools component of the chromium browser before 72.0.3626.81. Impact ====== A remote attacker can spoof the URL in the address bar, bypass security policies or execute arbitrary code. References ========== https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=914497 https://bugs.chromium.org/p/chromium/issues/detail?id=913296 https://bugs.chromium.org/p/chromium/issues/detail?id=895152 https://bugs.chromium.org/p/chromium/issues/detail?id=915469 https://bugs.chromium.org/p/chromium/issues/detail?id=913970 https://bugs.chromium.org/p/chromium/issues/detail?id=912211 https://bugs.chromium.org/p/chromium/issues/detail?id=912074 https://bugs.chromium.org/p/chromium/issues/detail?id=904714 https://bugs.chromium.org/p/chromium/issues/detail?id=900552 https://bugs.chromium.org/p/chromium/issues/detail?id=914731 https://bugs.chromium.org/p/chromium/issues/detail?id=913246 https://bugs.chromium.org/p/chromium/issues/detail?id=922627 https://bugs.chromium.org/p/chromium/issues/detail?id=907047 https://bugs.chromium.org/p/chromium/issues/detail?id=902427 https://bugs.chromium.org/p/chromium/issues/detail?id=805557 https://bugs.chromium.org/p/chromium/issues/detail?id=913975 https://bugs.chromium.org/p/chromium/issues/detail?id=908749 https://bugs.chromium.org/p/chromium/issues/detail?id=904265 https://bugs.chromium.org/p/chromium/issues/detail?id=908292 https://bugs.chromium.org/p/chromium/issues/detail?id=917668 https://bugs.chromium.org/p/chromium/issues/detail?id=904182 https://bugs.chromium.org/p/chromium/issues/detail?id=896722 https://bugs.chromium.org/p/chromium/issues/detail?id=863663 https://bugs.chromium.org/p/chromium/issues/detail?id=849421 https://bugs.chromium.org/p/chromium/issues/detail?id=918470 https://bugs.chromium.org/p/chromium/issues/detail?id=891697 https://bugs.chromium.org/p/chromium/issues/detail?id=896725 https://bugs.chromium.org/p/chromium/issues/detail?id=906043 https://bugs.chromium.org/p/chromium/issues/detail?id=895081 https://security.archlinux.org/CVE-2019-5754 https://security.archlinux.org/CVE-2019-5755 https://security.archlinux.org/CVE-2019-5756 https://security.archlinux.org/CVE-2019-5757 https://security.archlinux.org/CVE-2019-5758 https://security.archlinux.org/CVE-2019-5759 https://security.archlinux.org/CVE-2019-5760 https://security.archlinux.org/CVE-2019-5761 https://security.archlinux.org/CVE-2019-5762 https://security.archlinux.org/CVE-2019-5763 https://security.archlinux.org/CVE-2019-5764 https://security.archlinux.org/CVE-2019-5765 https://security.archlinux.org/CVE-2019-5766 https://security.archlinux.org/CVE-2019-5767 https://security.archlinux.org/CVE-2019-5768 https://security.archlinux.org/CVE-2019-5769 https://security.archlinux.org/CVE-2019-5770 https://security.archlinux.org/CVE-2019-5771 https://security.archlinux.org/CVE-2019-5772 https://security.archlinux.org/CVE-2019-5773 https://security.archlinux.org/CVE-2019-5774 https://security.archlinux.org/CVE-2019-5775 https://security.archlinux.org/CVE-2019-5776 https://security.archlinux.org/CVE-2019-5777 https://security.archlinux.org/CVE-2019-5778 https://security.archlinux.org/CVE-2019-5779 https://security.archlinux.org/CVE-2019-5780 https://security.archlinux.org/CVE-2019-5781 https://security.archlinux.org/CVE-2019-5782 https://security.archlinux.org/CVE-2019-5783

1 0

[ASA-201902-2] firefox: multiple issues
by Remi Gacogne 11 Feb '19

11 Feb '19

Arch Linux Security Advisory ASA-201902-2 ========================================= Severity: Critical Date : 2019-02-06 CVE-ID : CVE-2018-18500 CVE-2018-18501 CVE-2018-18502 CVE-2018-18503 CVE-2018-18504 CVE-2018-18505 CVE-2018-18506 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-862 Summary ======= The package firefox before version 65.0-1 is vulnerable to multiple issues including arbitrary code execution, privilege escalation and access restriction bypass. Resolution ========== Upgrade to 65.0-1. # pacman -Syu "firefox>=65.0-1" The problems have been fixed upstream in version 65.0. Workaround ========== None. Description =========== - CVE-2018-18500 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox < 65.0, that can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. - CVE-2018-18501 (arbitrary code execution) Several memory safety bugs have been found in Firefox < 65.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-18502 (arbitrary code execution) Several memory safety bugs have been found in Firefox < 65.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2018-18503 (arbitrary code execution) A memory corruption vulnerability has been found in the Audio Buffer component of Firefox < 65.0. When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatch in some situations. - CVE-2018-18504 (arbitrary code execution) A memory corruption and out-of-bounds read have been found in Firefox < 65.0, that can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results in a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. - CVE-2018-18505 (privilege escalation) A privilege escalation issue has been found in Firefox < 65.0. An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. - CVE-2018-18506 (access restriction bypass) When proxy auto-detection is enabled in Firefox < 65.0, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. Impact ====== A remote attacker might be able to execute arbitrary code via a crafted web content, or force requests to localhost to be sent through a proxy to another server. A local attacker might be able to escape firefox's sandbox via privilege escalation . References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1510114 https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1512450%2C1517542%2C1513201… https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1499426%2C1480090%2C1472990… https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1509442 https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1496413 https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1497749 https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-185… https://bugzilla.mozilla.org/show_bug.cgi?id=1503393 https://security.archlinux.org/CVE-2018-18500 https://security.archlinux.org/CVE-2018-18501 https://security.archlinux.org/CVE-2018-18502 https://security.archlinux.org/CVE-2018-18503 https://security.archlinux.org/CVE-2018-18504 https://security.archlinux.org/CVE-2018-18505 https://security.archlinux.org/CVE-2018-18506

1 0

[ASA-201902-1] dovecot: authentication bypass
by Remi Gacogne 11 Feb '19

11 Feb '19

Arch Linux Security Advisory ASA-201902-1 ========================================= Severity: High Date : 2019-02-06 CVE-ID : CVE-2019-3814 Package : dovecot Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-872 Summary ======= The package dovecot before version 2.3.4.1-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 2.3.4.1-1. # pacman -Syu "dovecot>=2.3.4.1-1" The problem has been fixed upstream in version 2.3.4.1. Workaround ========== None. Description =========== A vulnerability has been found in Dovecot versions prior to 2.3.4.1, allowing a remote client in possession of a trusted SSL certificate to log in as any user, in some configurations. This affects only installations using auth_ssl_require_client_cert = yes and auth_ssl_username_from_cert = yes, and the the attacker might have access to a trusted certificate without the ssl_cert_username_field (default to commonName) set in it. Impact ====== A remote client in possession of a trusted SSL certificate might be able to log in as any user. References ========== https://www.dovecot.org/pipermail/dovecot/2019-February/114575.html https://github.com/dovecot/core/commit/61471a5c42528090cffcca9bceded3167466… https://security.archlinux.org/CVE-2019-3814

1 0

[ASA-201901-18] ghostscript: sandbox escape
by Morten Linderud 31 Jan '19

31 Jan '19

Arch Linux Security Advisory ASA-201901-18 ========================================== Severity: High Date : 2019-01-29 CVE-ID : CVE-2019-6116 Package : ghostscript Type : sandbox escape Remote : Yes Link : https://security.archlinux.org/AVG-860 Summary ======= The package ghostscript before version 9.26-2 is vulnerable to sandbox escape. Resolution ========== Upgrade to 9.26-2. # pacman -Syu "ghostscript>=9.26-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== It was found that ghostscript could leak sensitive operators on the operand stack when a pseudo-operator pushes a subroutine. A specially crafted PostScript file could use this flaw to escape the -dSAFER protection in order to, for example, have access to the file system and execute commands. Impact ====== A remote attacker is able to escape the sandbox via a specially crafted PostScript document. References ========== https://marc.info/?l=oss-security&m=154825433813390 https://bugs.chromium.org/p/project-zero/issues/detail?id=1729&desc=2 https://bugs.ghostscript.com/show_bug.cgi?id=700317 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=13b0a36f8181db66a… http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2db98f9c66135601e… http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=99f13091a3f309bdc… http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=59d8f4deef90c1598… http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2768d1a6dddb83f5c… http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=49c8092da88ef6bb0… https://security.archlinux.org/CVE-2019-6116

1 0

[ASA-201901-17] subversion: denial of service
by Morten Linderud 29 Jan '19

29 Jan '19

Arch Linux Security Advisory ASA-201901-17 ========================================== Severity: High Date : 2019-01-28 CVE-ID : CVE-2018-11803 Package : subversion Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-858 Summary ======= The package subversion before version 1.11.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.11.1-1. # pacman -Syu "subversion>=1.11.1-1" The problem has been fixed upstream in version 1.11.1. Workaround ========== None. Description =========== A denial of service has been found in subversion versions prior to 1.11.1, allowing a malicious SVN client to crash a remote server using mod_dav_svn by omitting the root path from a recursive directory listing request, causing mod_dav_svn to dereference an uninitialized pointer variable and crash the httpd worker process handling the request. Impact ====== A remote attacker is able to crash the server by sending a specially crafted request. References ========== https://subversion.apache.org/security/CVE-2018-11803-advisory.txt https://security.archlinux.org/CVE-2018-11803

1 0

[ASA-201901-10] go-pie: private key recovery
by Morten Linderud 28 Jan '19

28 Jan '19

Arch Linux Security Advisory ASA-201901-11 ========================================== Severity: Medium Date : 2019-01-24 CVE-ID : CVE-2019-6486 Package : go Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-859 Summary ======= The package go before version 2:1.11.5-1 is vulnerable to private key recovery. Resolution ========== Upgrade to 2:1.11.5-1. # pacman -Syu "go>=2:1.11.5-1" The problem has been fixed upstream in version 1.11.5. Workaround ========== None. Description =========== Go before versions 1.10.8 and 1.11.5 has a vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves. A remote attacker can exploit this by crafting inputs that consume excessive amounts of CPU. These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some cases, if an ECDH private key is reused more than once, the attack can also lead to key recovery. Impact ====== A remote attacker can crash the system with maliciously crafted input, or recover the private key. References ========== https://groups.google.com/forum/m/#!topic/golang-announce/mVeX35iXuSw https://github.com/golang/go/issues/29903 https://github.com/golang/go/commit/42b42f71 https://security.archlinux.org/CVE-2019-6486

1 1