Arch Linux Security Advisory ASA-202102-4 ========================================= Severity: Critical Date : 2021-02-06 CVE-ID : CVE-2020-16044 CVE-2021-21117 CVE-2021-21118 CVE-2021-21119 CVE-2021-21120 CVE-2021-21121 CVE-2021-21122 CVE-2021-21123 CVE-2021-21124 CVE-2021-21125 CVE-2021-21126 CVE-2021-21127 CVE-2021-21128 CVE-2021-21129 CVE-2021-21130 CVE-2021-21131 CVE-2021-21132 CVE-2021-21133 CVE-2021-21134 CVE-2021-21135 CVE-2021-21136 CVE-2021-21137 CVE-2021-21138 CVE-2021-21139 CVE-2021-21140 CVE-2021-21141 CVE-2021-21142 CVE-2021-21143 CVE-2021-21144 CVE-2021-21145 CVE-2021-21146 CVE-2021-21147 CVE-2021-21148 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1478 Summary ======= The package vivaldi before version 3.6.2165.36-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation, content spoofing and incorrect calculation. Resolution ========== Upgrade to 3.6.2165.36-1. # pacman -Syu "vivaldi>=3.6.2165.36-1" The problems have been fixed upstream in version 3.6.2165.36. Workaround ========== None. Description =========== - CVE-2020-16044 (arbitrary code execution) A security issue was found in Firefox before 84.0.2, Thunderbird before 78.6.1 and Chromium before 88.0.4324.96. A malicious peer could have modified a COOKIE-ECHO chunk in an SCTP packet in a way that potentially resulted in a use-after-free. Mozilla presumes that with enough effort it could have been exploited to run arbitrary code. - CVE-2021-21117 (insufficient validation) An insufficient policy enforcement security issue was found in the Cryptohome component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21118 (insufficient validation) An insufficient data validation security issue was found in the V8 component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21119 (arbitrary code execution) A use after free security issue was found in the Media component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21120 (arbitrary code execution) A use after free security issue was found in the WebSQL component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21121 (arbitrary code execution) A use after free security issue was found in the Omnibox component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21122 (arbitrary code execution) A use after free security issue was found in the Blink component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21123 (insufficient validation) An insufficient data validation security issue was found in the File System component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21124 (arbitrary code execution) A potential use after free security issue was found in the Speech Recognizer component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21125 (insufficient validation) An insufficient policy enforcement security issue was found in the File System API component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21126 (insufficient validation) An insufficient policy enforcement security issue was found in the extensions component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21127 (insufficient validation) An insufficient policy enforcement security issue was found in the extensions component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21128 (arbitrary code execution) A heap buffer overflow security issue was found in the Blink component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21129 (insufficient validation) An insufficient policy enforcement security issue was found in the File System API component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21130 (insufficient validation) An insufficient policy enforcement security issue was found in the File System API component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21131 (insufficient validation) An insufficient policy enforcement security issue was found in the File System API component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21132 (incorrect calculation) An inappropriate implementation security issue was found in the DevTools component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21133 (insufficient validation) An insufficient policy enforcement security issue was found in the Downloads component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21134 (content spoofing) An incorrect security UI security issue was found in the Page Info component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21135 (incorrect calculation) An inappropriate implementation security issue was found in the Performance API component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21136 (insufficient validation) An insufficient policy enforcement security issue was found in the WebView component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21137 (incorrect calculation) An inappropriate implementation security issue was found in the DevTools component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21138 (arbitrary code execution) A use after free security issue was found in the DevTools component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21139 (incorrect calculation) An inappropriate implementation security issue was found in the iframe sandbox component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21140 (arbitrary code execution) An uninitialized use security issue was found in the USB component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21141 (insufficient validation) An insufficient policy enforcement security issue was found in the File System API component of the Chromium browser before version 88.0.4324.96. - CVE-2021-21142 (arbitrary code execution) A use after free security issue was found in the Payments component of the Chromium browser before version 88.0.4324.146. - CVE-2021-21143 (arbitrary code execution) A heap buffer overflow security issue was found in the Extensions component of the Chromium browser before version 88.0.4324.146. - CVE-2021-21144 (arbitrary code execution) A heap buffer overflow security issue was found in the Tab Groups component of the Chromium browser before version 88.0.4324.146. - CVE-2021-21145 (arbitrary code execution) A use after free security issue was found in the Fonts component of the Chromium browser before version 88.0.4324.146. - CVE-2021-21146 (arbitrary code execution) A use after free security issue was found in the Navigation component of the Chromium browser before version 88.0.4324.146. - CVE-2021-21147 (incorrect calculation) An inappropriate implementation security issue was found in the Skia component of the Chromium browser before version 88.0.4324.146. - CVE-2021-21148 (arbitrary code execution) A heap buffer overflow security issue was found in the V8 component of the Chromium browser before version 88.0.4324.150. Impact ====== A remote attacker might be able to bypass security measures, trick the user into performing unwanted actions or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2021-01/#CVE-2020-1604... https://bugzilla.mozilla.org/show_bug.cgi?id=1683964 https://hg.mozilla.org/mozilla-central/rev/08ba03dc8d4420e04e7c77fee3013e681... https://hg.mozilla.org/mozilla-central/rev/8c09f4813fc7e8f44605b6092262199bf... https://hg.mozilla.org/mozilla-central/rev/5991645a87d2abf289686d09d943229c9... https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desk... https://crbug.com/1137179 https://crbug.com/1161357 https://crbug.com/1160534 https://crbug.com/1160602 https://crbug.com/1161143 https://crbug.com/1162131 https://crbug.com/1137247 https://crbug.com/1131346 https://crbug.com/1152327 https://crbug.com/1108126 https://crbug.com/1115590 https://crbug.com/1138877 https://crbug.com/1140403 https://crbug.com/1140410 https://crbug.com/1140417 https://crbug.com/1128206 https://crbug.com/1157743 https://crbug.com/1157800 https://crbug.com/1157818 https://crbug.com/1038002 https://crbug.com/1093791 https://crbug.com/1122487 https://crbug.com/937131 https://crbug.com/1136327 https://crbug.com/1140435 https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desk... https://crbug.com/1169317 https://crbug.com/1163504 https://crbug.com/1163845 https://crbug.com/1154965 https://crbug.com/1161705 https://crbug.com/1162942 https://chromereleases.googleblog.com/2021/02/stable-channel-update-for-desk... https://crbug.com/1170176 https://security.archlinux.org/CVE-2020-16044 https://security.archlinux.org/CVE-2021-21117 https://security.archlinux.org/CVE-2021-21118 https://security.archlinux.org/CVE-2021-21119 https://security.archlinux.org/CVE-2021-21120 https://security.archlinux.org/CVE-2021-21121 https://security.archlinux.org/CVE-2021-21122 https://security.archlinux.org/CVE-2021-21123 https://security.archlinux.org/CVE-2021-21124 https://security.archlinux.org/CVE-2021-21125 https://security.archlinux.org/CVE-2021-21126 https://security.archlinux.org/CVE-2021-21127 https://security.archlinux.org/CVE-2021-21128 https://security.archlinux.org/CVE-2021-21129 https://security.archlinux.org/CVE-2021-21130 https://security.archlinux.org/CVE-2021-21131 https://security.archlinux.org/CVE-2021-21132 https://security.archlinux.org/CVE-2021-21133 https://security.archlinux.org/CVE-2021-21134 https://security.archlinux.org/CVE-2021-21135 https://security.archlinux.org/CVE-2021-21136 https://security.archlinux.org/CVE-2021-21137 https://security.archlinux.org/CVE-2021-21138 https://security.archlinux.org/CVE-2021-21139 https://security.archlinux.org/CVE-2021-21140 https://security.archlinux.org/CVE-2021-21141 https://security.archlinux.org/CVE-2021-21142 https://security.archlinux.org/CVE-2021-21143 https://security.archlinux.org/CVE-2021-21144 https://security.archlinux.org/CVE-2021-21145 https://security.archlinux.org/CVE-2021-21146 https://security.archlinux.org/CVE-2021-21147 https://security.archlinux.org/CVE-2021-21148