- Arch-security - lists.archlinux.org

[ASA-202103-20] dotnet-runtime: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-20 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-26701 Package : dotnet-runtime Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1698 Summary ======= The package dotnet-runtime before version 5.0.4.sdk104-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.0.4.sdk104-1. # pacman -Syu "dotnet-runtime>=5.0.4.sdk104-1" The problem has been fixed upstream in version 5.0.4.sdk104. Workaround ========== None. Description =========== A remote code execution vulnerability exists in .NET 5.0 before Runtime 5.0.4 and SDK 5.0.104 as well as .NET Core 3.1 before Runtime 3.1.13 and SDK 3.1.113 due to how text encoding is performed in the System.Text.Encodings.Web package, caused by a buffer overrun. Impact ====== An attacker can execute arbitrary code by abusing the text encoding. References ========== https://bugs.archlinux.org/task/69317 https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26701 https://github.com/dotnet/announcements/issues/178 https://security.archlinux.org/CVE-2021-26701

1 0

[ASA-202103-19] vivaldi: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-19 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-27844 CVE-2021-21159 CVE-2021-21160 CVE-2021-21161 CVE-2021-21162 CVE-2021-21163 CVE-2021-21165 CVE-2021-21166 CVE-2021-21167 CVE-2021-21168 CVE-2021-21169 CVE-2021-21170 CVE-2021-21171 CVE-2021-21172 CVE-2021-21173 CVE-2021-21174 CVE-2021-21175 CVE-2021-21176 CVE-2021-21177 CVE-2021-21178 CVE-2021-21179 CVE-2021-21180 CVE-2021-21181 CVE-2021-21182 CVE-2021-21183 CVE-2021-21184 CVE-2021-21185 CVE-2021-21186 CVE-2021-21187 CVE-2021-21188 CVE-2021-21189 CVE-2021-21190 CVE-2021-21191 CVE-2021-21192 CVE-2021-21193 Package : vivaldi Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1633 Summary ======= The package vivaldi before version 3.7.2218.45-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation, access restriction bypass, content spoofing, incorrect calculation and information disclosure. Resolution ========== Upgrade to 3.7.2218.45-1. # pacman -Syu "vivaldi>=3.7.2218.45-1" The problems have been fixed upstream in version 3.7.2218.45. Workaround ========== None. Description =========== - CVE-2020-27844 (arbitrary code execution) A heap-based buffer overflow was discovered in lib/openjp2/t2.c:973 in the current master (commit 18b1138fbe3bb0ae4aa2bf1369f9430a8ec6fa00) of OpenJPEG. - CVE-2021-21159 (arbitrary code execution) A heap buffer overflow security issue was found in the TabStrip component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21160 (arbitrary code execution) A heap buffer overflow security issue was found in the WebAudio component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21161 (arbitrary code execution) A heap buffer overflow security issue was found in the TabStrip component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21162 (arbitrary code execution) A use after free security issue was found in the WebRTC component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21163 (insufficient validation) An insufficient data validation security issue was found in the Reader Mode component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21165 (arbitrary code execution) An object lifecycle security issue was found in the audio component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21166 (arbitrary code execution) An object lifecycle security issue was found in the audio component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21167 (arbitrary code execution) A use after free security issue was found in the bookmarks component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21168 (access restriction bypass) An insufficient policy enforcement security issue was found in the appcache component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21169 (information disclosure) An out of bounds memory access security issue was found in the V8 component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21170 (content spoofing) An incorrect security UI security issue was found in the Loader component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21171 (content spoofing) An incorrect security UI security issue was found in the TabStrip and Navigation components of the Chromium browser before version 89.0.4389.72. - CVE-2021-21172 (access restriction bypass) An insufficient policy enforcement security issue was found in the File System API component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21173 (information disclosure) A side-channel information leakage security issue was found in the Network Internals component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21174 (incorrect calculation) An inappropriate implementation security issue was found in the Referrer component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21175 (incorrect calculation) An inappropriate implementation security issue was found in the Site isolation component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21176 (incorrect calculation) An inappropriate implementation security issue was found in the full screen mode component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21177 (access restriction bypass) An insufficient policy enforcement security issue was found in the Autofill component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21178 (incorrect calculation) An inappropriate implementation security issue was found in the Compositing component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21179 (arbitrary code execution) A use after free security issue was found in the Network Internals component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21180 (arbitrary code execution) A use after free security issue was found in the tab search component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21181 (information disclosure) A side-channel information leakage security issue was found in the autofill component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21182 (access restriction bypass) An insufficient policy enforcement security issue was found in the navigations component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21183 (incorrect calculation) An inappropriate implementation security issue was found in the performance APIs component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21184 (incorrect calculation) An inappropriate implementation security issue was found in the performance APIs component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21185 (access restriction bypass) An insufficient policy enforcement security issue was found in the extensions component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21186 (access restriction bypass) An insufficient policy enforcement security issue was found in the QR scanning component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21187 (insufficient validation) An insufficient data validation security issue was found in the URL formatting component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21188 (arbitrary code execution) A use after free security issue was found in the Blink component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21189 (access restriction bypass) An insufficient policy enforcement security issue was found in the payments component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21190 (arbitrary code execution) An uninitialized use security issue was found in the PDFium component of the Chromium browser before version 89.0.4389.72. - CVE-2021-21191 (arbitrary code execution) A use after free security issue was found in the WebRTC component of the Chromium browser before version 89.0.4389.90. - CVE-2021-21192 (arbitrary code execution) A heap buffer overflow security issue was found in the tab groups component of the Chromium browser before version 89.0.4389.90. - CVE-2021-21193 (arbitrary code execution) A use after free security issue was found in the Blink component of the Chromium browser before version 89.0.4389.90. Google is aware of reports that an exploit for this issue exists in the wild. Impact ====== A remote attacker might be able to bypass security measures, trick the user into performing unwanted actions or execute arbitrary code. References ========== https://vivaldi.com/blog/desktop/minor-update-2-for-vivaldi-desktop-3-6/ https://vivaldi.com/blog/vivaldi-fires-up-performance-2/ https://github.com/uclouvain/openjpeg/issues/1299 https://github.com/uclouvain/openjpeg/pull/1301 https://github.com/uclouvain/openjpeg/commit/73fdf28342e4594019af26eb6a347a… https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-des… https://crbug.com/1171049 https://crbug.com/1170531 https://crbug.com/1173702 https://crbug.com/1172054 https://crbug.com/1111239 https://crbug.com/1174582 https://crbug.com/1177465 https://crbug.com/1161144 https://crbug.com/1152226 https://crbug.com/1166138 https://crbug.com/1111646 https://crbug.com/1152894 https://crbug.com/1150810 https://crbug.com/1154250 https://crbug.com/1158010 https://crbug.com/1146651 https://crbug.com/1170584 https://crbug.com/1173879 https://crbug.com/1174186 https://crbug.com/1174943 https://crbug.com/1175507 https://crbug.com/1182767 https://crbug.com/1049265 https://crbug.com/1105875 https://crbug.com/1131929 https://crbug.com/1100748 https://crbug.com/1153445 https://crbug.com/1155516 https://crbug.com/1161739 https://crbug.com/1165392 https://crbug.com/1166091 https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-des… https://crbug.com/1167357 https://crbug.com/1181387 https://crbug.com/1186287 https://security.archlinux.org/CVE-2020-27844 https://security.archlinux.org/CVE-2021-21159 https://security.archlinux.org/CVE-2021-21160 https://security.archlinux.org/CVE-2021-21161 https://security.archlinux.org/CVE-2021-21162 https://security.archlinux.org/CVE-2021-21163 https://security.archlinux.org/CVE-2021-21165 https://security.archlinux.org/CVE-2021-21166 https://security.archlinux.org/CVE-2021-21167 https://security.archlinux.org/CVE-2021-21168 https://security.archlinux.org/CVE-2021-21169 https://security.archlinux.org/CVE-2021-21170 https://security.archlinux.org/CVE-2021-21171 https://security.archlinux.org/CVE-2021-21172 https://security.archlinux.org/CVE-2021-21173 https://security.archlinux.org/CVE-2021-21174 https://security.archlinux.org/CVE-2021-21175 https://security.archlinux.org/CVE-2021-21176 https://security.archlinux.org/CVE-2021-21177 https://security.archlinux.org/CVE-2021-21178 https://security.archlinux.org/CVE-2021-21179 https://security.archlinux.org/CVE-2021-21180 https://security.archlinux.org/CVE-2021-21181 https://security.archlinux.org/CVE-2021-21182 https://security.archlinux.org/CVE-2021-21183 https://security.archlinux.org/CVE-2021-21184 https://security.archlinux.org/CVE-2021-21185 https://security.archlinux.org/CVE-2021-21186 https://security.archlinux.org/CVE-2021-21187 https://security.archlinux.org/CVE-2021-21188 https://security.archlinux.org/CVE-2021-21189 https://security.archlinux.org/CVE-2021-21190 https://security.archlinux.org/CVE-2021-21191 https://security.archlinux.org/CVE-2021-21192 https://security.archlinux.org/CVE-2021-21193

1 0

[ASA-202103-18] libebml: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-18 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-3405 Package : libebml Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1554 Summary ======= The package libebml before version 1.4.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.4.2-1. # pacman -Syu "libebml>=1.4.2-1" The problem has been fixed upstream in version 1.4.2. Workaround ========== None. Description =========== A security issue was found in libebml before version 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml. Impact ====== A crafted file could execute arbitrary code. References ========== https://bugs.archlinux.org/task/70039 https://bugzilla.redhat.com/show_bug.cgi?id=1926990 https://github.com/Matroska-Org/libebml/issues/74 https://github.com/Matroska-Org/libebml/pull/76 https://github.com/Matroska-Org/libebml/commit/3d3d2cff9b012059fa7cb536399b… https://security.archlinux.org/CVE-2021-3405

1 0

[ASA-202103-17] dotnet-sdk: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-17 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-1721 CVE-2021-1723 CVE-2021-24112 Package : dotnet-sdk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1449 Summary ======= The package dotnet-sdk before version 5.0.3.sdk103-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.0.3.sdk103-2. # pacman -Syu "dotnet-sdk>=5.0.3.sdk103-2" The problems have been fixed upstream in version 5.0.3.sdk103. Workaround ========== None. Description =========== - CVE-2021-1721 (denial of service) A security issue was found in dotnet-core before version 3.1.12. A denial-of-service vulnerability exists when creating HTTPS web request during X509 certificate chain building. - CVE-2021-1723 (denial of service) A flaw was found in dotnet-core before version 3.1.11. Running callbacks outside of locks results in Krestel deadlock using HTTP2. - CVE-2021-24112 (arbitrary code execution) A remote code execution vulnerability exists in dotnet-core before version 3.1.12 when parsing certain types of graphics files. This vulnerability only exists on systems running on MacOS or Linux. Impact ====== A malicious client can send crafted HTTP requests and crash the server, or execute arbitrary code by reading a crafted file. References ========== https://bugs.archlinux.org/task/69317 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1721 https://github.com/dotnet/announcements/issues/175 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723 https://github.com/dotnet/announcements/issues/170 https://github.com/dotnet/aspnetcore/commit/20ad9fa5dcde635c13c6c83806c4701… https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24112 https://github.com/dotnet/announcements/issues/176 https://security.archlinux.org/CVE-2021-1721 https://security.archlinux.org/CVE-2021-1723 https://security.archlinux.org/CVE-2021-24112

1 0

[ASA-202103-16] dotnet-runtime: multiple issues
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-16 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2021-1721 CVE-2021-1723 CVE-2021-24112 Package : dotnet-runtime Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1449 Summary ======= The package dotnet-runtime before version 5.0.3.sdk103-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 5.0.3.sdk103-2. # pacman -Syu "dotnet-runtime>=5.0.3.sdk103-2" The problems have been fixed upstream in version 5.0.3.sdk103. Workaround ========== None. Description =========== - CVE-2021-1721 (denial of service) A security issue was found in dotnet-core before version 3.1.12. A denial-of-service vulnerability exists when creating HTTPS web request during X509 certificate chain building. - CVE-2021-1723 (denial of service) A flaw was found in dotnet-core before version 3.1.11. Running callbacks outside of locks results in Krestel deadlock using HTTP2. - CVE-2021-24112 (arbitrary code execution) A remote code execution vulnerability exists in dotnet-core before version 3.1.12 when parsing certain types of graphics files. This vulnerability only exists on systems running on MacOS or Linux. Impact ====== A malicious client can send crafted HTTP requests and crash the server, or execute arbitrary code by reading a crafted file. References ========== https://bugs.archlinux.org/task/69317 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1721 https://github.com/dotnet/announcements/issues/175 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1723 https://github.com/dotnet/announcements/issues/170 https://github.com/dotnet/aspnetcore/commit/20ad9fa5dcde635c13c6c83806c4701… https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-24112 https://github.com/dotnet/announcements/issues/176 https://security.archlinux.org/CVE-2021-1721 https://security.archlinux.org/CVE-2021-1723 https://security.archlinux.org/CVE-2021-24112

1 0

[ASA-202103-15] awstats: directory traversal
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-15 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-35176 Package : awstats Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-1356 Summary ======= The package awstats before version 7.8-3 is vulnerable to directory traversal. Resolution ========== Upgrade to 7.8-3. # pacman -Syu "awstats>=7.8-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. This issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600. Impact ====== A malicious user could access files on the filesystem. References ========== https://bugs.archlinux.org/task/69301 https://github.com/eldy/awstats/issues/195 https://github.com/eldy/awstats/pull/196 https://github.com/eldy/AWStats/commit/0d4d4c05f8e73be8f71dd361dc55cbd52858… https://security.archlinux.org/CVE-2020-35176

1 0

[ASA-202103-14] groovy: privilege escalation
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-14 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-17521 Package : groovy Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1325 Summary ======= The package groovy before version 2.5.14-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.5.14-1. # pacman -Syu "groovy>=2.5.14-1" The problem has been fixed upstream in version 2.5.14. Workaround ========== None. Description =========== Groovy before version 2.5.14 may create temporary directories within the OS temporary directory which is shared between all users on affected systems. Groovy will create such directories for internal use when producing Java Stubs or on behalf of user code via two extension methods for creating temporary directories. If Groovy user code uses either of these extension methods, and stores executable code in the resulting temporary directory, this can lead to local privilege escalation. If such Groovy code is making use of the temporary directory to store sensitive information, such information could be exposed or modified. Impact ====== A local attacker is able to obtain and modify sensitive information in Groovy temporary directories leading to privilege escalation if executable code is stored. References ========== https://bugs.archlinux.org/task/68865 https://issues.apache.org/jira/browse/GROOVY-9824 https://github.com/apache/groovy/commit/98dc5d713926cd81b006c510a1546ccd520… https://security.archlinux.org/CVE-2020-17521

1 0

[ASA-202103-13] gitlab: arbitrary code execution
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-13 ========================================== Severity: Critical Date : 2021-03-25 CVE-ID : CVE-2021-22192 Package : gitlab Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1710 Summary ======= The package gitlab before version 13.9.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 13.9.4-1. # pacman -Syu "gitlab>=13.9.4-1" The problem has been fixed upstream in version 13.9.4. Workaround ========== None. Description =========== An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server. Impact ====== An authenticated malicious user is able to execute arbitrary code on the affected server. References ========== https://about.gitlab.com/releases/2021/03/17/security-release-gitlab-13-9-4… https://hackerone.com/reports/1125425 https://gitlab.com/gitlab-org/gitlab/-/issues/324452 https://gitlab.com/gitlab-org/gitlab/-/commit/179329b5c3c118924fb242dc449d0… https://security.archlinux.org/CVE-2021-22192

1 0

[ASA-202103-12] busybox: denial of service
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-12 ========================================== Severity: Low Date : 2021-03-25 CVE-ID : CVE-2021-28831 Package : busybox Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1707 Summary ======= The package busybox before version 1.32.1-4 is vulnerable to denial of service. Resolution ========== Upgrade to 1.32.1-4. # pacman -Syu "busybox>=1.32.1-4" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. Impact ====== A local attacker is able to provide a crafted zip file to crash the application. References ========== https://bugs.archlinux.org/task/70075 https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac7… https://security.archlinux.org/CVE-2021-28831

1 0

[ASA-202103-11] mkinitcpio-busybox: denial of service
by Morten Linderud 26 Mar '21

26 Mar '21

Arch Linux Security Advisory ASA-202103-11 ========================================== Severity: Low Date : 2021-03-25 CVE-ID : CVE-2021-28831 Package : mkinitcpio-busybox Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1708 Summary ======= The package mkinitcpio-busybox before version 1.32.1-3 is vulnerable to denial of service. Resolution ========== Upgrade to 1.32.1-3. # pacman -Syu "mkinitcpio-busybox>=1.32.1-3" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. Impact ====== A local attacker is able to provide a crafted zip file to crash the application. References ========== https://bugs.archlinux.org/task/70075 https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac7… https://security.archlinux.org/CVE-2021-28831

1 0