- Arch-security - lists.archlinux.org

[ASA-202101-38] dnsmasq: multiple issues
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-38 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2020-25681 CVE-2020-25682 CVE-2020-25683 CVE-2020-25684 CVE-2020-25685 CVE-2020-25686 CVE-2020-25687 Package : dnsmasq Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1470 Summary ======= The package dnsmasq before version 2.83-1 is vulnerable to multiple issues including arbitrary code execution, denial of service and insufficient validation. Resolution ========== Upgrade to 2.83-1. # pacman -Syu "dnsmasq>=2.83-1" The problems have been fixed upstream in version 2.83. Workaround ========== None. Description =========== - CVE-2020-25681 (arbitrary code execution) A heap-based buffer overflow was discovered in dnsmasq before version 2.83 in the way it sorts RRSets before validating them with DNSSEC data. An attacker on the network, who can forge DNS replies such as that they are accepted as valid, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. - CVE-2020-25682 (arbitrary code execution) A buffer overflow vulnerability was discovered in the way dnsmasq before version 2.83 extract names from DNS packets before validating them with DNSSEC data. An attacker on the network, who can create valid DNS replies, could use this flaw to cause an overflow with arbitrary data in a heap-allocated memory, possibly executing code on the machine. The flaw is in rfc1035.c:extract_name() function, which writes data to the memory pointed by name assuming MAXDNAME*2 bytes are available in the buffer. However, in some code execution paths it is possible extract_name() gets passed an offset from the base buffer, thus reducing in practice the number of available bytes that can be written in the buffer. - CVE-2020-25683 (denial of service) A heap-based buffer overflow was discovered in dnsmasq before version 2.83 when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a Denial of Service. - CVE-2020-25684 (insufficient validation) A flaw was found when getting a reply from a forwarded query, where dnsmasq before version 2.83 checks in forward.c:reply_query() if the reply destination address/port is used by the pending forwarded queries. However, it does not use the address/port to retrieve the exact forwarded query, substantially reducing the number of attempts an attacker on the network would have to perform to forge a reply and get it accepted by dnsmasq. This issue contrasts with RFC5452, which specifies a query's attributes that all must be used to match a reply. This flaw allows an attacker to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25685 or CVE-2020-25686, the attack complexity of a successful attack is reduced. - CVE-2020-25685 (insufficient validation) When getting a reply from a forwarded query, dnsmasq before version 2.83 checks in forward.c:reply_query() which one is the forwarded query that matches the reply by only using a weak hash of the query name. Due to the weak hash (CRC32 when dnsmasq is compiled without DNSSEC, SHA-1 when it is) an off-path attacker can find several different domains all having the same hash, substantially reducing the number of attempts he would have to perform to forge a reply and get it accepted by dnsmasq. This is in contrast with RFC5452, which specifies that query name is one of the attributes of a query that must be used to match a reply. This flaw could be abused to perform a DNS Cache Poisoning attack. If chained with CVE-2020-25684 the attack complexity of a successful attack is reduced. - CVE-2020-25686 (insufficient validation) A flaw was found when receiving a query, where dnsmasq before version 2.83 does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same name. This flaw allows an off-path attacker on the network to substantially reduce the number of attempts that would have to be performed to forge a reply and have it accepted by dnsmasq. This issue is mentioned in the "Birthday Attacks" section of RFC5452. If chained with CVE-2020-25684, the attack complexity of a successful attack is reduced. - CVE-2020-25687 (denial of service) A heap-based buffer overflow was discovered in dnsmasq before version 2.83 when DNSSEC is enabled and before it validates the received DNS entries. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rtc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of Service. Impact ====== A remote attacker can execute arbitrary code, bypass validation and crash the application through crafted DNS responses. References ========== https://www.openwall.com/lists/oss-security/2021/01/19/1 https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html https://www.jsof-tech.com/disclosures/dnspooq/ https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=4e96a4be685c… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=257ac0c5f773… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=2d765867c597… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=2024f9729713… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=15b60ddf935a… https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=6a6e06fbb0d4… https://security.archlinux.org/CVE-2020-25681 https://security.archlinux.org/CVE-2020-25682 https://security.archlinux.org/CVE-2020-25683 https://security.archlinux.org/CVE-2020-25684 https://security.archlinux.org/CVE-2020-25685 https://security.archlinux.org/CVE-2020-25686 https://security.archlinux.org/CVE-2020-25687

1 0

[ASA-202101-37] virtualbox: multiple issues
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-37 ========================================== Severity: High Date : 2021-01-20 CVE-ID : CVE-2021-2073 CVE-2021-2074 CVE-2021-2086 CVE-2021-2111 CVE-2021-2112 CVE-2021-2119 CVE-2021-2120 CVE-2021-2121 CVE-2021-2123 CVE-2021-2124 CVE-2021-2125 CVE-2021-2126 CVE-2021-2127 CVE-2021-2128 CVE-2021-2129 CVE-2021-2130 CVE-2021-2131 Package : virtualbox Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1483 Summary ======= The package virtualbox before version 6.1.18-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation, denial of service and information disclosure. Resolution ========== Upgrade to 6.1.18-1. # pacman -Syu "virtualbox>=6.1.18-1" The problems have been fixed upstream in version 6.1.18. Workaround ========== None. Description =========== - CVE-2021-2073 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2074 (arbitrary code execution) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. - CVE-2021-2086 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2111 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2112 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2119 (information disclosure) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2021-2120 (information disclosure) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2021-2121 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2123 (information disclosure) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2021-2124 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2125 (insufficient validation) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle VM VirtualBox accessible data as well as unauthorized read access to a subset of Oracle VM VirtualBox accessible data. - CVE-2021-2126 (insufficient validation) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. - CVE-2021-2127 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2128 (information disclosure) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2021-2129 (insufficient validation) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. - CVE-2021-2130 (denial of service) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. - CVE-2021-2131 (insufficient validation) Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data. Impact ====== Some exploit might crash the application or bypass authorization for resource modification. References ========== https://www.oracle.com/security-alerts/cpujan2021verbose.html#OVIR https://security.archlinux.org/CVE-2021-2073 https://security.archlinux.org/CVE-2021-2074 https://security.archlinux.org/CVE-2021-2086 https://security.archlinux.org/CVE-2021-2111 https://security.archlinux.org/CVE-2021-2112 https://security.archlinux.org/CVE-2021-2119 https://security.archlinux.org/CVE-2021-2120 https://security.archlinux.org/CVE-2021-2121 https://security.archlinux.org/CVE-2021-2123 https://security.archlinux.org/CVE-2021-2124 https://security.archlinux.org/CVE-2021-2125 https://security.archlinux.org/CVE-2021-2126 https://security.archlinux.org/CVE-2021-2127 https://security.archlinux.org/CVE-2021-2128 https://security.archlinux.org/CVE-2021-2129 https://security.archlinux.org/CVE-2021-2130 https://security.archlinux.org/CVE-2021-2131

1 0

[ASA-202101-36] podofo: multiple issues
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-36 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2017-8054 CVE-2018-5783 CVE-2018-11254 CVE-2018-11255 CVE-2018-11256 CVE-2018-12982 CVE-2018-14320 CVE-2018-19532 CVE-2018-20751 CVE-2019-9199 CVE-2019-9687 Package : podofo Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-867 Summary ======= The package podofo before version 0.9.7-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 0.9.7-1. # pacman -Syu "podofo>=0.9.7-1" The problems have been fixed upstream in version 0.9.7. Workaround ========== None. Description =========== - CVE-2017-8054 (denial of service) The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cpp:464 in PoDoFo 0.9.6 allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted PDF document. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-5783 (denial of service) In PoDoFo 0.9.6, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecObjects.h). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted pdf file. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-11254 (denial of service) An issue was discovered in PoDoFo 0.9.6. There is an Excessive Recursion in the PdfPagesTree::GetPageNode() function of PdfPagesTree.cpp. Remote attackers could leverage this vulnerability to cause a denial of service through a crafted pdf file, a related issue to CVE-2017-8054. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-11255 (denial of service) An issue was discovered in PoDoFo 0.9.6. The function PdfPage::GetPageNumber() in PdfPage.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-11256 (denial of service) An issue was discovered in PoDoFo 0.9.6. The function PdfDocument::Append() in PdfDocument.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF document. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-12982 (denial of service) An invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service impact via a crafted file. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-14320 (arbitrary code execution) This vulnerability in PoDoFo 0.9.6 allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within PdfEncoding::ParseToUnicode. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-19532 (denial of service) A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, as demonstrated by podofoimpose. It allows an attacker to cause Denial of Service. The issue is fixed in PoDoFo version 0.9.7. - CVE-2018-20751 (denial of service) An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage->GetObject()->GetDictionary().AddKey(PdfName("MediaBox"),var) can be problematic due to the function GetObject() being called for the pPage NULL pointer object. The value of pPage at this point is 0x0, which causes a NULL pointer dereference. The issue is fixed in PoDoFo version 0.9.7. - CVE-2019-9199 (denial of service) PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.cpp in PoDoFo 0.9.6 has a NULL pointer dereference that can (for example) be triggered by sending a crafted PDF file to the podofoimpose binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. The issue is fixed in PoDoFo version 0.9.7. - CVE-2019-9687 (arbitrary code execution) PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp. The issue is fixed in PoDoFo version 0.9.7. Impact ====== A maliciously crafted PDF file can crash the application or execute arbitrary code. References ========== https://bugs.archlinux.org/task/61651 https://qwertwwwe.github.io/2017/04/22/PoDoFo-0-9-5-allows-remote-attackers… https://sourceforge.net/p/podofo/code/1941/ https://sourceforge.net/p/podofo/tickets/4/ https://sourceforge.net/p/podofo/code/1949/ https://bugzilla.redhat.com/show_bug.cgi?id=1576174 https://sourceforge.net/p/podofo/tickets/20/ https://bugzilla.redhat.com/show_bug.cgi?id=1575502 https://bugzilla.redhat.com/attachment.cgi?id=1432515 https://sourceforge.net/p/podofo/code/1952/ https://bugzilla.redhat.com/show_bug.cgi?id=1575851 https://sourceforge.net/p/podofo/code/1938/ https://sourceforge.net/p/podofo/tickets/22/ https://bugzilla.redhat.com/show_bug.cgi?id=1595689 https://bugzilla.redhat.com/attachment.cgi?id=1455023 https://sourceforge.net/p/podofo/code/1948/ https://zerodayinitiative.com/advisories/ZDI-18-1046 https://sourceforge.net/p/podofo/code/1953/ https://research.loginsoft.com/vulnerability/null-pointer-dereference-vulne… https://sourceforge.net/p/podofo/tickets/32/ https://sourceforge.net/p/podofo/code/1950/ https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-… https://sourceforge.net/p/podofo/tickets/33/ https://sourceforge.net/p/podofo/code/1954/ https://research.loginsoft.com/vulnerability/null-pointer-dereference-vulne… https://sourceforge.net/p/podofo/tickets/40/ https://sourceforge.net/p/podofo/code/1971/ https://sourceforge.net/p/podofo/mailman/podofo-users/thread/CAD3bFv0VMb1DH… https://sourceforge.net/p/podofo/code/1969/ https://security.archlinux.org/CVE-2017-8054 https://security.archlinux.org/CVE-2018-5783 https://security.archlinux.org/CVE-2018-11254 https://security.archlinux.org/CVE-2018-11255 https://security.archlinux.org/CVE-2018-11256 https://security.archlinux.org/CVE-2018-12982 https://security.archlinux.org/CVE-2018-14320 https://security.archlinux.org/CVE-2018-19532 https://security.archlinux.org/CVE-2018-20751 https://security.archlinux.org/CVE-2019-9199 https://security.archlinux.org/CVE-2019-9687

1 0

[ASA-202101-35] vlc: arbitrary code execution
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-35 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-26664 Package : vlc Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1423 Summary ======= The package vlc before version 3.0.12-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 3.0.12-1. # pacman -Syu "vlc>=3.0.12-1" The problem has been fixed upstream in version 3.0.12. Workaround ========== None. Description =========== A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file. It is fixed in version 3.0.12. Impact ====== A crafted .mkv file can crash or possibly execute arbitrary code. References ========== https://gist.githubusercontent.com/henices/db11664dd45b9f322f8514d182aef5ea… https://code.videolan.org/videolan/vlc-3.0/-/commit/ec1f55ee9ace5cc675395a1… https://security.archlinux.org/CVE-2020-26664

1 0

[ASA-202101-34] gptfdisk: arbitrary code execution
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-34 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2021-0308 Package : gptfdisk Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1435 Summary ======= The package gptfdisk before version 1.0.6-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.0.6-1. # pacman -Syu "gptfdisk>=1.0.6-1" The problem has been fixed upstream in version 1.0.6. Workaround ========== None. Description =========== A security issue was found in GPT fdisk before version 1.0.6. In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. Impact ====== A badly formatted MBR disk could execute arbitrary code. References ========== https://source.android.com/security/bulletin/2021-01-01#system https://android.googlesource.com/platform/external/gptfdisk/+/6d369451868ce…! https://sourceforge.net/p/gptfdisk/code/ci/f523bbc0c2437fe259aa3aff5e819e24… https://security.archlinux.org/CVE-2021-0308

1 0

[ASA-202101-33] linux: directory traversal
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-33 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-28374 Package : linux Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1442 Summary ======= The package linux before version 5.10.7.arch1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 5.10.7.arch1-1. # pacman -Syu "linux>=5.10.7.arch1-1" The problem has been fixed upstream in version 5.10.7.arch1. Workaround ========== None. Description =========== In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Impact ====== An attacker can traverse directories on the system through malicious operations. References ========== https://www.openwall.com/lists/oss-security/2021/01/12/12 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2020-28374

1 0

[ASA-202101-32] linux-hardened: directory traversal
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-32 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-28374 Package : linux-hardened Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1443 Summary ======= The package linux-hardened before version 5.10.7.a-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 5.10.7.a-1. # pacman -Syu "linux-hardened>=5.10.7.a-1" The problem has been fixed upstream in version 5.10.7.a. Workaround ========== None. Description =========== In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Impact ====== An attacker can traverse directories on the system through malicious operations. References ========== https://www.openwall.com/lists/oss-security/2021/01/12/12 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2020-28374

1 0

[ASA-202101-31] linux-zen: directory traversal
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-31 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-28374 Package : linux-zen Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1444 Summary ======= The package linux-zen before version 5.10.7.zen1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 5.10.7.zen1-1. # pacman -Syu "linux-zen>=5.10.7.zen1-1" The problem has been fixed upstream in version 5.10.7.zen1. Workaround ========== None. Description =========== In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Impact ====== An attacker can traverse directories on the system through malicious operations. References ========== https://www.openwall.com/lists/oss-security/2021/01/12/12 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2020-28374

1 0

[ASA-202101-30] linux-lts: directory traversal
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-30 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-28374 Package : linux-lts Type : directory traversal Remote : No Link : https://security.archlinux.org/AVG-1445 Summary ======= The package linux-lts before version 5.4.89-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 5.4.89-1. # pacman -Syu "linux-lts>=5.4.89-1" The problem has been fixed upstream in version 5.4.89. Workaround ========== None. Description =========== In drivers/target/target_core_xcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by remote attackers to read or write files via directory traversal in an XCOPY request, aka CID-2896c93811e3. For example, an attack can occur over a network if the attacker has access to one iSCSI LUN. The attacker gains control over file access because I/O operations are proxied via an attacker-selected backstore. Impact ====== An attacker can traverse directories on the system through malicious operations. References ========== https://www.openwall.com/lists/oss-security/2021/01/12/12 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… https://security.archlinux.org/CVE-2020-28374

1 0

[ASA-202101-29] lldpd: information disclosure
by Morten Linderud 28 Jan '21

28 Jan '21

Arch Linux Security Advisory ASA-202101-29 ========================================== Severity: Medium Date : 2021-01-20 CVE-ID : CVE-2020-27827 Package : lldpd Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1451 Summary ======= The package lldpd before version 1.0.8-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 1.0.8-1. # pacman -Syu "lldpd>=1.0.8-1" The problem has been fixed upstream in version 1.0.8. Workaround ========== None. Description =========== A security issue was found in lldpd before version 1.0.8. A packet that contains multiple instances of certain TLVs will cause lldpd to continually allocate memory and leak the old memory. As an example, multiple instances of system name TLV will cause old values to be dropped by the decoding routine. Impact ====== A remote attack can leak information through crafted packets. References ========== https://github.com/lldpd/lldpd/blob/master/NEWS https://github.com/lldpd/lldpd/commit/a8d3c90feca548fc0656d95b5d278713db86f… https://mail.openvswitch.org/pipermail/ovs-announce/2021-January/000269.html https://github.com/openvswitch/ovs/pull/337 https://github.com/openvswitch/ovs/commit/f915f32f5667e3b9d460055d8b47fa5d2… https://security.archlinux.org/CVE-2020-27827

1 0