- Arch-security - lists.archlinux.org

[ASA-202003-6] linux: multiple issues
by Morten Linderud 12 Mar '20

12 Mar '20

Arch Linux Security Advisory ASA-202003-6 ========================================= Severity: High Date : 2020-03-08 CVE-ID : CVE-2020-2732 CVE-2020-9383 Package : linux Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1108 Summary ======= The package linux before version 5.5.7.arch1-1 is vulnerable to multiple issues including authentication bypass and information disclosure. Resolution ========== Upgrade to 5.5.7.arch1-1. # pacman -Syu "linux>=5.5.7.arch1-1" The problems have been fixed upstream in version 5.5.7.arch1. Workaround ========== None. Description =========== - CVE-2020-2732 (information disclosure) An issue has been found in KVM before 5.5.7, where vmx_check_intercept ws is not yet fully implemented on Intel processors, causing e.g. the I/O or MSR interception bitmaps not to be checked. This in turn allowed the L2 guest to trick the L0 hypervisor into accessing sensitive information on the L1 hypervisor. - CVE-2020-9383 (authentication bypass) An issue was discovered in the Linux kernel through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it, aka CID-2e90ca68b0d2. Impact ====== A local malicious attacker can disclose sensitive information through side-channel cache attacks, or bypass authentication measures by abusing the floppy drivers. References ========== https://www.openwall.com/lists/oss-security/2020/02/25/3 https://www.spinics.net/lists/kvm/msg208259.html https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://github.com/torvalds/linux/commit/2e90ca68b0d2f5548804f22f0dd6114551… https://security.archlinux.org/CVE-2020-2732 https://security.archlinux.org/CVE-2020-9383

1 0

[ASA-202003-5] python-django: sql injection
by Morten Linderud 12 Mar '20

12 Mar '20

Arch Linux Security Advisory ASA-202003-5 ========================================= Severity: Medium Date : 2020-03-08 CVE-ID : CVE-2020-9402 Package : python-django Type : sql injection Remote : Yes Link : https://security.archlinux.org/AVG-1111 Summary ======= The package python-django before version 3.0.4-1 is vulnerable to sql injection. Resolution ========== Upgrade to 3.0.4-1. # pacman -Syu "python-django>=3.0.4-1" The problem has been fixed upstream in version 3.0.4. Workaround ========== None. Description =========== A potential SQL injection has been found in Django before 3.0.4, via tolerance parameter in GIS functions and aggregates on Oracle. Impact ====== A remote attacker can alter the database via a SQL injection. References ========== https://docs.djangoproject.com/en/dev/releases/3.0.4/ https://www.openwall.com/lists/oss-security/2020/03/04/1 https://www.djangoproject.com/weblog/2020/mar/04/security-releases/ https://github.com/django/django/commit/26a5cf834526e291db00385dd33d319b827… https://security.archlinux.org/CVE-2020-9402

1 0

[ASA-202003-4] golang-golang-x-crypto: denial of service
by Morten Linderud 12 Mar '20

12 Mar '20

Arch Linux Security Advisory ASA-202003-4 ========================================= Severity: Medium Date : 2020-03-08 CVE-ID : CVE-2020-9283 Package : golang-golang-x-crypto Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1109 Summary ======= The package golang-golang-x-crypto before version 0.0.20200303-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.0.20200303-1. # pacman -Syu "golang-golang-x-crypto>=0.0.20200303-1" The problem has been fixed upstream in version 0.0.20200303. Workaround ========== None. Description =========== A security issue has been found in golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975. An attacker can craft an ssh- ed25519 or sk-ssh-ed25519(a)openssh.com public key, such that the library will panic when trying to verify a signature with it. Clients can deliver such a public key and signature to any golang.org/x/crypto/ssh server with a PublicKeyCallback, and servers can deliver them to any golang.org/x/crypto/ssh client. Impact ====== A remote unauthenticated attacker can serve a malicious SSH public key and crash the service. References ========== https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY https://github.com/golang/crypto/commit/bac4c82f69751a6dd76e702d54b3ceb88ad… https://packetstormsecurity.com/files/156480/Go-SSH-0.0.2-Denial-Of-Service… https://security.archlinux.org/CVE-2020-9283

1 0

[ASA-202003-3] ppp: arbitrary code execution
by Morten Linderud 12 Mar '20

12 Mar '20

Arch Linux Security Advisory ASA-202003-3 ========================================= Severity: Medium Date : 2020-03-07 CVE-ID : CVE-2020-8597 Package : ppp Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1101 Summary ======= The package ppp before version 2.4.7-7 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.4.7-7. # pacman -Syu "ppp>=2.4.7-7" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A buffer overflow flaw was found in the ppp package in versions 2.4.2 through 2.4.8. The bounds check for the rhostname was improperly constructed in the EAP request and response functions which could allow a buffer overflow to occur. Data confidentiality and integrity, as well as system availability, are all at risk with this vulnerability. Impact ====== A remote unauthenticated user can crash or possibly execute code on the host by sending malicious authentication data. References ========== https://lists.debian.org/debian-lts-announce/2020/02/msg00005.html https://github.com/paulusmack/ppp/commit/8d7970b8f3db727fe798b65f3377fe6787… https://seclists.org/fulldisclosure/2020/Mar/6 https://security.archlinux.org/CVE-2020-8597

1 0

[ASA-202003-2] opensc: denial of service
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202003-2 ========================================= Severity: Medium Date : 2020-03-04 CVE-ID : CVE-2019-6502 CVE-2019-15945 CVE-2019-15946 CVE-2019-19479 CVE-2019-19480 CVE-2019-19481 Package : opensc Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1106 Summary ======= The package opensc before version 0.20.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.20.0-1. # pacman -Syu "opensc>=0.20.0-1" The problems have been fixed upstream in version 0.20.0. Workaround ========== None. Description =========== - CVE-2019-6502 (denial of service) sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory leak, as demonstrated by a call from eidenv. - CVE-2019-15945 (denial of service) OpenSC before 0.20.0 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c. - CVE-2019-15946 (denial of service) OpenSC before 0.20.0 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c. - CVE-2019-19479 (denial of service) An issue was discovered in OpenSC before 0.20.0. libopensc/card- setcos.c has an incorrect read operation during parsing of a SETCOS file attribute. - CVE-2019-19480 (denial of service) An issue was discovered in OpenSC before 0.20.0. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry. - CVE-2019-19481 (denial of service) An issue was discovered in OpenSC before 0.20.0. libopensc/card-cac1.c mishandles buffer limits for CAC certificates, leading to an out-of- bounds read. Impact ====== A local attacker is able to crash the application with a malformed certificate. References ========== https://bugs.archlinux.org/task/65082 https://github.com/OpenSC/OpenSC/issues/1586 https://github.com/OpenSC/OpenSC/commit/0d7967549751b7032f22b437106b41444af… https://github.com/OpenSC/OpenSC/commit/412a6142c27a5973c61ba540e33cdc22d56… https://github.com/OpenSC/OpenSC/compare/f1691fc...12218d4 https://github.com/OpenSC/OpenSC/commit/a3fc7693f3a035a8a7921cffb98432944bb… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18693 https://github.com/OpenSC/OpenSC/commit/c3f23b836e5a1766c36617fe1da30d22f7b… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18478 https://github.com/OpenSC/OpenSC/commit/6ce6152284c47ba9b1d4fe8ff9d2e6a3f5e… https://github.com/OpenSC/OpenSC/commit/b75c002cfb1fd61cd20ec938ff4937d7b1a… https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18618 https://security.archlinux.org/CVE-2019-6502 https://security.archlinux.org/CVE-2019-15945 https://security.archlinux.org/CVE-2019-15946 https://security.archlinux.org/CVE-2019-19479 https://security.archlinux.org/CVE-2019-19480 https://security.archlinux.org/CVE-2019-19481

1 0

[ASA-202003-1] chromium: access restriction bypass
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202003-1 ========================================= Severity: High Date : 2020-03-04 CVE-ID : CVE-2020-6420 Package : chromium Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-1107 Summary ======= The package chromium before version 80.0.3987.132-1 is vulnerable to access restriction bypass. Resolution ========== Upgrade to 80.0.3987.132-1. # pacman -Syu "chromium>=80.0.3987.132-1" The problem has been fixed upstream in version 80.0.3987.132. Workaround ========== None. Description =========== An insufficient policy enforcement issue has been found in the media component of chromium before 80.0.3987.132. Impact ====== A remote attacker can bypass security restrictions. References ========== https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-des… https://crbug.com/1050996 https://security.archlinux.org/CVE-2020-6420

1 0

[ASA-202002-13] opensmtpd: arbitrary command execution
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202002-13 ========================================== Severity: Critical Date : 2020-02-29 CVE-ID : CVE-2020-8794 Package : opensmtpd Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1105 Summary ======= The package opensmtpd before version 6.6.4p1-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 6.6.4p1-1. # pacman -Syu "opensmtpd>=6.6.4p1-1" The problem has been fixed upstream in version 6.6.4p1. Workaround ========== None. Description =========== An out-of-bounds read vulnerability has been found in the client-side code of OpenSMTPD <= 6.6.3p1, leading to arbitrary command execution via a crafted SMTP transaction. Impact ====== A remote attacker is able to execute arbitrary commands as root on the affected host. References ========== https://www.qualys.com/2020/02/24/cve-2020-8794/lpe-rce-opensmtpd-default-i… https://security.archlinux.org/CVE-2020-8794

1 0

[ASA-202002-12] weechat: multiple issues
by Remi Gacogne 05 Mar '20

05 Mar '20

Arch Linux Security Advisory ASA-202002-12 ========================================== Severity: Critical Date : 2020-02-25 CVE-ID : CVE-2020-8955 CVE-2020-9759 CVE-2020-9760 Package : weechat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1103 Summary ======= The package weechat before version 2.7.1-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 2.7.1-1. # pacman -Syu "weechat>=2.7.1-1" The problems have been fixed upstream in version 2.7.1. Workaround ========== None. Description =========== - CVE-2020-8955 (arbitrary code execution) A heap-based out-of-bounds write has been found in the IRC plugin of Weechat before 2.7.1, in irc-mode.c, when receiving a malformed IRC message 324 (channel mode). - CVE-2020-9759 (denial of service) A heap-based out-of-bounds read has been found in Weechat before 2.7.1, when receiving a malformed IRC message 352 (WHO). It could lead to a off-by-one read resulting in denial of service (crash). - CVE-2020-9760 (arbitrary code execution) A heap-based out-of-bounds write has been found in Weechat before 2.7.1, when a new IRC message 005 is received with longer nick prefixes. It could lead to writing out of the allocated prefixes array when setting a prefix, resulting in denial of service (crash) or even arbitrary code execution. Impact ====== A remote attacker can crash the client and execute code remotely via a malformed message. References ========== https://weechat.org/news/113/20200220-Version-2.7.1-security-release/ https://github.com/weechat/weechat/commit/51a739df615f8ec66fbe1e9682ec3c321… https://github.com/weechat/weechat/commit/c827d6fa864e2c0b79cea640c45272e83… https://github.com/weechat/weechat/commit/694b5c9f874d7337cd2e03761e0de4352… https://security.archlinux.org/CVE-2020-8955 https://security.archlinux.org/CVE-2020-9759 https://security.archlinux.org/CVE-2020-9760

1 0

[ASA-202002-11] chromium: multiple issues
by Morten Linderud 29 Feb '20

29 Feb '20

Arch Linux Security Advisory ASA-202002-11 ========================================== Severity: High Date : 2020-02-25 CVE-ID : CVE-2020-6407 CVE-2020-6418 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1102 Summary ======= The package chromium before version 80.0.3987.122-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 80.0.3987.122-1. # pacman -Syu "chromium>=80.0.3987.122-1" The problems have been fixed upstream in version 80.0.3987.122. Workaround ========== None. Description =========== - CVE-2020-6407 (information disclosure) An out-of-bounds memory access vulnerability has been found in the streams component of chromium before 80.0.3987.122. - CVE-2020-6418 (arbitrary code execution) A type confusion vulnerability has been found in the V8 component of chromium before 80.0.3987.122. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-des… https://crbug.com/1045931 https://crbug.com/1053604 https://security.archlinux.org/CVE-2020-6407 https://security.archlinux.org/CVE-2020-6418

1 0

[ASA-202002-10] webkit2gtk: multiple issues
by Morten Linderud 29 Feb '20

29 Feb '20

Arch Linux Security Advisory ASA-202002-10 ========================================== Severity: High Date : 2020-02-17 CVE-ID : CVE-2020-3862 CVE-2020-3864 CVE-2020-3865 CVE-2020-3867 CVE-2020-3868 Package : webkit2gtk Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1100 Summary ======= The package webkit2gtk before version 2.26.4-1 is vulnerable to multiple issues including arbitrary code execution, cross-site scripting, sandbox escape, denial of service and same-origin policy bypass. Resolution ========== Upgrade to 2.26.4-1. # pacman -Syu "webkit2gtk>=2.26.4-1" The problems have been fixed upstream in version 2.26.4. Workaround ========== None. Description =========== - CVE-2020-3862 (denial of service) A malicious website may be able to cause a denial of service. - CVE-2020-3864 (same-origin policy bypass) A DOM object context may not have had a unique security origin. - CVE-2020-3865 (sandbox escape) A top-level DOM object context may have incorrectly been considered secure. - CVE-2020-3867 (cross-site scripting) Processing maliciously crafted web content may lead to universal cross site scripting. - CVE-2020-3868 (arbitrary code execution) Processing maliciously crafted web content may lead to arbitrary code execution. Credit to Marcin Towalski of Cisco Talos. Impact ====== A remote attacker can bypass security restrictions via universal cross- site scripting or execute arbitrary code via crafted web content. References ========== https://webkitgtk.org/security/WSA-2020-0002.html https://security.archlinux.org/CVE-2020-3862 https://security.archlinux.org/CVE-2020-3864 https://security.archlinux.org/CVE-2020-3865 https://security.archlinux.org/CVE-2020-3867 https://security.archlinux.org/CVE-2020-3868

1 0