- Arch-security - lists.archlinux.org

[ASA-201912-2] thunderbird: arbitrary code execution
by Remi Gacogne 11 Dec '19

11 Dec '19

Arch Linux Security Advisory ASA-201912-2 ========================================= Severity: Critical Date : 2019-12-06 CVE-ID : CVE-2019-11745 CVE-2019-17005 CVE-2019-17008 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1072 Summary ======= The package thunderbird before version 68.3.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 68.3.0-1. # pacman -Syu "thunderbird>=68.3.0-1" The problems have been fixed upstream in version 68.3.0. Workaround ========== None. Description =========== - CVE-2019-11745 (arbitrary code execution) An out-of-bounds write vulnerability has been found in the NSS component of Firefox before 71.0 and Thunderbird before 68.3. When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. - CVE-2019-17005 (arbitrary code execution) An out-of-bounds write vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3 where the plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. - CVE-2019-17008 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3. When using nested workers, a use-after- free could occur during worker destruction. This resulted in a potentially exploitable crash. - CVE-2019-17010 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3. Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. - CVE-2019-17011 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3. Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. - CVE-2019-17012 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 71.0 and Thunderbird before 68.3. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667… https://security.archlinux.org/CVE-2019-11745 https://security.archlinux.org/CVE-2019-17005 https://security.archlinux.org/CVE-2019-17008 https://security.archlinux.org/CVE-2019-17010 https://security.archlinux.org/CVE-2019-17011 https://security.archlinux.org/CVE-2019-17012

1 0

[ASA-201912-1] firefox: multiple issues
by Remi Gacogne 05 Dec '19

05 Dec '19

Arch Linux Security Advisory ASA-201912-1 ========================================= Severity: Critical Date : 2019-12-03 CVE-ID : CVE-2019-11745 CVE-2019-11756 CVE-2019-17005 CVE-2019-17008 CVE-2019-17009 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012 CVE-2019-17013 CVE-2019-17014 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1071 Summary ======= The package firefox before version 71.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, information disclosure and privilege escalation. Resolution ========== Upgrade to 71.0-1. # pacman -Syu "firefox>=71.0-1" The problems have been fixed upstream in version 71.0. Workaround ========== None. Description =========== - CVE-2019-11745 (arbitrary code execution) An out-of-bounds write vulnerability has been found in the NSS component of Firefox before 71.0. When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. - CVE-2019-11756 (denial of service) A use-after-free vulnerability has been found in Firefox before 71.0 where improper reference counting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). - CVE-2019-17005 (arbitrary code execution) An out-of-bounds write vulnerability has been found in Firefox before 71.0 where the plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. - CVE-2019-17008 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0. When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. - CVE-2019-17009 (privilege escalation) A privilege escalation vulnerability has been found in Firefox before 71.0. When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. - CVE-2019-17010 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0. Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. - CVE-2019-17011 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0. Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. - CVE-2019-17012 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 71.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17013 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 71.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17014 (information disclosure) An information disclosure issue has been found in Firefox before 71.0 where, if an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. Impact ====== A remote attacker can crash Firefox, access sensitive information, escalate privileges and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1508776 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1510494 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667… https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439… https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1322864 https://security.archlinux.org/CVE-2019-11745 https://security.archlinux.org/CVE-2019-11756 https://security.archlinux.org/CVE-2019-17005 https://security.archlinux.org/CVE-2019-17008 https://security.archlinux.org/CVE-2019-17009 https://security.archlinux.org/CVE-2019-17010 https://security.archlinux.org/CVE-2019-17011 https://security.archlinux.org/CVE-2019-17012 https://security.archlinux.org/CVE-2019-17013 https://security.archlinux.org/CVE-2019-17014

1 0

[ASA-201911-14] intel-ucode: multiple issues
by Remi Gacogne 03 Dec '19

03 Dec '19

Arch Linux Security Advisory ASA-201911-14 ========================================== Severity: High Date : 2019-11-13 CVE-ID : CVE-2019-0117 CVE-2019-11135 CVE-2019-11139 Package : intel-ucode Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1068 Summary ======= The package intel-ucode before version 20191112-1 is vulnerable to multiple issues including information disclosure, private key recovery and denial of service. Resolution ========== Upgrade to 20191112-1. # pacman -Syu "intel-ucode>=20191112-1" The problems have been fixed upstream in version 20191112. Workaround ========== None. Description =========== - CVE-2019-0117 (information disclosure) A flaw was found in the implementation of SGX around the access control of protected memory. A local attacker of a system with SGX enabled and an affected intel GPU with the ability to execute code is able to infer the contents of the SGX protected memory. - CVE-2019-11135 (private key recovery) A flaw was found in the way Intel CPUs handle speculative execution of instructions when the TSX Asynchronous Abort (TAA) error occurs. A local authenticated attacker with the ability to monitor execution times could infer the TSX memory state by comparing abort execution times. This could allow information disclosure via this observed side- channel for any TSX transaction being executed while an attacker is able to observe abort timing. Intel's Transactional Synchronisation Extensions (TSX) are set of instructions which enable transactional memory support to improve performance of the multi-threaded applications, in the lock-protected critical sections. The CPU executes instructions in the critical-sections as transactions, while ensuring their atomic state. When such transaction execution is unsuccessful, the processor cannot ensure atomic updates to the transaction memory, so the processor rolls back or aborts such transaction execution. While TSX Asynchronous Abort (TAA) is pending, CPU may continue to read data from architectural buffers and pass it to the dependent speculative operations. This may cause information leakage via speculative side- channel means, which is quite similar to the Microarchitectural Data Sampling (MDS) issue. This mitigation is only effective using one the follow linux kernels: v3.16.77, v4.4.202, v4.9.202, v4.14.154, v4.19.84 or v5.3.11. - CVE-2019-11139 (denial of service) It was discovered that certain Intel Xeon processors did not properly restrict access to a voltage modulation interface. A local privileged attacker could use this to cause a denial of service (system crash). Impact ====== A local unprivileged attacker with access to an affected GPU can read protected memory on an SGX enclave. Further, an attacker can infer the contents of TPM keys using side-channel attacks. Finally, an attacker can crash the system by accessing the voltage modulator interface on certain Xeon processors. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://software.intel.com/security-software-guidance/insights/deep-dive-in… https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://security.archlinux.org/CVE-2019-0117 https://security.archlinux.org/CVE-2019-11135 https://security.archlinux.org/CVE-2019-11139

1 0

[ASA-201911-13] libtiff: denial of service
by Remi Gacogne 03 Dec '19

03 Dec '19

Arch Linux Security Advisory ASA-201911-13 ========================================== Severity: Medium Date : 2019-11-13 CVE-ID : CVE-2019-6128 CVE-2019-7663 Package : libtiff Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-886 Summary ======= The package libtiff before version 4.1.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.1.0-1. # pacman -Syu "libtiff>=4.1.0-1" The problems have been fixed upstream in version 4.1.0. Workaround ========== None. Description =========== - CVE-2019-6128 (denial of service) The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb. - CVE-2019-7663 (denial of service) An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. Impact ====== A remote attacker is able to cause a denial of service. References ========== https://gitlab.com/libtiff/libtiff/commit/ae0bed1fe530a82faf2e9ea1775109dbf… https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17… https://gitlab.com/libtiff/libtiff/merge_requests/60 https://security.archlinux.org/CVE-2019-6128 https://security.archlinux.org/CVE-2019-7663

1 0

[ASA-201911-12] linux-zen: arbitrary code execution
by Levente Polyak 14 Nov '19

14 Nov '19

Arch Linux Security Advisory ASA-201911-12 ========================================== Severity: Critical Date : 2019-11-13 CVE-ID : CVE-2019-17666 Package : linux-zen Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1066 Summary ======= The package linux-zen before version 5.3.9.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.9.1-1. # pacman -Syu "linux-zen>=5.3.9.1-1" The problem has been fixed upstream in version 5.3.9.1. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-11] linux-lts: arbitrary code execution
by Levente Polyak 14 Nov '19

14 Nov '19

Arch Linux Security Advisory ASA-201911-11 ========================================== Severity: Critical Date : 2019-11-13 CVE-ID : CVE-2019-17666 Package : linux-lts Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1065 Summary ======= The package linux-lts before version 4.19.82-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.19.82-1. # pacman -Syu "linux-lts>=4.19.82-1" The problem has been fixed upstream in version 4.19.82. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-10] linux: arbitrary code execution
by Levente Polyak 14 Nov '19

14 Nov '19

Arch Linux Security Advisory ASA-201911-10 ========================================== Severity: Critical Date : 2019-11-13 CVE-ID : CVE-2019-17666 Package : linux Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1064 Summary ======= The package linux before version 5.3.9.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.9.1-1. # pacman -Syu "linux>=5.3.9.1-1" The problem has been fixed upstream in version 5.3.9.1. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-9] linux-hardened: arbitrary code execution
by Levente Polyak 07 Nov '19

07 Nov '19

Arch Linux Security Advisory ASA-201911-9 ========================================= Severity: Critical Date : 2019-11-07 CVE-ID : CVE-2019-17666 Package : linux-hardened Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1063 Summary ======= The package linux-hardened before version 5.3.7.b-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.7.b-1. # pacman -Syu "linux-hardened>=5.3.7.b-1" The problem has been fixed upstream in version 5.3.7.b. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-8] squid: multiple issues
by Remi Gacogne 07 Nov '19

07 Nov '19

Arch Linux Security Advisory ASA-201911-8 ========================================= Severity: Critical Date : 2019-11-07 CVE-ID : CVE-2019-12526 CVE-2019-18678 CVE-2019-18679 Package : squid Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1062 Summary ======= The package squid before version 4.9-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 4.9-1. # pacman -Syu "squid>=4.9-1" The problems have been fixed upstream in version 4.9. Workaround ========== - CVE-2019-12526 Deny urn: protocol URI being proxied to all clients: acl URN proto URN http_access deny URN - CVE-2019-18678 There are no workarounds for this vulnerability. - CVE-2019-18679 Digest authentication can be disabled by removing all 'auth_param digest ...' configuration settings from squid.conf. Description =========== - CVE-2019-12526 (arbitrary code execution) A heap-based buffer overflow has been found in Squid before 4.9, when processing URN. - CVE-2019-18678 (content spoofing) A HTTP request splitting issue has been found in Squid before 4.9. This issue allows attackers to smuggle HTTP requests through frontend software to a Squid which splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between client and Squid with attacker controlled content at arbitrary URLs. - CVE-2019-18679 (information disclosure) An information disclosure issue has been found in Squid before 4.9, when processing HTTP Digest Authentication. The nonce tokens contain the raw byte value of a pointer which sits within heap memory allocation, which reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks. Impact ====== A remote attacker might access sensitive information, corrupt the content of arbitrary URLs in the caches or execute arbitrary code. References ========== http://www.squid-cache.org/Advisories/SQUID-2019_7.txt http://www.squid-cache.org/Advisories/SQUID-2019_10.txt http://www.squid-cache.org/Advisories/SQUID-2019_11.txt http://www.squid-cache.org/Versions/v4/changesets/squid-4-7aa0184a720fd2161… http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156d… http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156d… https://security.archlinux.org/CVE-2019-12526 https://security.archlinux.org/CVE-2019-18678 https://security.archlinux.org/CVE-2019-18679

1 0

[ASA-201911-7] electron: arbitrary code execution
by Remi Gacogne 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-7 ========================================= Severity: Critical Date : 2019-11-04 CVE-ID : CVE-2019-13720 Package : electron Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1061 Summary ======= The package electron before version 7.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.0.1-1. # pacman -Syu "electron>=7.0.1-1" The problem has been fixed upstream in version 7.0.1. Workaround ========== None. Description =========== A use-after-free vulnerability has been found in the audio component of the chromium browser before 78.0.3904.87. Google is aware of reports that an exploit for this vulnerability exists in the wild. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://github.com/electron/electron/commit/25b3ee29cf9a8e3f59dcbabf7345b5b… https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-des… https://crbug.com/1019226 https://security.archlinux.org/CVE-2019-13720

1 0