- Arch-security - lists.archlinux.org

[ASA-201904-5] ghostscript: sandbox escape
by Remi Gacogne 24 Apr '19

24 Apr '19

Arch Linux Security Advisory ASA-201904-5 ========================================= Severity: High Date : 2019-04-11 CVE-ID : CVE-2019-3835 CVE-2019-3838 Package : ghostscript Type : sandbox escape Remote : Yes Link : https://security.archlinux.org/AVG-929 Summary ======= The package ghostscript before version 9.27-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 9.27-1. # pacman -Syu "ghostscript>=9.27-1" The problems have been fixed upstream in version 9.27. Workaround ========== None. Description =========== - CVE-2019-3835 (sandbox escape) It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. - CVE-2019-3838 (sandbox escape) It was found that the forceput operator could be extracted from the DefineResource method using methods similar to the ones described in CVE-2019-6116. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Impact ====== A remote attacker is able to escape the sandbox via a specially crafted PostScript document. References ========== https://bugs.archlinux.org/task/62102 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d683d1e6 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd95bb01 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e8f95a https://security.archlinux.org/CVE-2019-3835 https://security.archlinux.org/CVE-2019-3838

1 0

[ASA-201904-4] thunderbird: arbitrary code execution
by Remi Gacogne 11 Apr '19

11 Apr '19

Arch Linux Security Advisory ASA-201904-4 ========================================= Severity: Critical Date : 2019-04-06 CVE-ID : CVE-2019-9810 CVE-2019-9813 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-947 Summary ======= The package thunderbird before version 60.6.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 60.6.1-1. # pacman -Syu "thunderbird>=60.6.1-1" The problems have been fixed upstream in version 60.6.1. Workaround ========== None. Description =========== - CVE-2019-9810 (arbitrary code execution) An incorrect alias information in the IonMonkey JIT compiler of Firefox before 66.0.1 and Thunderbird before 60.6.1 for the Array.prototype.slice method may lead to missing bounds check and a buffer overflow. - CVE-2019-9813 (arbitrary code execution) An incorrect handling of __proto__ mutations may lead to type confusion in the IonMonkey JIT code of Firefox before 66.0.1 and Thunderbird before 60.6.1, and can be leveraged for arbitrary memory read and write. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9810 https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9810 https://bugzilla.mozilla.org/show_bug.cgi?id=1537924 https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9813 https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9813 https://bugzilla.mozilla.org/show_bug.cgi?id=1538006 https://security.archlinux.org/CVE-2019-9810 https://security.archlinux.org/CVE-2019-9813

1 0

[ASA-201904-3] apache: multiple issues
by Remi Gacogne 11 Apr '19

11 Apr '19

Arch Linux Security Advisory ASA-201904-3 ========================================= Severity: Critical Date : 2019-04-05 CVE-ID : CVE-2019-0196 CVE-2019-0197 CVE-2019-0211 CVE-2019-0215 CVE-2019-0217 CVE-2019-0220 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-946 Summary ======= The package apache before version 2.4.39-1 is vulnerable to multiple issues including privilege escalation, access restriction bypass and denial of service. Resolution ========== Upgrade to 2.4.39-1. # pacman -Syu "apache>=2.4.39-1" The problems have been fixed upstream in version 2.4.39. Workaround ========== None. Description =========== - CVE-2019-0196 (denial of service) A use-after-free issue has been found in the http/2 request handling code of Apache HTTPd <= 2.4.18 and <= 2.4.38. Using crafted network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly. - CVE-2019-0197 (denial of service) An issue has been found in Apache HTTPd >= 2.4.34 and <= 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. A server that never enabled the h2 protocol or that only enabled it for https: and did not configure the "H2Upgrade on" is unaffected by this. - CVE-2019-0211 (privilege escalation) In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. - CVE-2019-0215 (access restriction bypass) In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions. - CVE-2019-0217 (access restriction bypass) In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. - CVE-2019-0220 (access restriction bypass) A security issue has been found in Apache HTTPd 2.4.x before 2.4.39. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them. Impact ====== A remote attacker can bypass access control restrictions, or crash a server via a crafted HTTP/2 query. A local attacker can elevate privileges to root by manipulating the scoreboard. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://security.archlinux.org/CVE-2019-0196 https://security.archlinux.org/CVE-2019-0197 https://security.archlinux.org/CVE-2019-0211 https://security.archlinux.org/CVE-2019-0215 https://security.archlinux.org/CVE-2019-0217 https://security.archlinux.org/CVE-2019-0220

1 0

[ASA-201904-2] gnutls: multiple issues
by Remi Gacogne 11 Apr '19

11 Apr '19

Arch Linux Security Advisory ASA-201904-2 ========================================= Severity: Critical Date : 2019-04-05 CVE-ID : CVE-2019-3829 CVE-2019-3836 Package : gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-945 Summary ======= The package gnutls before version 3.6.7-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 3.6.7-1. # pacman -Syu "gnutls>=3.6.7-1" The problems have been fixed upstream in version 3.6.7. Workaround ========== None. Description =========== - CVE-2019-3829 (arbitrary code execution) A critical memory corruption vulnerability has been found in GnuTLS versions prior to 3.6.7, in any API backed by verify_crt(), including gnutls_x509_trust_list_verify_crt() and related routines. Any client or server that verifies X.509 certificates with GnuTLS is likely affected and can be compromised by a malicious server or active network attacker. - CVE-2019-3836 (denial of service) An invalid pointer access via malformed TLS1.3 async messages has been found in GnuTLS versions prior to 3.6.7. Impact ====== A remote attacker can execute arbitrary code on a client or server validating certificates. References ========== https://lists.gnupg.org/pipermail/gnutls-help/2019-March/004497.html https://gitlab.com/gnutls/gnutls/issues/694 https://gitlab.com/gnutls/gnutls/issues/704 https://security.archlinux.org/CVE-2019-3829 https://security.archlinux.org/CVE-2019-3836

1 0

[ASA-201904-1] evolution: content spoofing
by Remi Gacogne 11 Apr '19

11 Apr '19

Arch Linux Security Advisory ASA-201904-1 ========================================= Severity: High Date : 2019-04-02 CVE-ID : CVE-2018-15587 Package : evolution Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-889 Summary ======= The package evolution before version 3.32.0-1 is vulnerable to content spoofing. Resolution ========== Upgrade to 3.32.0-1. # pacman -Syu "evolution>=3.32.0-1" The problem has been fixed upstream in version 3.32.0. Workaround ========== None. Description =========== GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment. Impact ====== A remote attacker can spoof a valid signature for a specially crafted e-mail. References ========== https://bugzilla.gnome.org/show_bug.cgi?id=796424 https://gitlab.gnome.org/GNOME/evolution/issues/120 https://security.archlinux.org/CVE-2018-15587

1 0

[ASA-201903-16] dovecot: privilege escalation
by Remi Gacogne 28 Mar '19

28 Mar '19

Arch Linux Security Advisory ASA-201903-16 ========================================== Severity: High Date : 2019-03-28 CVE-ID : CVE-2019-7524 Package : dovecot Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-944 Summary ======= The package dovecot before version 2.3.5.1-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.3.5.1-1. # pacman -Syu "dovecot>=2.3.5.1-1" The problem has been fixed upstream in version 2.3.5.1. Workaround ========== None. Description =========== A stack-based buffer overflow has been found in Dovecot versions prior to 2.3.5.1. When reading FTS or POP3-UIDL header from dovecot index, the input buffer size is not bound, and data is copied to target structure causing stack overflow. This can be used for local root privilege escalation or executing arbitrary code in dovecot process context. This requires ability to directly modify dovecot indexes. Impact ====== A local attacker with the ability to alter FTS or POP3-UIDL files can escalate privileges to root. References ========== https://seclists.org/oss-sec/2019/q1/197 https://dovecot.org/pipermail/dovecot/2019-March/115296.html https://github.com/dovecot/core/commit/79679674eb6d2c7d38f2537e613efc103058… https://github.com/dovecot/core/commit/d79845350e0754f5e25c41bd56591ddd5b0a… https://security.archlinux.org/CVE-2019-7524

1 0

[ASA-201903-15] imagemagick: arbitrary code execution
by Remi Gacogne 28 Mar '19

28 Mar '19

Arch Linux Security Advisory ASA-201903-15 ========================================== Severity: Critical Date : 2019-03-28 CVE-ID : CVE-2019-9956 Package : imagemagick Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-931 Summary ======= The package imagemagick before version 7.0.8.35-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.0.8.35-1. # pacman -Syu "imagemagick>=7.0.8.35-1" The problem has been fixed upstream in version 7.0.8.35. Workaround ========== None. Description =========== A stack-based buffer overflow has been found in ImageMagick before 7.0.8-35, in the WritePSImage() function. Impact ====== An attacker can execute arbitrary code via a crafted file. References ========== https://github.com/ImageMagick/ImageMagick/issues/1523 https://github.com/ImageMagick/ImageMagick/commit/34a6a5a45e83a4af852090b4e… https://security.archlinux.org/CVE-2019-9956

1 0

[ASA-201903-14] firefox: arbitrary code execution
by Remi Gacogne 24 Mar '19

24 Mar '19

Arch Linux Security Advisory ASA-201903-14 ========================================== Severity: Critical Date : 2019-03-23 CVE-ID : CVE-2019-9810 CVE-2019-9813 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-930 Summary ======= The package firefox before version 66.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 66.0.1-1. # pacman -Syu "firefox>=66.0.1-1" The problems have been fixed upstream in version 66.0.1. Workaround ========== None. Description =========== - CVE-2019-9810 (arbitrary code execution) An incorrect alias information in the IonMonkey JIT compiler of Firefox before 66.0.1 for the Array.prototype.slice method may lead to missing bounds check and a buffer overflow. - CVE-2019-9813 (arbitrary code execution) An incorrect handling of __proto__ mutations may lead to type confusion in the IonMonkey JIT code of Firefox before 66.0.1 and can be leveraged for arbitrary memory read and write. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9810 https://bugzilla.mozilla.org/show_bug.cgi?id=1537924 https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9813 https://bugzilla.mozilla.org/show_bug.cgi?id=1538006 https://security.archlinux.org/CVE-2019-9810 https://security.archlinux.org/CVE-2019-9813

1 0

[ASA-201903-13] powerdns: insufficient validation
by Remi Gacogne 22 Mar '19

22 Mar '19

Arch Linux Security Advisory ASA-201903-13 ========================================== Severity: High Date : 2019-03-22 CVE-ID : CVE-2019-3871 Package : powerdns Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-927 Summary ======= The package powerdns before version 4.1.7-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 4.1.7-1. # pacman -Syu "powerdns>=4.1.7-1" The problem has been fixed upstream in version 4.1.7. Workaround ========== None. Description =========== An issue has been found in PowerDNS Authoritative Server before 4.1.7, when the HTTP remote backend is used in RESTful mode (without post=1 set), allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one, via a crafted DNS query. This can be used to cause a denial of service by preventing the remote backend from getting a response, content spoofing if the attacker can time its own query so that subsequent queries will use an attacker-controlled HTTP server instead of the configured one, and possibly information disclosure if the Authoritative Server has access to internal servers. Impact ====== A remote user can cause a denial of service by preventing the remote backend from getting a response, content spoofing if the attacker can time its own query so that subsequent queries will use an attacker- controlled HTTP server instead of the configured one, and possibly information disclosure if the Authoritative Server has access to internal servers. References ========== https://seclists.org/oss-sec/2019/q1/185 https://docs.powerdns.com/authoritative/security-advisories/powerdns-adviso… https://github.com/PowerDNS/pdns/issues/7573 https://github.com/PowerDNS/pdns/pull/7577 https://security.archlinux.org/CVE-2019-3871

1 0

[ASA-201903-12] libssh2: multiple issues
by Remi Gacogne 22 Mar '19

22 Mar '19

Arch Linux Security Advisory ASA-201903-12 ========================================== Severity: Critical Date : 2019-03-22 CVE-ID : CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 Package : libssh2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-926 Summary ======= The package libssh2 before version 1.8.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 1.8.1-1. # pacman -Syu "libssh2>=1.8.1-1" The problems have been fixed upstream in version 1.8.1. Workaround ========== None. Description =========== - CVE-2019-3855 (arbitrary code execution) A out-of-bounds write has been found in libssh2 before 1.8.1, where a malicious server could send a specially crafted packet which could result in an unchecked integer overflow. The value would then be used to allocate memory causing a possible memory write out of bounds error. - CVE-2019-3856 (arbitrary code execution) An issue has been found in libssh2 before 1.8.1 where a server could send a value approaching unsigned int max number of keyboard prompt requests which could result in an unchecked integer overflow. The value would then be used to allocate memory causing a possible memory write out of bounds error. - CVE-2019-3857 (arbitrary code execution) An issue has been found in libssh2 before 1.8.1 where a server could send a SSH_MSG_CHANNEL_REQUEST packet with an exit signal message with a length of max unsigned integer value. The length would then have a value of 1 added to it and used to allocate memory causing a possible memory write out of bounds error or zero byte allocation. - CVE-2019-3858 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted partial SFTP packet with a zero value for the payload length. This zero value would be used to then allocate memory resulting in a zero byte allocation and possible out of bounds read. - CVE-2019-3859 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted partial packet in response to various commands such as: sha1 and sha226 key exchange, user auth list, user auth password response, public key auth response, channel startup/open/forward/ setenv/request pty/x11 and session start up. The result would be a memory out of bounds read. - CVE-2019-3860 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted partial SFTP packet with a empty payload in response to various SFTP commands such as read directory, file status, status vfs and symlink. The result would be a memory out of bounds read. - CVE-2019-3861 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted SSH packet with a padding length value greater than the packet length. This would result in a buffer read out of bounds when decompressing the packet or result in a corrupted packet value. - CVE-2019-3862 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted SSH_MSG_CHANNEL_REQUEST packet with an exit status message and no payload. This would result in an out of bounds memory comparison. - CVE-2019-3863 (arbitrary code execution) An issue has been found in libssh2 before 1.8.1 where a server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error. Impact ====== A malicious server could access sensitive information or execute arbitrary code on a vulnerable client. References ========== https://www.libssh2.org/mail/libssh2-devel-archive-2019-03/0009.shtml https://www.libssh2.org/CVE-2019-3855.html https://libssh2.org/1.8.0-CVE/CVE-2019-3855.patch https://www.libssh2.org/CVE-2019-3856.html https://libssh2.org/1.8.0-CVE/CVE-2019-3856.patch https://www.libssh2.org/CVE-2019-3857.html https://libssh2.org/1.8.0-CVE/CVE-2019-3857.patch https://www.libssh2.org/CVE-2019-3858.html https://libssh2.org/1.8.0-CVE/CVE-2019-3858.patch https://www.libssh2.org/CVE-2019-3859.html https://libssh2.org/1.8.0-CVE/CVE-2019-3859.patch https://www.libssh2.org/CVE-2019-3860.html https://libssh2.org/1.8.0-CVE/CVE-2019-3860.patch https://www.libssh2.org/CVE-2019-3861.html https://libssh2.org/1.8.0-CVE/CVE-2019-3861.patch https://www.libssh2.org/CVE-2019-3862.html https://libssh2.org/1.8.0-CVE/CVE-2019-3862.patch https://www.libssh2.org/CVE-2019-3863.html https://libssh2.org/1.8.0-CVE/CVE-2019-3863.patch https://security.archlinux.org/CVE-2019-3855 https://security.archlinux.org/CVE-2019-3856 https://security.archlinux.org/CVE-2019-3857 https://security.archlinux.org/CVE-2019-3858 https://security.archlinux.org/CVE-2019-3859 https://security.archlinux.org/CVE-2019-3860 https://security.archlinux.org/CVE-2019-3861 https://security.archlinux.org/CVE-2019-3862 https://security.archlinux.org/CVE-2019-3863

1 0