March 2019 - Arch-security - lists.archlinux.org

[ASA-201903-16] dovecot: privilege escalation
by Remi Gacogne 28 Mar '19

28 Mar '19

Arch Linux Security Advisory ASA-201903-16 ========================================== Severity: High Date : 2019-03-28 CVE-ID : CVE-2019-7524 Package : dovecot Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-944 Summary ======= The package dovecot before version 2.3.5.1-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 2.3.5.1-1. # pacman -Syu "dovecot>=2.3.5.1-1" The problem has been fixed upstream in version 2.3.5.1. Workaround ========== None. Description =========== A stack-based buffer overflow has been found in Dovecot versions prior to 2.3.5.1. When reading FTS or POP3-UIDL header from dovecot index, the input buffer size is not bound, and data is copied to target structure causing stack overflow. This can be used for local root privilege escalation or executing arbitrary code in dovecot process context. This requires ability to directly modify dovecot indexes. Impact ====== A local attacker with the ability to alter FTS or POP3-UIDL files can escalate privileges to root. References ========== https://seclists.org/oss-sec/2019/q1/197 https://dovecot.org/pipermail/dovecot/2019-March/115296.html https://github.com/dovecot/core/commit/79679674eb6d2c7d38f2537e613efc103058… https://github.com/dovecot/core/commit/d79845350e0754f5e25c41bd56591ddd5b0a… https://security.archlinux.org/CVE-2019-7524

1 0

[ASA-201903-15] imagemagick: arbitrary code execution
by Remi Gacogne 28 Mar '19

28 Mar '19

Arch Linux Security Advisory ASA-201903-15 ========================================== Severity: Critical Date : 2019-03-28 CVE-ID : CVE-2019-9956 Package : imagemagick Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-931 Summary ======= The package imagemagick before version 7.0.8.35-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.0.8.35-1. # pacman -Syu "imagemagick>=7.0.8.35-1" The problem has been fixed upstream in version 7.0.8.35. Workaround ========== None. Description =========== A stack-based buffer overflow has been found in ImageMagick before 7.0.8-35, in the WritePSImage() function. Impact ====== An attacker can execute arbitrary code via a crafted file. References ========== https://github.com/ImageMagick/ImageMagick/issues/1523 https://github.com/ImageMagick/ImageMagick/commit/34a6a5a45e83a4af852090b4e… https://security.archlinux.org/CVE-2019-9956

1 0

[ASA-201903-14] firefox: arbitrary code execution
by Remi Gacogne 24 Mar '19

24 Mar '19

Arch Linux Security Advisory ASA-201903-14 ========================================== Severity: Critical Date : 2019-03-23 CVE-ID : CVE-2019-9810 CVE-2019-9813 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-930 Summary ======= The package firefox before version 66.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 66.0.1-1. # pacman -Syu "firefox>=66.0.1-1" The problems have been fixed upstream in version 66.0.1. Workaround ========== None. Description =========== - CVE-2019-9810 (arbitrary code execution) An incorrect alias information in the IonMonkey JIT compiler of Firefox before 66.0.1 for the Array.prototype.slice method may lead to missing bounds check and a buffer overflow. - CVE-2019-9813 (arbitrary code execution) An incorrect handling of __proto__ mutations may lead to type confusion in the IonMonkey JIT code of Firefox before 66.0.1 and can be leveraged for arbitrary memory read and write. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9810 https://bugzilla.mozilla.org/show_bug.cgi?id=1537924 https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9813 https://bugzilla.mozilla.org/show_bug.cgi?id=1538006 https://security.archlinux.org/CVE-2019-9810 https://security.archlinux.org/CVE-2019-9813

1 0

[ASA-201903-13] powerdns: insufficient validation
by Remi Gacogne 22 Mar '19

22 Mar '19

Arch Linux Security Advisory ASA-201903-13 ========================================== Severity: High Date : 2019-03-22 CVE-ID : CVE-2019-3871 Package : powerdns Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-927 Summary ======= The package powerdns before version 4.1.7-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 4.1.7-1. # pacman -Syu "powerdns>=4.1.7-1" The problem has been fixed upstream in version 4.1.7. Workaround ========== None. Description =========== An issue has been found in PowerDNS Authoritative Server before 4.1.7, when the HTTP remote backend is used in RESTful mode (without post=1 set), allowing a remote user to cause the HTTP backend to connect to an attacker-specified host instead of the configured one, via a crafted DNS query. This can be used to cause a denial of service by preventing the remote backend from getting a response, content spoofing if the attacker can time its own query so that subsequent queries will use an attacker-controlled HTTP server instead of the configured one, and possibly information disclosure if the Authoritative Server has access to internal servers. Impact ====== A remote user can cause a denial of service by preventing the remote backend from getting a response, content spoofing if the attacker can time its own query so that subsequent queries will use an attacker- controlled HTTP server instead of the configured one, and possibly information disclosure if the Authoritative Server has access to internal servers. References ========== https://seclists.org/oss-sec/2019/q1/185 https://docs.powerdns.com/authoritative/security-advisories/powerdns-adviso… https://github.com/PowerDNS/pdns/issues/7573 https://github.com/PowerDNS/pdns/pull/7577 https://security.archlinux.org/CVE-2019-3871

1 0

[ASA-201903-12] libssh2: multiple issues
by Remi Gacogne 22 Mar '19

22 Mar '19

Arch Linux Security Advisory ASA-201903-12 ========================================== Severity: Critical Date : 2019-03-22 CVE-ID : CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 Package : libssh2 Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-926 Summary ======= The package libssh2 before version 1.8.1-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 1.8.1-1. # pacman -Syu "libssh2>=1.8.1-1" The problems have been fixed upstream in version 1.8.1. Workaround ========== None. Description =========== - CVE-2019-3855 (arbitrary code execution) A out-of-bounds write has been found in libssh2 before 1.8.1, where a malicious server could send a specially crafted packet which could result in an unchecked integer overflow. The value would then be used to allocate memory causing a possible memory write out of bounds error. - CVE-2019-3856 (arbitrary code execution) An issue has been found in libssh2 before 1.8.1 where a server could send a value approaching unsigned int max number of keyboard prompt requests which could result in an unchecked integer overflow. The value would then be used to allocate memory causing a possible memory write out of bounds error. - CVE-2019-3857 (arbitrary code execution) An issue has been found in libssh2 before 1.8.1 where a server could send a SSH_MSG_CHANNEL_REQUEST packet with an exit signal message with a length of max unsigned integer value. The length would then have a value of 1 added to it and used to allocate memory causing a possible memory write out of bounds error or zero byte allocation. - CVE-2019-3858 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted partial SFTP packet with a zero value for the payload length. This zero value would be used to then allocate memory resulting in a zero byte allocation and possible out of bounds read. - CVE-2019-3859 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted partial packet in response to various commands such as: sha1 and sha226 key exchange, user auth list, user auth password response, public key auth response, channel startup/open/forward/ setenv/request pty/x11 and session start up. The result would be a memory out of bounds read. - CVE-2019-3860 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted partial SFTP packet with a empty payload in response to various SFTP commands such as read directory, file status, status vfs and symlink. The result would be a memory out of bounds read. - CVE-2019-3861 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted SSH packet with a padding length value greater than the packet length. This would result in a buffer read out of bounds when decompressing the packet or result in a corrupted packet value. - CVE-2019-3862 (information disclosure) An issue has been found in libssh2 before 1.8.1 where a server could send a specially crafted SSH_MSG_CHANNEL_REQUEST packet with an exit status message and no payload. This would result in an out of bounds memory comparison. - CVE-2019-3863 (arbitrary code execution) An issue has been found in libssh2 before 1.8.1 where a server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used as an index to copy memory causing in an out of bounds memory write error. Impact ====== A malicious server could access sensitive information or execute arbitrary code on a vulnerable client. References ========== https://www.libssh2.org/mail/libssh2-devel-archive-2019-03/0009.shtml https://www.libssh2.org/CVE-2019-3855.html https://libssh2.org/1.8.0-CVE/CVE-2019-3855.patch https://www.libssh2.org/CVE-2019-3856.html https://libssh2.org/1.8.0-CVE/CVE-2019-3856.patch https://www.libssh2.org/CVE-2019-3857.html https://libssh2.org/1.8.0-CVE/CVE-2019-3857.patch https://www.libssh2.org/CVE-2019-3858.html https://libssh2.org/1.8.0-CVE/CVE-2019-3858.patch https://www.libssh2.org/CVE-2019-3859.html https://libssh2.org/1.8.0-CVE/CVE-2019-3859.patch https://www.libssh2.org/CVE-2019-3860.html https://libssh2.org/1.8.0-CVE/CVE-2019-3860.patch https://www.libssh2.org/CVE-2019-3861.html https://libssh2.org/1.8.0-CVE/CVE-2019-3861.patch https://www.libssh2.org/CVE-2019-3862.html https://libssh2.org/1.8.0-CVE/CVE-2019-3862.patch https://www.libssh2.org/CVE-2019-3863.html https://libssh2.org/1.8.0-CVE/CVE-2019-3863.patch https://security.archlinux.org/CVE-2019-3855 https://security.archlinux.org/CVE-2019-3856 https://security.archlinux.org/CVE-2019-3857 https://security.archlinux.org/CVE-2019-3858 https://security.archlinux.org/CVE-2019-3859 https://security.archlinux.org/CVE-2019-3860 https://security.archlinux.org/CVE-2019-3861 https://security.archlinux.org/CVE-2019-3862 https://security.archlinux.org/CVE-2019-3863

1 0

[ASA-201903-11] firefox: multiple issues
by Remi Gacogne 22 Mar '19

22 Mar '19

Arch Linux Security Advisory ASA-201903-11 ========================================== Severity: Critical Date : 2019-03-22 CVE-ID : CVE-2019-9788 CVE-2019-9789 CVE-2019-9790 CVE-2019-9791 CVE-2019-9792 CVE-2019-9793 CVE-2019-9795 CVE-2019-9796 CVE-2019-9797 CVE-2019-9799 CVE-2019-9802 CVE-2019-9803 CVE-2019-9805 CVE-2019-9806 CVE-2019-9807 CVE-2019-9808 CVE-2019-9809 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-925 Summary ======= The package firefox before version 66.0-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure, same-origin policy bypass, access restriction bypass, content spoofing and denial of service. Resolution ========== Upgrade to 66.0-1. # pacman -Syu "firefox>=66.0-1" The problems have been fixed upstream in version 66.0. Workaround ========== None. Description =========== - CVE-2019-9788 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 66.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2019-9789 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 66.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2019-9790 (arbitrary code execution) A use-after-free vulnerability can occur in Firefox before 66.0 when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. - CVE-2019-9791 (arbitrary code execution) The type inference system in Firefox before 66.0 allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. - CVE-2019-9792 (arbitrary code execution) The IonMonkey just-in-time (JIT) compiler in Firefox before 66.0 can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then be used by JavaScript to achieve memory corruption, which results in a potentially exploitable crash. - CVE-2019-9793 (arbitrary code execution) A mechanism was discovered in Firefox before 66.0 that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. Note that Spectre mitigations are currently enabled for all users by default settings. - CVE-2019-9795 (arbitrary code execution) A vulnerability has been found in Firefox before 66.0; where type- confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash. - CVE-2019-9796 (arbitrary code execution) A use-after-free vulnerability can occur in Firefox before 66.0 when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element, the refresh driver incorrectly leaves a dangling pointer to the driver's observer array. - CVE-2019-9797 (same-origin policy bypass) Cross-origin images can be read in violation of the same-origin policy, in Firefox before 66.0, by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. - CVE-2019-9799 (information disclosure) Insufficient bounds checking of data during inter-process communication in Firefox before 66.0 might allow a compromised content process to be able to read memory from the parent process under certain conditions. - CVE-2019-9802 (information disclosure) If a Sandbox content process is compromised in Firefox before 66.0, it can initiate an FTP download which will then use a child process to render the downloaded data. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and allow for a potential memory read of adjacent data from the privileged Chrome process, which may include sensitive data. - CVE-2019-9803 (access restriction bypass) The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same- origin URL must be upgraded to HTTPS. Firefox before 66.0 will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some circumstances, allowing for potential man-in-the-middle attacks on the linked resources. - CVE-2019-9805 (information disclosure) A latent vulnerability exists in the Prio library in Firefox before 66.0 where data may be read from uninitialized memory for some functions, leading to potential memory corruption. - CVE-2019-9806 (denial of service) A vulnerability exists in Firefox before 66.0 during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediately dismissed. This allows for a denial of service (DOS) attack. - CVE-2019-9807 (content spoofing) When arbitrary text is sent over an FTP connection and a page reload is initiated in Firefox before 66.0, it is possible to create a modal alert message with this text as the content. This could potentially be used for social engineering attacks. - CVE-2019-9808 (content spoofing) If WebRTC permission is requested from documents with data: or blob: URLs in Firefox before 66.0, the permission notifications do not properly display the originating domain. The notification states "Unknown origin" as the requestee, leading to user confusion about which site is asking for this permission. - CVE-2019-9809 (denial of service) If the source for resources on a page is through an FTP connection in Firefox before 66.0, it is possible to trigger a series of modal alert messages for these resources through invalid credentials or locations. These messages cannot be immediately dismissed, allowing for a denial of service (DOS) attack. Impact ====== A remote attacker might be able to spoof origin of a permission request, bypass security measures, access sensitive information, crash the browser or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9788 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1518001%2C1521304%2C1521214… https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9789 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1520483%2C1522987%2C1528199… https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9790 https://bugzilla.mozilla.org/show_bug.cgi?id=1525145 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9791 https://bugzilla.mozilla.org/show_bug.cgi?id=1530958 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9792 https://bugzilla.mozilla.org/show_bug.cgi?id=1532599 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9793 https://bugzilla.mozilla.org/show_bug.cgi?id=1528829 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9795 https://bugzilla.mozilla.org/show_bug.cgi?id=1514682 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9796 https://bugzilla.mozilla.org/show_bug.cgi?id=1531277 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9797 https://bugzilla.mozilla.org/show_bug.cgi?id=1528909 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9799 https://bugzilla.mozilla.org/show_bug.cgi?id=1505678 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9802 https://bugzilla.mozilla.org/show_bug.cgi?id=1415508 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9803 https://bugzilla.mozilla.org/show_bug.cgi?id=1515863 https://bugzilla.mozilla.org/show_bug.cgi?id=1437009 https://w3c.github.io/webappsec-upgrade-insecure-requests/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9805 https://bugzilla.mozilla.org/show_bug.cgi?id=1521360 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9806 https://bugzilla.mozilla.org/show_bug.cgi?id=1525267 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9807 https://bugzilla.mozilla.org/show_bug.cgi?id=1362050 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9808 https://bugzilla.mozilla.org/show_bug.cgi?id=1434634 https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9809 https://bugzilla.mozilla.org/show_bug.cgi?id=1282430 https://bugzilla.mozilla.org/show_bug.cgi?id=1523249 https://security.archlinux.org/CVE-2019-9788 https://security.archlinux.org/CVE-2019-9789 https://security.archlinux.org/CVE-2019-9790 https://security.archlinux.org/CVE-2019-9791 https://security.archlinux.org/CVE-2019-9792 https://security.archlinux.org/CVE-2019-9793 https://security.archlinux.org/CVE-2019-9795 https://security.archlinux.org/CVE-2019-9796 https://security.archlinux.org/CVE-2019-9797 https://security.archlinux.org/CVE-2019-9799 https://security.archlinux.org/CVE-2019-9802 https://security.archlinux.org/CVE-2019-9803 https://security.archlinux.org/CVE-2019-9805 https://security.archlinux.org/CVE-2019-9806 https://security.archlinux.org/CVE-2019-9807 https://security.archlinux.org/CVE-2019-9808 https://security.archlinux.org/CVE-2019-9809

1 0

[ASA-201903-10] wordpress: directory traversal
by Santiago Torres-Arias 20 Mar '19

20 Mar '19

Arch Linux Security Advisory ASA-201903-10 ========================================== Severity: High Date : 2019-03-18 CVE-ID : CVE-2019-8943 Package : wordpress Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-909 Summary ======= The package wordpress before version 5.1-1 is vulnerable to directory traversal. Resolution ========== Upgrade to 5.1-1. # pacman -Syu "wordpress>=5.1-1" The problem has been fixed upstream in version 5.1. Workaround ========== None. Description =========== WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. Impact ====== A remote attacker with image-cropping privileges can write files to an arbitrary directory References ========== https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/ https://security.archlinux.org/CVE-2019-8943

1 0

[ASA-201903-9] libelf: denial of service
by Santiago Torres-Arias 20 Mar '19

20 Mar '19

Arch Linux Security Advisory ASA-201903-9 ========================================= Severity: Medium Date : 2019-03-18 CVE-ID : CVE-2019-7148 CVE-2019-7149 CVE-2019-7150 CVE-2019-7664 CVE-2019-7665 Package : libelf Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-863 Summary ======= The package libelf before version 0.176-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.176-1. # pacman -Syu "libelf>=0.176-1" The problems have been fixed upstream in version 0.176. Workaround ========== None. Description =========== - CVE-2019-7148 (denial of service) An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils <= 0.175. Remote attackers could leverage this vulnerability to cause a denial-of- service via crafted elf input, which leads to an out-of-memory exception. - CVE-2019-7149 (denial of service) A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of- service. - CVE-2019-7150 (denial of service) An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service. - CVE-2019-7664 (denial of service) In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash). - CVE-2019-7665 (denial of service) In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes. Impact ====== A remote attacker is able to crash a program that uses libelf by providing it with a crafted ELF file. References ========== https://sourceware.org/bugzilla/show_bug.cgi?id=24085 https://sourceware.org/bugzilla/show_bug.cgi?id=24102 https://sourceware.org/bugzilla/show_bug.cgi?id=24103 https://sourceware.org/bugzilla/show_bug.cgi?id=24084 https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html https://sourceware.org/bugzilla/show_bug.cgi?id=24089 https://security.archlinux.org/CVE-2019-7148 https://security.archlinux.org/CVE-2019-7149 https://security.archlinux.org/CVE-2019-7150 https://security.archlinux.org/CVE-2019-7664 https://security.archlinux.org/CVE-2019-7665

1 0

[ASA-201903-8] chromium: multiple issues
by Remi Gacogne 13 Mar '19

13 Mar '19

Arch Linux Security Advisory ASA-201903-8 ========================================= Severity: High Date : 2019-03-13 CVE-ID : CVE-2019-5787 CVE-2019-5788 CVE-2019-5789 CVE-2019-5790 CVE-2019-5791 CVE-2019-5792 CVE-2019-5793 CVE-2019-5794 CVE-2019-5795 CVE-2019-5796 CVE-2019-5797 CVE-2019-5798 CVE-2019-5799 CVE-2019-5800 CVE-2019-5802 CVE-2019-5803 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-923 Summary ======= The package chromium before version 73.0.3683.75-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing and information disclosure. Resolution ========== Upgrade to 73.0.3683.75-1. # pacman -Syu "chromium>=73.0.3683.75-1" The problems have been fixed upstream in version 73.0.3683.75. Workaround ========== None. Description =========== - CVE-2019-5787 (arbitrary code execution) A use-after-free issue has been found in the Canvas component of the chromium browser before 73.0.3683.75. - CVE-2019-5788 (arbitrary code execution) A use-after-free issue has been found in the FileAPI component of the chromium browser before 73.0.3683.75. - CVE-2019-5789 (arbitrary code execution) A use-after-free issue has been found in the WebMIDI component of the chromium browser before 73.0.3683.75. - CVE-2019-5790 (arbitrary code execution) A heap-based buffer overflow has been found in the V8 component of the chromium browser before 73.0.3683.75. - CVE-2019-5791 (arbitrary code execution) A type confusion issue has been found in the V8 component of the chromium browser before 73.0.3683.75. - CVE-2019-5792 (arbitrary code execution) An integer overflow issue has been found in the PDFium component of the chromium browser before 73.0.3683.75. - CVE-2019-5793 (access restriction bypass) An excessive permissions for private API issue has been found in the Extensions component of the chromium browser before 73.0.3683.75. - CVE-2019-5794 (content spoofing) A UI spoofing issue has been found in the chromium browser before 73.0.3683.75. - CVE-2019-5795 (arbitrary code execution) An integer overflow issue has been found in the PDFium component of the chromium browser before 73.0.3683.75. - CVE-2019-5796 (arbitrary code execution) A race condition has been found in the Extensions component of the chromium browser before 73.0.3683.75. - CVE-2019-5797 (arbitrary code execution) A race condition has been found in the DOMStorage component of the chromium browser before 73.0.3683.75. - CVE-2019-5798 (information disclosure) An out-of-bounds read has been found in the Skia component of the chromium browser before 73.0.3683.75. - CVE-2019-5799 (access restriction bypass) A CSP bypass issue with blob URLs has been found in the chromium browser before 73.0.3683.75. - CVE-2019-5800 (access restriction bypass) A CSP bypass issue with blob URLs has been found in the chromium browser before 73.0.3683.75. - CVE-2019-5802 (content spoofing) A UI spoofing issue has been found in the chromium browser before 73.0.3683.75. - CVE-2019-5803 (access restriction bypass) A CSP bypass issue with Javascript URLs has been found in the chromium browser before 73.0.3683.75. Impact ====== A remote attacker can access sensitive information, bypass security restrictions and execute arbitrary code via crafted web content. References ========== https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-des… https://bugs.chromium.org/p/chromium/issues/detail?id=913964 https://bugs.chromium.org/p/chromium/issues/detail?id=925864 https://bugs.chromium.org/p/chromium/issues/detail?id=921581 https://bugs.chromium.org/p/chromium/issues/detail?id=914736 https://bugs.chromium.org/p/chromium/issues/detail?id=926651 https://bugs.chromium.org/p/chromium/issues/detail?id=914983 https://bugs.chromium.org/p/chromium/issues/detail?id=937487 https://bugs.chromium.org/p/chromium/issues/detail?id=935175 https://bugs.chromium.org/p/chromium/issues/detail?id=919643 https://bugs.chromium.org/p/chromium/issues/detail?id=918861 https://bugs.chromium.org/p/chromium/issues/detail?id=916523 https://bugs.chromium.org/p/chromium/issues/detail?id=883596 https://bugs.chromium.org/p/chromium/issues/detail?id=905301 https://bugs.chromium.org/p/chromium/issues/detail?id=894228 https://bugs.chromium.org/p/chromium/issues/detail?id=632514 https://bugs.chromium.org/p/chromium/issues/detail?id=909865 https://security.archlinux.org/CVE-2019-5787 https://security.archlinux.org/CVE-2019-5788 https://security.archlinux.org/CVE-2019-5789 https://security.archlinux.org/CVE-2019-5790 https://security.archlinux.org/CVE-2019-5791 https://security.archlinux.org/CVE-2019-5792 https://security.archlinux.org/CVE-2019-5793 https://security.archlinux.org/CVE-2019-5794 https://security.archlinux.org/CVE-2019-5795 https://security.archlinux.org/CVE-2019-5796 https://security.archlinux.org/CVE-2019-5797 https://security.archlinux.org/CVE-2019-5798 https://security.archlinux.org/CVE-2019-5799 https://security.archlinux.org/CVE-2019-5800 https://security.archlinux.org/CVE-2019-5802 https://security.archlinux.org/CVE-2019-5803

1 0

[ASA-201903-7] pacman: arbitrary code execution
by Levente Polyak 11 Mar '19

11 Mar '19

Arch Linux Security Advisory ASA-201903-7 ========================================= Severity: High Date : 2019-03-11 CVE-ID : CVE-2019-9686 Package : pacman Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-921 Summary ======= The package pacman before version 5.1.3-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.1.3-1. # pacman -Syu "pacman>=5.1.3-1" The problem has been fixed upstream in version 5.1.3. Workaround ========== None. Description =========== pacman prior to version 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c. Impact ====== A remote attacker in the position of man-in-the-middle or a malicious server is able to execute arbitrary code as root when a user installs a remote package via a specified URL. References ========== https://git.archlinux.org/pacman.git/commit/?id=9702703633bec2c007730006de2… https://git.archlinux.org/pacman.git/commit/?id=d197d8ab82cf10650487518fb96… https://git.archlinux.org/pacman.git/commit/?h=release/5.1.x&id=1bf76723436… https://security.archlinux.org/CVE-2019-9686

1 0