October 2020 - Arch-security - lists.archlinux.org

[ASA-202010-11] lib32-freetype2: arbitrary code execution
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-11 ========================================== Severity: High Date : 2020-10-20 CVE-ID : CVE-2020-15999 Package : lib32-freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1255 Summary ======= The package lib32-freetype2 before version 2.10.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.10.4-1. # pacman -Syu "lib32-freetype2>=2.10.4-1" The problem has been fixed upstream in version 2.10.4. Workaround ========== None. Description =========== A heap buffer overflow has been found in freetype2 before 2.10.4. Malformed TTF files with PNG sbit glyphs can cause a heap buffer overflow in Load_SBit_Png as libpng uses the original 32-bit values, which are saved in png_struct. If the original width and/or height are greater than 65535, the allocated buffer won't be able to fit the bitmap. Impact ====== A remote user can serve malformed TTF files that can cause arbitrary code execution on the affected host. References ========== http://git.savannah.nongnu.org/cgit/freetype/freetype2.git/commit/?id=a3bab… https://savannah.nongnu.org/bugs/?59308 https://security.archlinux.org/CVE-2020-15999

1 0

[ASA-202010-10] freetype2: arbitrary code execution
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-10 ========================================== Severity: High Date : 2020-10-20 CVE-ID : CVE-2020-15999 Package : freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1254 Summary ======= The package freetype2 before version 2.10.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.10.4-1. # pacman -Syu "freetype2>=2.10.4-1" The problem has been fixed upstream in version 2.10.4. Workaround ========== None. Description =========== A heap buffer overflow has been found in freetype2 before 2.10.4. Malformed TTF files with PNG sbit glyphs can cause a heap buffer overflow in Load_SBit_Png as libpng uses the original 32-bit values, which are saved in png_struct. If the original width and/or height are greater than 65535, the allocated buffer won't be able to fit the bitmap. Impact ====== A remote user can serve malformed TTF files that can cause arbitrary code execution on the affected host. References ========== http://git.savannah.nongnu.org/cgit/freetype/freetype2.git/commit/?id=a3bab… https://savannah.nongnu.org/bugs/?59308 https://security.archlinux.org/CVE-2020-15999

1 0

[ASA-202010-9] linux-hardened: multiple issues
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-9 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490 Package : linux-hardened Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1251 Summary ======= The package linux-hardened before version 5.8.16.a-1 is vulnerable to multiple issues including information disclosure, privilege escalation and denial of service. Resolution ========== Upgrade to 5.8.16.a-1. # pacman -Syu "linux-hardened>=5.8.16.a-1" The problems have been fixed upstream in version 5.8.16.a. Workaround ========== None. Description =========== - CVE-2020-12351 (privilege escalation) A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. - CVE-2020-12352 (information disclosure) An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. - CVE-2020-24490 (denial of service) A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== A remote unauthenticated attacker in range is able to execute arbitrary code, disclose information or DoS the system through bluetooth. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://github.com/google/security-research/security/advisories/GHSA-h637-c… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz… https://github.com/google/security-research/security/advisories/GHSA-7mh3-g… https://github.com/google/security-research/security/advisories/GHSA-ccx2-w… https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.gi… https://security.archlinux.org/CVE-2020-12351 https://security.archlinux.org/CVE-2020-12352 https://security.archlinux.org/CVE-2020-24490

1 0

[ASA-202010-8] kpmcore: privilege escalation
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-8 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-27187 Package : kpmcore Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1253 Summary ======= The package kpmcore before version 4.2.0-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.2.0-1. # pacman -Syu "kpmcore>=4.2.0-1" The problem has been fixed upstream in version 4.2.0. Workaround ========== None. Description =========== kpmcore_externalcommand helper contains a logic flaw in which the service invoking dbus is not properly checked. An attacker on your local machine can replace /etc/fstab, execute mount and other partitioning related commands while KDE Partition Manager is running. mount command can then be used to gain full root privileges. Impact ====== A local attacker is able to escalate privileges, modify the filesystem and launch partition commands on the host while the program is running. References ========== https://kde.org/info/security/advisory-20201017-1.txt https://invent.kde.org/system/kpmcore/-/commit/c466c5db11b5cee546d1ec0594c2… https://invent.kde.org/system/kpmcore/-/commit/7ec4b611dcf822439b081613cca4… https://security.archlinux.org/CVE-2020-27187

1 0

[ASA-202010-7] kdeconnect: arbitrary code execution
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-7 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-26164 Package : kdeconnect Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1241 Summary ======= The package kdeconnect before version 20.08.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 20.08.2-1. # pacman -Syu "kdeconnect>=20.08.2-1" The problem has been fixed upstream in version 20.08.2. Workaround ========== None. Description =========== Several issues have been found in kdeconnect <= 20.08.1 where a remote, unauthenticated attacker on the local network can access sensitive information, crash the daemon or possibly execute arbitrary code via a use-after-free. Impact ====== A remote unauthenticated attacker on the local network can access sensitive information, crash the daemon or possible execute arbitrary code. References ========== https://kde.org/info/security/advisory-20201002-1.txt https://www.openwall.com/lists/oss-security/2020/10/13/4 https://security.archlinux.org/CVE-2020-26164

1 0

[ASA-202010-6] powerdns-recursor: denial of service
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-6 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-25829 Package : powerdns-recursor Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1243 Summary ======= The package powerdns-recursor before version 4.3.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.3.5-1. # pacman -Syu "powerdns-recursor>=4.3.5-1" The problem has been fixed upstream in version 4.3.5. Workaround ========== None. Description =========== An issue has been found in PowerDNS Recursor before 4.3.5 where a remote attacker can cause the cached records for a given name to be updated to the ‘Bogus’ DNSSEC validation state, instead of their actual DNSSEC ‘Secure’ state, via a DNS ANY query. This results in a denial of service for installations that always validate (dnssec=validate) and for clients requesting validation when on-demand validation is enabled (dnssec=process). Impact ====== A remote attacker can deny DNSSEC validation by updating the state of cached entries. References ========== https://www.openwall.com/lists/oss-security/2020/10/13/3 https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-20… https://downloads.powerdns.com/patches/2020-07/any-cache-update-4.3.4.diff https://github.com/PowerDNS/pdns/commit/ae33c53e68a32189e0a2fd3df24821d3edc… https://security.archlinux.org/CVE-2020-25829

1 0

[ASA-202010-5] lua: arbitrary code execution
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-5 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-15888 CVE-2020-15889 Package : lua Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1207 Summary ======= The package lua before version 5.4.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.4.1-1. # pacman -Syu "lua>=5.4.1-1" The problems have been fixed upstream in version 5.4.1. Workaround ========== None. Description =========== - CVE-2020-15888 (arbitrary code execution) Lua through 5.4.0 mishandles the interaction between stack resizes and garbage collection, leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. - CVE-2020-15889 (arbitrary code execution) Lua through 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members. Impact ====== A remote attacker is capable of executing arbitrary code on the affected host. References ========== http://lua-users.org/lists/lua-l/2020-07/msg00053.html http://lua-users.org/lists/lua-l/2020-07/msg00054.html http://lua-users.org/lists/lua-l/2020-07/msg00071.html http://lua-users.org/lists/lua-l/2020-07/msg00079.html https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7 https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5 http://lua-users.org/lists/lua-l/2020-07/msg00078.html https://github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312 https://security.archlinux.org/CVE-2020-15888 https://security.archlinux.org/CVE-2020-15889

1 0

[ASA-202010-4] linux-lts: multiple issues
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-4 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490 Package : linux-lts Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1250 Summary ======= The package linux-lts before version 5.4.72-1 is vulnerable to multiple issues including information disclosure, privilege escalation and denial of service. Resolution ========== Upgrade to 5.4.72-1. # pacman -Syu "linux-lts>=5.4.72-1" The problems have been fixed upstream in version 5.4.72. Workaround ========== None. Description =========== - CVE-2020-12351 (privilege escalation) A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. - CVE-2020-12352 (information disclosure) An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. - CVE-2020-24490 (denial of service) A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== A remote unauthenticated attacker in range is able to execute arbitrary code, disclose information or DoS the system through bluetooth. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://github.com/google/security-research/security/advisories/GHSA-h637-c… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz… https://github.com/google/security-research/security/advisories/GHSA-7mh3-g… https://github.com/google/security-research/security/advisories/GHSA-ccx2-w… https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.gi… https://security.archlinux.org/CVE-2020-12351 https://security.archlinux.org/CVE-2020-12352 https://security.archlinux.org/CVE-2020-24490

1 0

[ASA-202010-3] linux-zen: multiple issues
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-3 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490 Package : linux-zen Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1249 Summary ======= The package linux-zen before version 5.9.1.zen2-1 is vulnerable to multiple issues including information disclosure, privilege escalation and denial of service. Resolution ========== Upgrade to 5.9.1.zen2-1. # pacman -Syu "linux-zen>=5.9.1.zen2-1" The problems have been fixed upstream in version 5.9.1.zen2. Workaround ========== None. Description =========== - CVE-2020-12351 (privilege escalation) A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. - CVE-2020-12352 (information disclosure) An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. - CVE-2020-24490 (denial of service) A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== A remote unauthenticated attacker in range is able to execute arbitrary code, disclose information or DoS the system through bluetooth. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://github.com/google/security-research/security/advisories/GHSA-h637-c… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz… https://github.com/google/security-research/security/advisories/GHSA-7mh3-g… https://github.com/google/security-research/security/advisories/GHSA-ccx2-w… https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.gi… https://security.archlinux.org/CVE-2020-12351 https://security.archlinux.org/CVE-2020-12352 https://security.archlinux.org/CVE-2020-24490

1 0

[ASA-202010-2] linux: multiple issues
by Morten Linderud 21 Oct '20

21 Oct '20

Arch Linux Security Advisory ASA-202010-2 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-12351 CVE-2020-12352 CVE-2020-24490 Package : linux Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1248 Summary ======= The package linux before version 5.9.1.arch1-1 is vulnerable to multiple issues including information disclosure, privilege escalation and denial of service. Resolution ========== Upgrade to 5.9.1.arch1-1. # pacman -Syu "linux>=5.9.1.arch1-1" The problems have been fixed upstream in version 5.9.1.arch1. Workaround ========== None. Description =========== - CVE-2020-12351 (privilege escalation) A flaw was found in the way the Linux kernel Bluetooth implementation handled L2CAP packets with A2MP CID. A remote attacker in adjacent range could use this flaw to crash the system causing denial of service or potentially execute arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. - CVE-2020-12352 (information disclosure) An information leak flaw was found in the way the Linux kernel's Bluetooth stack implementation handled initialization of stack memory when handling certain AMP packets. A remote attacker in adjacent range could use this flaw to leak small portions of stack memory on the system by sending a specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality. - CVE-2020-24490 (denial of service) A heap buffer overflow flaw was found in the way the Linux kernel’s Bluetooth implementation processed extended advertising report events. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or to potentially execute arbitrary code on the system by sending a specially crafted Bluetooth packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Impact ====== A remote unauthenticated attacker in range is able to execute arbitrary code, disclose information or DoS the system through bluetooth. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://github.com/google/security-research/security/advisories/GHSA-h637-c… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-2-luiz.dentz… https://lore.kernel.org/linux-bluetooth/20200806181714.3216076-1-luiz.dentz… https://github.com/google/security-research/security/advisories/GHSA-7mh3-g… https://github.com/google/security-research/security/advisories/GHSA-ccx2-w… https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.gi… https://security.archlinux.org/CVE-2020-12351 https://security.archlinux.org/CVE-2020-12352 https://security.archlinux.org/CVE-2020-24490

1 0