Jelle van der Waa has announced 5 security updates for Arch Linux:
ASA-201902-16: firefox: multiple issues
ASA-201902-17: webkit2gtk: arbitrary code execution
ASA-201902-18: hiawatha: directory traversal
ASA-201902-19: cairo: arbitrary code execution
ASA-201902-20: flatpak: privilege escalation
ASA-201902-16: firefox: multiple issues
ASA-201902-17: webkit2gtk: arbitrary code execution
ASA-201902-18: hiawatha: directory traversal
ASA-201902-19: cairo: arbitrary code execution
ASA-201902-20: flatpak: privilege escalation
ASA-201902-16: firefox: multiple issues
Arch Linux Security Advisory ASA-201902-16
==========================================
Severity: High
Date : 2019-02-13
CVE-ID : CVE-2018-18356 CVE-2018-18511 CVE-2019-5785
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-896
Summary
=======
The package firefox before version 65.0.1-1 is vulnerable to multiple
issues including arbitrary code execution and same-origin policy
bypass.
Resolution
==========
Upgrade to 65.0.1-1.
# pacman -Syu "firefox>=65.0.1-1"
The problems have been fixed upstream in version 65.0.1.
Workaround
==========
None.
Description
===========
- CVE-2018-18356 (arbitrary code execution)
A use-after-free has been found in the Skia component of chromium
before 71.0.3578.80 and firefox before 65.0.1.
- CVE-2018-18511 (same-origin policy bypass)
A cross-origin theft of images issue has been found in the
ImageBitmapRenderingContext component of firefox 65.0, where cross-
origin images can be read from a canvas element in violation of the
same-origin policy using the transferFromImageBitmap method. The issue
has been fixed in 65.0.1 and versions prior to 65.0 were not affected.
- CVE-2019-5785 (arbitrary code execution)
An integer overflow issue has been found in the Skia component of
firefox before 65.0.1.
Impact
======
A remote attacker can bypass the same-origin policy to access sensitive
information, or execute arbitrary code, via a crafted web content.
References
==========
https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
https://bugs.chromium.org/p/chromium/issues/detail?id=883666
https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2018-18356
https://bugzilla.mozilla.org/show_bug.cgi?id=1525817
https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2019-5785
https://bugzilla.mozilla.org/show_bug.cgi?id=1526218
https://bugzilla.mozilla.org/show_bug.cgi?id=1525433
https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexity-confusion.html
https://security.archlinux.org/CVE-2018-18356
https://security.archlinux.org/CVE-2018-18511
https://security.archlinux.org/CVE-2019-5785
ASA-201902-17: webkit2gtk: arbitrary code execution
Arch Linux Security Advisory ASA-201902-17
==========================================
Severity: Critical
Date : 2019-02-15
CVE-ID : CVE-2019-6212 CVE-2019-6215
Package : webkit2gtk
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-899
Summary
=======
The package webkit2gtk before version 2.22.6-1 is vulnerable to
arbitrary code execution.
Resolution
==========
Upgrade to 2.22.6-1.
# pacman -Syu "webkit2gtk>=2.22.6-1"
The problems have been fixed upstream in version 2.22.6.
Workaround
==========
None.
Description
===========
- CVE-2019-6212 (arbitrary code execution)
Multiple memory corruption issues have been found in WebKitGTK+ before
2.22.6, where processing maliciously crafted web content may lead to
arbitrary code execution.
- CVE-2019-6215 (arbitrary code execution)
A type confusion issue has been found in WebKitGTK+ before 2.22.6,
where processing maliciously crafted web content may lead to arbitrary
code execution.
Impact
======
A remote attacker can execute arbitrary code via maliciously crafted
web content.
References
==========
https://webkitgtk.org/security/WSA-2019-0001.html
https://webkitgtk.org/security/WSA-2019-0001.html#CVE-2019-6212
https://webkitgtk.org/security/WSA-2019-0001.html#CVE-2019-6215
https://security.archlinux.org/CVE-2019-6212
https://security.archlinux.org/CVE-2019-6215
ASA-201902-18: hiawatha: directory traversal
Arch Linux Security Advisory ASA-201902-18
==========================================
Severity: High
Date : 2019-02-16
CVE-ID : CVE-2019-8358
Package : hiawatha
Type : directory traversal
Remote : Yes
Link : https://security.archlinux.org/AVG-900
Summary
=======
The package hiawatha before version 10.8.4-1 is vulnerable to directory
traversal.
Resolution
==========
Upgrade to 10.8.4-1.
# pacman -Syu "hiawatha>=10.8.4-1"
The problem has been fixed upstream in version 10.8.4.
Workaround
==========
None.
Description
===========
In Hiawatha before 10.8.4 a remote attacker is able to do directory
traversal if AllowDotFiles is enabled.
Impact
======
A remote attacker is able to read arbitrary files from a hiawatha
server.
References
==========
https://www.hiawatha-webserver.org/changelog
https://security.archlinux.org/CVE-2019-8358
ASA-201902-19: cairo: arbitrary code execution
Arch Linux Security Advisory ASA-201902-19
==========================================
Severity: Critical
Date : 2019-02-17
CVE-ID : CVE-2018-19876
Package : cairo
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-826
Summary
=======
The package cairo before version 1.16.0-2 is vulnerable to arbitrary
code execution.
Resolution
==========
Upgrade to 1.16.0-2.
# pacman -Syu "cairo>=1.16.0-2"
The problem has been fixed upstream but no release is available yet.
Workaround
==========
None.
Description
===========
A memory-corruption issue has been found in cairo versions
