The following updates has been released for Arch Linux:
ASA-201910-14: php: arbitrary code execution
ASA-201910-15: thunderbird: multiple issues
ASA-201910-16: firefox: multiple issues
ASA-201910-17: chromium: multiple issues
ASA-201910-14: php: arbitrary code execution
ASA-201910-15: thunderbird: multiple issues
ASA-201910-16: firefox: multiple issues
ASA-201910-17: chromium: multiple issues
ASA-201910-14: php: arbitrary code execution
Arch Linux Security Advisory ASA-201910-14
==========================================
Severity: Critical
Date : 2019-10-25
CVE-ID : CVE-2019-11043
Package : php
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-1052
Summary
=======
The package php before version 7.3.11-1 is vulnerable to arbitrary code
execution.
Resolution
==========
Upgrade to 7.3.11-1.
# pacman -Syu "php>=7.3.11-1"
The problem has been fixed upstream in version 7.3.11.
Workaround
==========
If nginx and php-fpm share the same filesystem, one can first check the
script actually exists, so the malicious request will never make it to
php-fpm (it is usually done using something like `try_files $uri
=404`). Or there may be cgi.fix_pathinfo=0 which will also prevent
exploitation.
Description
===========
A buffer underflow issue has been found in the php-fpm component of php
before 7.3.11, 7.2.24 and 7.1.33, leading to remote code execution in
certain nginx + php-fpm configurations. This vulnerability can be
exploited if the fastcgi_split_path_info directive contains a regexp
that can be broken by an attacker by supplying %0a in the path info
which results in the fastcgi_param PATH_INFO being empty.
Impact
======
A remote attacker is able to execute arbitrary code on the affected
host by supplying %0a in the path info if php-fpm is used with a
vulnerable nginx configuration.
References
==========
https://bugs.php.net/bug.php?id=78599
https://git.php.net/?p=php-src.git;a=commitdiff;h=19e17d3807e6cc0b1ba9443ec5facbd33a61f8fe
https://github.com/neex/phuip-fpizdam
https://security.archlinux.org/CVE-2019-11043
ASA-201910-15: thunderbird: multiple issues
Arch Linux Security Advisory ASA-201910-15
==========================================
Severity: Critical
Date : 2019-10-26
CVE-ID : CVE-2019-11757 CVE-2019-11759 CVE-2019-11760 CVE-2019-11761
CVE-2019-11762 CVE-2019-11763 CVE-2019-11764 CVE-2019-15903
Package : thunderbird
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1054
Summary
=======
The package thunderbird before version 68.2.0-1 is vulnerable to
multiple issues including arbitrary code execution, access restriction
bypass, denial of service, insufficient validation and same-origin
policy bypass.
Resolution
==========
Upgrade to 68.2.0-1.
# pacman -Syu "thunderbird>=68.2.0-1"
The problems have been fixed upstream in version 68.2.0.
Workaround
==========
None.
Description
===========
- CVE-2019-11757 (arbitrary code execution)
A use-after-free issue has been found in the IndexedDB component of
Firefox before 70.0 and Thunderbird before 68.2. When storing a value
in IndexedDB, the value's prototype chain is followed and it was
possible to retain a reference to a locale, delete it, and subsequently
reference it.
- CVE-2019-11759 (arbitrary code execution)
A stack-based buffer overflow has been found in the HKDF output of
Firefox before 70.0 and Thunderbird before 68.2. An attacker could have
caused 4 bytes of HMAC output to be written past the end of a buffer
stored on the stack.
- CVE-2019-11760 (arbitrary code execution)
A fixed-size stack buffer overflow has been found in nrappkit, in the
WebRTC signaling code of Firefox before 70.0 and Thunderbird before
68.2.
- CVE-2019-11761 (access restriction bypass)
An issue has been found in Firefox before 70.0 and Thunderbird before
68.2, where by using a form with a data URI it was possible to gain
access to the privileged JSONView object that had been cloned into
content. Impact from exposing this object appears to be minimal,
however it was a bypass of existing defense in depth mechanisms.
- CVE-2019-11762 (same-origin policy bypass)
A same-origin policy bypass has been found in Firefox before 70.0 and
Thunderbird before 68.2 where, if two same-origin documents set
document.domain differently to become cross-origin, it was possible for
them to call arbitrary DOM methods/getters/setters on the now-cross-
origin window.
- CVE-2019-11763 (insufficient validation)
An issue has been found in Firefox before 70.0 and Thunderbird before
68.2, where failure to correctly handle null bytes when processing HTML
entities resulted in incorrectly parsing these entities. This could
have led to HTML comment text being treated as HTML which could have
led to XSS in a web application under certain conditions. It could have
also led to HTML entities being masked from filters, enabling the use
of entities to mask the actual characters of interest from filters.
- CVE-2019-11764 (arbitrary code execution)
Several memory safety bugs have been found in Firefox before 70.0 and
Thunderbird before 68.2. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could be exploited to run arbitrary code.
- CVE-2019-15903 (denial of service)
A security issue has been found in libexpat before 2.2.8, where crafted
XML input could fool the parser into changing from DTD parsing to
document parsing too early; a consecutive call to
XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted
in a heap-based buffer over-read
Impact
======
A remote attacker could crash Thunderbird, bypass security measures or
execute arbitrary code.
References
==========
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11757
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11757
https://bugzilla.mozilla.org/show_bug.cgi?id=1577107
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11759
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11759
https://bugzilla.mozilla.org/show_bug.cgi?id=1577953
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11760
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11760
https://bugzilla.mozilla.org/show_bug.cgi?id=1577719
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11761
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11761
https://bugzilla.mozilla.org/show_bug.cgi?id=1561502
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11762
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11762
https://bugzilla.mozilla.org/show_bug.cgi?id=1582857
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11763
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11763
https://bugzilla.mozilla.org/show_bug.cgi?id=1584216
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11764
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11764
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1558522%2C1577061%2C1548044%2C1571223%2C1573048%2C1578933%2C1575217%2C1583684%2C1586845%2C1581950%2C1583463%2C1586599
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html
https://crbug.com/1004341
https://github.com/libexpat/libexpat/issues/317
https://github.com/libexpat/libexpat/pull/318
https://security.archlinux.org/CVE-2019-11757
https://security.archlinux.org/CVE-2019-11759
https://security.archlinux.org/CVE-2019-11760
https://security.archlinux.org/CVE-2019-11761
https://security.archlinux.org/CVE-2019-11762
https://security.archlinux.org/CVE-2019-11763
https://security.archlinux.org/CVE-2019-11764
https://security.archlinux.org/CVE-2019-15903
ASA-201910-16: firefox: multiple issues
Arch Linux Security Advisory ASA-201910-16
==========================================
Severity: Critical
Date : 2019-10-26
CVE-ID : CVE-2018-6156 CVE-2019-11757 CVE-2019-11759 CVE-2019-11760
CVE-2019-11761 CVE-2019-11762 CVE-2019-11763 CVE-2019-11764
CVE-2019-11765 CVE-2019-15903 CVE-2019-17000 CVE-2019-17001
CVE-2019-17002
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1055
Summary
=======
The package firefox before version 70.0-1 is vulnerable to multiple
issues including arbitrary code execution, access restriction bypass,
denial of service, insufficient validation and same-origin policy
bypass.
Resolution
==========
Upgrade to 70.0-1.
# pacman -Syu "firefox>=70.0-1"
The problems have been fixed upstream in version 70.0.
Workaround
==========
None.
Description
===========
- CVE-2018-6156 (arbitrary code execution)
A heap-based buffer overflow has been found in Firefox before 70.0,
where an incorrect derivation of a packet length in WebRTC caused heap
corruption via a crafted video file.
- CVE-2019-11757 (arbitrary code execution)
A use-after-free issue has been found in the IndexedDB component of
Firefox before 70.0 and Thunderbird before 68.2. When storing a value
in IndexedDB, the value's prototype chain is followed and it was
possible to retain a reference to a locale, delete it, and subsequently
reference it.
- CVE-2019-11759 (arbitrary code execution)
A stack-based buffer overflow has been found in the HKDF output of
Firefox before 70.0 and Thunderbird before 68.2. An attacker could have
caused 4 bytes of HMAC output to be written past the end of a buffer
stored on the stack.
- CVE-2019-11760 (arbitrary code execution)
A fixed-size stack buffer overflow has been found in nrappkit, in the
WebRTC signaling code of Firefox before 70.0 and Thunderbird before
68.2.
- CVE-2019-11761 (access restriction bypass)
An issue has been found in Firefox before 70.0 and Thunderbird before
68.2, where by using a form with a data URI it was possible to gain
access to the privileged JSONView object that had been cloned into
content. Impact from exposing this object appears to be minimal,
however it was a bypass of existing defense in depth mechanisms.
- CVE-2019-11762 (same-origin policy bypass)
A same-origin policy bypass has been found in Firefox before 70.0 and
Thunderbird before 68.2 where, if two same-origin documents set
document.domain differently to become cross-origin, it was possible for
them to call arbitrary DOM methods/getters/setters on the now-cross-
origin window.
- CVE-2019-11763 (insufficient validation)
An issue has been found in Firefox before 70.0 and Thunderbird before
68.2, where failure to correctly handle null bytes when processing HTML
entities resulted in incorrectly parsing these entities. This could
have led to HTML comment text being treated as HTML which could have
led to XSS in a web application under certain conditions. It could have
also led to HTML entities being masked from filters, enabling the use
of entities to mask the actual characters of interest from filters.
- CVE-2019-11764 (arbitrary code execution)
Several memory safety bugs have been found in Firefox before 70.0 and
Thunderbird before 68.2. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could be exploited to run arbitrary code.
- CVE-2019-11765 (insufficient validation)
Incorrect permissions could be granted to a website in Firefox before
70.0. A compromised content process could send a message to the parent
process that would cause the 'Click to Play' permission prompt to be
shown. However, due to lack of validation from the parent process, if
the user accepted the permission request an attacker-controlled
permission would be granted rather than the 'Click to Play' permission.
- CVE-2019-15903 (denial of service)
A security issue has been found in libexpat before 2.2.8, where crafted
XML input could fool the parser into changing from DTD parsing to
document parsing too early; a consecutive call to
XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted
in a heap-based buffer over-read
- CVE-2019-17000 (access restriction bypass)
A CSP bypass has been found in Firefox 69, where an object tag with a
data URI did not correctly inherit the document's Content Security
Policy. This allowed a CSP bypass in a cross-origin frame if the
document's policy explicitly allowed data: URIs.
- CVE-2019-17001 (access restriction bypass)
A CSP bypass has been found in Firefox 69, where a Content-Security-
Policy that blocks in-line scripts could be bypassed using an object
tag to execute JavaScript in the protected document (cross-site
scripting). This is a separate bypass from CVE-2019-17000.
- CVE-2019-17002 (access restriction bypass)
An issue has been found in Firefox before 70.0 where, if upgrade-
insecure-requests was specified in the Content Security Policy, and a
link was dragged and dropped from that page, the link was not upgraded
to https.
Impact
======
A remote attacker can crash Firefox, bypass security measures or
execute arbitrary code.
References
==========
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2018-6156
https://bugzilla.mozilla.org/show_bug.cgi?id=1480088
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11757
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11757
https://bugzilla.mozilla.org/show_bug.cgi?id=1577107
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11759
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11759
https://bugzilla.mozilla.org/show_bug.cgi?id=1577953
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11760
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11760
https://bugzilla.mozilla.org/show_bug.cgi?id=1577719
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11761
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11761
https://bugzilla.mozilla.org/show_bug.cgi?id=1561502
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11762
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11762
https://bugzilla.mozilla.org/show_bug.cgi?id=1582857
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11763
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11763
https://bugzilla.mozilla.org/show_bug.cgi?id=1584216
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11764
https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11764
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1558522%2C1577061%2C1548044%2C1571223%2C1573048%2C1578933%2C1575217%2C1583684%2C1586845%2C1581950%2C1583463%2C1586599
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11765
https://bugzilla.mozilla.org/show_bug.cgi?id=1562582
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html
https://crbug.com/1004341
https://github.com/libexpat/libexpat/issues/317
https://github.com/libexpat/libexpat/pull/318
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-17000
https://bugzilla.mozilla.org/show_bug.cgi?id=1441468
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-17001
https://bugzilla.mozilla.org/show_bug.cgi?id=1587976
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-17002
https://bugzilla.mozilla.org/show_bug.cgi?id=1561056
https://security.archlinux.org/CVE-2018-6156
https://security.archlinux.org/CVE-2019-11757
https://security.archlinux.org/CVE-2019-11759
https://security.archlinux.org/CVE-2019-11760
https://security.archlinux.org/CVE-2019-11761
https://security.archlinux.org/CVE-2019-11762
https://security.archlinux.org/CVE-2019-11763
https://security.archlinux.org/CVE-2019-11764
https://security.archlinux.org/CVE-2019-11765
https://security.archlinux.org/CVE-2019-15903
https://security.archlinux.org/CVE-2019-17000
https://security.archlinux.org/CVE-2019-17001
https://security.archlinux.org/CVE-2019-17002
ASA-201910-17: chromium: multiple issues
Arch Linux Security Advisory ASA-201910-17
==========================================
Severity: High
Date : 2019-10-26
CVE-ID : CVE-2019-13699 CVE-2019-13700 CVE-2019-13701 CVE-2019-13702
CVE-2019-13703 CVE-2019-13704 CVE-2019-13705 CVE-2019-13706
CVE-2019-13707 CVE-2019-13708 CVE-2019-13709 CVE-2019-13710
CVE-2019-13711 CVE-2019-13713 CVE-2019-13714 CVE-2019-13715
CVE-2019-13716 CVE-2019-13717 CVE-2019-13718 CVE-2019-13719
CVE-2019-15903
Package : chromium
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1053
Summary
=======
The package chromium before version 78.0.3904.70-1 is vulnerable to
multiple issues including arbitrary code execution, content spoofing,
access restriction bypass, authentication bypass, denial of service,
information disclosure, privilege escalation and cross-site scripting.
Resolution
==========
Upgrade to 78.0.3904.70-1.
# pacman -Syu "chromium>=78.0.3904.70-1"
The problems have been fixed upstream in version 78.0.3904.70.
Workaround
==========
None.
Description
===========
- CVE-2019-13699 (arbitrary code execution)
A use-after-free issue has been found in the media component of
chromium before 78.0.3904.70.
- CVE-2019-13700 (arbitrary code execution)
A buffer overrun issue has been found in the Blink component of
chromium before 78.0.3904.70.
- CVE-2019-13701 (content spoofing)
A URL spoofing issue has been found in chromium before 78.0.3904.70.
- CVE-2019-13702 (privilege escalation)
A privilege escalation issue has been found in chromium before
78.0.3904.70.
- CVE-2019-13703 (content spoofing)
A URL bar spoofing issue has been found in chromium before
78.0.3904.70.
- CVE-2019-13704 (access restriction bypass)
A CSP bypass has been found in chromium before 78.0.3904.70.
- CVE-2019-13705 (access restriction bypass)
An extension permission bypass has been found in chromium before
78.0.3904.70.
- CVE-2019-13706 (information disclosure)
An out-of-bounds read has been found in the PDFium component of
chromium before 78.0.3904.70.
- CVE-2019-13707 (information disclosure)
A file storage disclosure issue has been found in chromium before
78.0.3904.70.
- CVE-2019-13708 (authentication bypass)
A security issue has been found in chromium before 78.0.3904.70 where
HTTP authentication could be spoofed.
- CVE-2019-13709 (access restriction bypass)
A security issue has been found in chromium before 78.0.3904.70 where
the file download protection could be bypassed.
- CVE-2019-13710 (access restriction bypass)
A security issue has been found in chromium before 78.0.3904.70 where
the file download protection could be bypassed.
- CVE-2019-13711 (information disclosure)
A cross-context information leak has been found in chromium before
78.0.3904.70.
- CVE-2019-13713 (information disclosure)
A cross-origin data leak has been found in chromium before
78.0.3904.70.
- CVE-2019-13714 (cross-site scripting)
A CSS injection has been found in chromium before 78.0.3904.70.
- CVE-2019-13715 (content spoofing)
A security issue has been found in chromium before 78.0.3904.70 where
the content of the address bar could be spoofed.
- CVE-2019-13716 (denial of service)
A security issue has been found in chromium before 78.0.3904.70 where a
service worker could end up in an invalid state.
- CVE-2019-13717 (content spoofing)
A security issue has been found in chromium before 78.0.3904.70 where
notifications could be obscured.
- CVE-2019-13718 (content spoofing)
A security issue has been found in chromium before 78.0.3904.70 where
IDNs could be spoofed.
- CVE-2019-13719 (content spoofing)
A security issue has been found in chromium before 78.0.3904.70 where
notifications could be obscured.
- CVE-2019-15903 (denial of service)
A security issue has been found in libexpat before 2.2.8, where crafted
XML input could fool the parser into changing from DTD parsing to
document parsing too early; a consecutive call to
XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted
in a heap-based buffer over-read
Impact
======
A remote attacker can crash chromium, spoof various parts of the user
interface, bypass security measures, access sensitive information,
elevate privileges or execute arbitrary code.
References
==========
https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_22.html
https://crbug.com/1001503
https://crbug.com/998431
https://crbug.com/998284
https://crbug.com/991125
https://crbug.com/992838
https://crbug.com/1001283
https://crbug.com/989078
https://crbug.com/1001159
https://crbug.com/859349
https://crbug.com/931894
https://crbug.com/1005218
https://crbug.com/756825
https://crbug.com/986063
https://crbug.com/993288
https://crbug.com/982812
https://crbug.com/760855
https://crbug.com/1005948
https://crbug.com/839239
https://crbug.com/866162
https://crbug.com/927150
https://crbug.com/1004341
https://github.com/libexpat/libexpat/issues/317
https://github.com/libexpat/libexpat/pull/318
https://security.archlinux.org/CVE-2019-13699
https://security.archlinux.org/CVE-2019-13700
https://security.archlinux.org/CVE-2019-13701
https://security.archlinux.org/CVE-2019-13702
https://security.archlinux.org/CVE-2019-13703
https://security.archlinux.org/CVE-2019-13704
https://security.archlinux.org/CVE-2019-13705
https://security.archlinux.org/CVE-2019-13706
https://security.archlinux.org/CVE-2019-13707
https://security.archlinux.org/CVE-2019-13708
https://security.archlinux.org/CVE-2019-13709
https://security.archlinux.org/CVE-2019-13710
https://security.archlinux.org/CVE-2019-13711
https://security.archlinux.org/CVE-2019-13713
https://security.archlinux.org/CVE-2019-13714
https://security.archlinux.org/CVE-2019-13715
https://security.archlinux.org/CVE-2019-13716
https://security.archlinux.org/CVE-2019-13717
https://security.archlinux.org/CVE-2019-13718
https://security.archlinux.org/CVE-2019-13719
https://security.archlinux.org/CVE-2019-15903
