Remi Gacogne has announced the following security updates for Arch Linux:

ASA-201908-2: python-django: multiple issues
ASA-201908-3: python2-django: multiple issues
ASA-201908-4: exim: arbitrary code execution
ASA-201908-5: sdl2: arbitrary code execution

ASA-201908-2: python-django: multiple issues

Arch Linux Security Advisory ASA-201908-2
=========================================

Severity: Medium
Date : 2019-08-05
CVE-ID : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235
Package : python-django
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1015

Summary
=======

The package python-django before version 2.2.4-1 is vulnerable to
multiple issues including denial of service and sql injection.

Resolution
==========

Upgrade to 2.2.4-1.

# pacman -Syu "python-django>=2.2.4-1"

The problems have been fixed upstream in version 2.2.4.

Workaround
==========

None.

Description
===========

- CVE-2019-14232 (denial of service)

If ``django.utils.text.Truncator``'s ``chars()`` and ``words()``
methods were passed the ``html=True`` argument, they were extremely
slow to evaluate certain inputs due to a catastrophic backtracking
vulnerability in a regular expression. The ``chars()`` and ``words()``
methods are used to implement the ``truncatechars_html`` and
``truncatewords_html`` template filters, which were thus vulnerable.
The regular expressions used by ``Truncator`` have been simplified in
order to avoid potential backtracking issues. As a consequence,
trailing punctuation may now at times be included in the truncated
output.

- CVE-2019-14233 (denial of service)

Due to the behavior of the underlying HTMLParser,
django.utils.html.strip_tags() would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML
entities. The strip_tags() method is used to implement the
corresponding striptags template filter, which was thus also
vulnerable. strip_tags() now avoids recursive calls to HTMLParser when
progress removing tags, but necessarily incomplete HTML entities, stops
being made

- CVE-2019-14234 (sql injection)

Key and index lookups for JSONField and key lookups for HStoreField
were subject to SQL injection, using a suitably crafted dictionary,
with dictionary expansion, as the **kwargs passed to QuerySet.filter().

- CVE-2019-14235 (denial of service)

If passed certain inputs, django.utils.encoding.uri_to_iri() could lead
to significant memory usage due to excessive recursion when re-percent
encoding invalid UTF-8 octet sequences.

Impact
======

A remote attacker can cause a denial of service via crafted content, or
alter the database via a SQL injection.

References
==========

https://docs.djangoproject.com/en/dev/releases/1.11.23/
https://github.com/django/django/commit/7f65974f8219729c047fbbf8cd5cc9d80faefe77
https://github.com/django/django/commit/4b78420d250df5e21763633871e486ee76728cc4
https://github.com/django/django/commit/7deeabc7c7526786df6894429ce89a9c4b614086
https://github.com/django/django/commit/76ed1c49f804d409cfc2911a890c78584db3c76e
https://security.archlinux.org/CVE-2019-14232
https://security.archlinux.org/CVE-2019-14233
https://security.archlinux.org/CVE-2019-14234
https://security.archlinux.org/CVE-2019-14235

ASA-201908-3: python2-django: multiple issues

Arch Linux Security Advisory ASA-201908-3
=========================================

Severity: Medium
Date : 2019-08-05
CVE-ID : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235
Package : python2-django
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1014

Summary
=======

The package python2-django before version 1.11.23-1 is vulnerable to
multiple issues including denial of service and sql injection.

Resolution
==========

Upgrade to 1.11.23-1.

# pacman -Syu "python2-django>=1.11.23-1"

The problems have been fixed upstream in version 1.11.23.

Workaround
==========

None.

Description
===========

- CVE-2019-14232 (denial of service)

If ``django.utils.text.Truncator``'s ``chars()`` and ``words()``
methods were passed the ``html=True`` argument, they were extremely
slow to evaluate certain inputs due to a catastrophic backtracking
vulnerability in a regular expression. The ``chars()`` and ``words()``
methods are used to implement the ``truncatechars_html`` and
``truncatewords_html`` template filters, which were thus vulnerable.
The regular expressions used by ``Truncator`` have been simplified in
order to avoid potential backtracking issues. As a consequence,
trailing punctuation may now at times be included in the truncated
output.

- CVE-2019-14233 (denial of service)

Due to the behavior of the underlying HTMLParser,
django.utils.html.strip_tags() would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML
entities. The strip_tags() method is used to implement the
corresponding striptags template filter, which was thus also
vulnerable. strip_tags() now avoids recursive calls to HTMLParser when
progress removing tags, but necessarily incomplete HTML entities, stops
being made

- CVE-2019-14234 (sql injection)

Key and index lookups for JSONField and key lookups for HStoreField
were subject to SQL injection, using a suitably crafted dictionary,
with dictionary expansion, as the **kwargs passed to QuerySet.filter().

- CVE-2019-14235 (denial of service)

If passed certain inputs, django.utils.encoding.uri_to_iri() could lead
to significant memory usage due to excessive recursion when re-percent
encoding invalid UTF-8 octet sequences.

Impact
======

A remote attacker can cause a denial of service via crafted content, or
alter the database via a SQL injection.

References
==========

https://docs.djangoproject.com/en/dev/releases/1.11.23/
https://github.com/django/django/commit/7f65974f8219729c047fbbf8cd5cc9d80faefe77
https://github.com/django/django/commit/4b78420d250df5e21763633871e486ee76728cc4
https://github.com/django/django/commit/7deeabc7c7526786df6894429ce89a9c4b614086
https://github.com/django/django/commit/76ed1c49f804d409cfc2911a890c78584db3c76e
https://security.archlinux.org/CVE-2019-14232
https://security.archlinux.org/CVE-2019-14233
https://security.archlinux.org/CVE-2019-14234
https://security.archlinux.org/CVE-2019-14235

ASA-201908-4: exim: arbitrary code execution

Arch Linux Security Advisory ASA-201908-4
=========================================

Severity: Critical
Date : 2019-08-05
CVE-ID : CVE-2019-13917
Package : exim
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-1011

Summary
=======

The package exim before version 4.92.1-1 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 4.92.1-1.

# pacman -Syu "exim>=4.92.1-1"

The problem has been fixed upstream in version 4.92.1.

Workaround
==========

None.

Description
===========

Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution
as root in some unusual configurations that use the ${sort } expansion
for items that can be controlled by an attacker (e.g., $local_part or
$domain).

Impact
======

A remote attacker can, in some unusual configurations, execute
arbitrary code via a crafted e-mail.

References
==========

https://seclists.org/oss-sec/2019/q3/63
https://lists.exim.org/lurker/message/20190725.090419.d506f736.en.html
https://security.archlinux.org/CVE-2019-13917

ASA-201908-5: sdl2: arbitrary code execution

Arch Linux Security Advisory ASA-201908-5
=========================================

Severity: High
Date : 2019-08-05
CVE-ID : CVE-2019-7572 CVE-2019-7573 CVE-2019-7574 CVE-2019-7575
CVE-2019-7576 CVE-2019-7577 CVE-2019-7578 CVE-2019-7635
CVE-2019-7636 CVE-2019-7638
Package : sdl2
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-891

Summary
=======

The package sdl2 before version 2.0.10-1 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 2.0.10-1.

# pacman -Syu "sdl2>=2.0.10-1"

The problems have been fixed upstream in version 2.0.10.

Workaround
==========

None.

Description
===========

- CVE-2019-7572 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.

- CVE-2019-7573 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c
(inside the wNumCoef loop).

- CVE-2019-7574 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c.

- CVE-2019-7575 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.

- CVE-2019-7576 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c
(outside the wNumCoef loop).

- CVE-2019-7577 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c.

- CVE-2019-7578 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a heap-based buffer over-read in InitIMA_ADPCM in audio/SDL_wave.c.

- CVE-2019-7635 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c.

- CVE-2019-7636 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c.

- CVE-2019-7638 (arbitrary code execution)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has
a heap-based buffer over-read in Map1toN in video/SDL_pixels.c.

Impact
======

An attacker can execute arbitrary code on the affected host via a
crafted audio or video file.

References
==========

https://bugzilla.libsdl.org/show_bug.cgi?id=4495
https://discourse.libsdl.org/t/vulnerabilities-found-in-libsdl-1-2-15-and-sdl2/25720
https://hg.libsdl.org/SDL/rev/e52413f52586
https://hg.libsdl.org/SDL/rev/a8afedbcaea0
https://bugzilla.libsdl.org/show_bug.cgi?id=4491
https://hg.libsdl.org/SDL/rev/388987dff7bf
https://hg.libsdl.org/SDL/rev/f9a9d6c76b21
https://bugzilla.libsdl.org/show_bug.cgi?id=4496
https://hg.libsdl.org/SDL/rev/a6e3d2f5183e
https://bugzilla.libsdl.org/show_bug.cgi?id=4493
https://hg.libsdl.org/SDL/rev/a936f9bd3e38
https://bugzilla.libsdl.org/show_bug.cgi?id=4490
https://bugzilla.libsdl.org/show_bug.cgi?id=4492
https://hg.libsdl.org/SDL/rev/faf9abbcfb5f
https://hg.libsdl.org/SDL/rev/416136310b88
https://bugzilla.libsdl.org/show_bug.cgi?id=4494
https://bugzilla.libsdl.org/show_bug.cgi?id=4498
https://hg.libsdl.org/SDL/rev/7c643f1c1887
https://hg.libsdl.org/SDL/rev/f1f5878be5db
https://bugzilla.libsdl.org/show_bug.cgi?id=4499
https://hg.libsdl.org/SDL/rev/19d8c3b9c251
https://hg.libsdl.org/SDL/rev/07c39cbbeacf
https://bugzilla.libsdl.org/show_bug.cgi?id=4500
https://security.archlinux.org/CVE-2019-7572
https://security.archlinux.org/CVE-2019-7573
https://security.archlinux.org/CVE-2019-7574
https://security.archlinux.org/CVE-2019-7575
https://security.archlinux.org/CVE-2019-7576
https://security.archlinux.org/CVE-2019-7577
https://security.archlinux.org/CVE-2019-7578
https://security.archlinux.org/CVE-2019-7635
https://security.archlinux.org/CVE-2019-7636
https://security.archlinux.org/CVE-2019-7638