The following security updates has been released for Arch Linux:

ASA-201910-10: xpdf: arbitrary code execution
ASA-201910-11: go-pie: denial of service
ASA-201910-12: go: denial of service
ASA-201910-13: pacman: arbitrary command execution

ASA-201910-10: xpdf: arbitrary code execution

Arch Linux Security Advisory ASA-201910-10
==========================================

Severity: Medium
Date : 2019-10-16
CVE-ID : CVE-2019-16927
Package : xpdf
Type : arbitrary code execution
Remote : No
Link : https://security.archlinux.org/AVG-1048

Summary
=======

The package xpdf before version 4.02-1 is vulnerable to arbitrary code
execution.

Resolution
==========

Upgrade to 4.02-1.

# pacman -Syu "xpdf>=4.02-1"

The problem has been fixed upstream in version 4.02.

Workaround
==========

None.

Description
===========

Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the
TextPage::findGaps function in TextOutputDev.cc, a different
vulnerability than CVE-2019-9877.

Impact
======

A local attacker is able to execute arbitrary code via a specially
crafted PDF document.

References
==========

https://bugs.archlinux.org/task/63980
https://forum.xpdfreader.com/viewtopic.php?f=3&t=41885
https://security.archlinux.org/CVE-2019-16927

ASA-201910-11: go-pie: denial of service

Arch Linux Security Advisory ASA-201910-11
==========================================

Severity: Medium
Date : 2019-10-21
CVE-ID : CVE-2019-17596
Package : go-pie
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-1051

Summary
=======

The package go-pie before version 2:1.13.3-1 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 2:1.13.3-1.

# pacman -Syu "go-pie>=2:1.13.3-1"

The problem has been fixed upstream in version 1.13.3.

Workaround
==========

None.

Description
===========

Invalid DSA public keys can cause a panic in dsa.Verify. In particular,
using crypto/x509.Verify on a crafted X.509 certificate chain can lead
to a panic, even if the certificates don’t chain to a trusted root. The
chain can be delivered via a crypto/tls connection to a client, or to a
server that accepts and verifies client certificates. net/http clients
can be made to crash by an HTTPS server, while net/http servers that
accept client certificates will recover the panic and are unaffected.

Moreover, an application might crash invoking
crypto/x509.(*CertificateRequest) CheckSignature on an X.509
certificate request, parsing a golang.org/x/crypto/openpgp Entity, or
during a golang.org/x/crypto/otr conversation. Finally, a
golang.org/x/crypto/ssh client can panic due to a malformed host key,
while a server could panic if either PublicKeyCallback accepts a
malformed public key, or if IsUserAuthority accepts a certificate with
a malformed public key.

Impact
======

A remote attacker can perform a denial of service attack by crafting a
malicious certificate chain.

References
==========

https://github.com/golang/go/issues/34960
https://security.archlinux.org/CVE-2019-17596

ASA-201910-12: go: denial of service

Arch Linux Security Advisory ASA-201910-12
==========================================

Severity: Medium
Date : 2019-10-21
CVE-ID : CVE-2019-17596
Package : go
Type : denial of service
Remote : Yes
Link : https://security.archlinux.org/AVG-1051

Summary
=======

The package go before version 2:1.13.3-1 is vulnerable to denial of
service.

Resolution
==========

Upgrade to 2:1.13.3-1.

# pacman -Syu "go>=2:1.13.3-1"

The problem has been fixed upstream in version 1.13.3.

Workaround
==========

None.

Description
===========

Invalid DSA public keys can cause a panic in dsa.Verify. In particular,
using crypto/x509.Verify on a crafted X.509 certificate chain can lead
to a panic, even if the certificates don’t chain to a trusted root. The
chain can be delivered via a crypto/tls connection to a client, or to a
server that accepts and verifies client certificates. net/http clients
can be made to crash by an HTTPS server, while net/http servers that
accept client certificates will recover the panic and are unaffected.

Moreover, an application might crash invoking
crypto/x509.(*CertificateRequest) CheckSignature on an X.509
certificate request, parsing a golang.org/x/crypto/openpgp Entity, or
during a golang.org/x/crypto/otr conversation. Finally, a
golang.org/x/crypto/ssh client can panic due to a malformed host key,
while a server could panic if either PublicKeyCallback accepts a
malformed public key, or if IsUserAuthority accepts a certificate with
a malformed public key.

Impact
======

A remote attacker can perform a denial of service attack by crafting a
malicious certificate chain.

References
==========

https://github.com/golang/go/issues/34960
https://security.archlinux.org/CVE-2019-17596

ASA-201910-13: pacman: arbitrary command execution

Arch Linux Security Advisory ASA-201910-13
==========================================

Severity: High
Date : 2019-10-23
CVE-ID : CVE-2019-18182 CVE-2019-18183
Package : pacman
Type : arbitrary command execution
Remote : Yes
Link : https://security.archlinux.org/AVG-1049

Summary
=======

The package pacman before version 5.2.0-1 is vulnerable to arbitrary
command execution.

Resolution
==========

Upgrade to 5.2.0-1.

# pacman -Syu "pacman>=5.2.0-1"

The problems have been fixed upstream in version 5.2.0.

Workaround
==========

For CVE-2019-18182:
Ensure `XferCommand` is commented out in `/etc/pacman.conf`

For CVE-2019-18183:
Ensure `UseDelta` is commented out in `/etc/pacman.conf`

Description
===========

- CVE-2019-18182 (arbitrary command execution)

pacman before 5.2 is vulnerable to arbitrary command injection in
src/pacman/conf.c in the download_with_xfercommand() function. This can
be exploited when unsigned databases are used. To exploit the
vulnerability, the user must enable a non-default XferCommand and
retrieve an attacker-controlled crafted database and package.

- CVE-2019-18183 (arbitrary command execution)

pacman before 5.2 is vulnerable to arbitrary command injection in
lib/libalpm/sync.c in the apply_deltas() function. This can be
exploited when unsigned databases are used. To exploit the
vulnerability, the user must enable the non-default delta feature and
retrieve an attacker-controlled crafted database and delta file.

Impact
======

A remote attacker is able to execute arbitrary commands on the host
with a specially crafted database and a package or delta file.

References
==========

https://git.archlinux.org/pacman.git/tree/src/pacman/conf.c?h=v5.1.3#n263
https://git.archlinux.org/pacman.git/commit/?id=808a4f15ce82d2ed7eeb06de73d0f313620558ee
https://git.archlinux.org/pacman.git/tree/lib/libalpm/sync.c?h=v5.1.3#n767
https://git.archlinux.org/pacman.git/commit/?id=c0e9be7973be6c81b22fde91516fb8991e7bb07b
https://security.archlinux.org/CVE-2019-18182
https://security.archlinux.org/CVE-2019-18183