Chromium and PostgreSQL Updates for Arch Linux
Posted on: 08/12/2019 05:47 PM

Remi Gacogne has announced the following security updates for Arch Linux:

ASA-201908-6: chromium: arbitrary code execution
ASA-201908-7: postgresql-libs: multiple issues
ASA-201908-8: postgresql: multiple issues

ASA-201908-6: chromium: arbitrary code execution
Arch Linux Security Advisory ASA-201908-6
=========================================

Severity: High
Date : 2019-08-10
CVE-ID : CVE-2019-5867 CVE-2019-5868
Package : chromium
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-1018

Summary
=======

The package chromium before version 76.0.3809.100-1 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 76.0.3809.100-1.

# pacman -Syu "chromium>=76.0.3809.100-1"

The problems have been fixed upstream in version 76.0.3809.100.

Workaround
==========

None.

Description
===========

- CVE-2019-5867 (arbitrary code execution)

An out-of-bounds read has been found in the V8 component of the
chromium browser before 76.0.3809.100.

- CVE-2019-5868 (arbitrary code execution)

A use-after-free issue has been found in PDFium's ExecuteFieldAction,
in the chromium browser before 76.0.3809.100.

Impact
======

A remote attacker can execute arbitrary code on the affected host.

References
==========

https://chromereleases.googleblog.com/2019/08/stable-channel-update-for-desktop.html
https://crbug.com/984344
https://crbug.com/983867
https://security.archlinux.org/CVE-2019-5867
https://security.archlinux.org/CVE-2019-5868


ASA-201908-7: postgresql-libs: multiple issues
Arch Linux Security Advisory ASA-201908-7
=========================================

Severity: Medium
Date : 2019-08-10
CVE-ID : CVE-2019-10208 CVE-2019-10209
Package : postgresql-libs
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1019

Summary
=======

The package postgresql-libs before version 11.5-1 is vulnerable to
multiple issues including access restriction bypass and information
disclosure.

Resolution
==========

Upgrade to 11.5-1.

# pacman -Syu "postgresql-libs>=11.5-1"

The problems have been fixed upstream in version 11.5.

Workaround
==========

None.

Description
===========

- CVE-2019-10208 (access restriction bypass)

A security issue has been found in PostgreSQL < 11.5 where given a
suitable SECURITY DEFINER function, an attacker can execute arbitrary
SQL under the identity of the function owner. An attack requires
EXECUTE permission on the function, which must itself contain a
function call having inexact argument type match. For example,
length('foo'::varchar) and length('foo') are inexact, while
length('foo'::text) is exact. As part of exploiting this vulnerability,
the attacker uses CREATE DOMAIN to create a type in a pg_temp schema.
The attack pattern and fix are similar to that for CVE-2007-2138.

- CVE-2019-10209 (information disclosure)

An issue has been found in PostgreSQL >= 11.0 and < 11.5. In a database
containing hypothetical, user-defined hash equality operators, an
attacker could read arbitrary bytes of server memory. For an attack to
become possible, a superuser would need to create unusual operators. It
is possible for operators not purpose-crafted for attack to have the
properties that enable an attack, but we are not aware of specific
examples.

Impact
======

An authenticated attacker can read arbitrary bytes of server memory or
execute arbitrary SQL commands under a different identity than its own.

References
==========

https://www.postgresql.org/about/news/1960/
https://bugzilla.redhat.com/show_bug.cgi?id=1734416
https://bugzilla.redhat.com/show_bug.cgi?id=1734447
https://security.archlinux.org/CVE-2019-10208
https://security.archlinux.org/CVE-2019-10209


ASA-201908-8: postgresql: multiple issues
Arch Linux Security Advisory ASA-201908-8
=========================================

Severity: Medium
Date : 2019-08-10
CVE-ID : CVE-2019-10208 CVE-2019-10209
Package : postgresql
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1019

Summary
=======

The package postgresql before version 11.5-1 is vulnerable to multiple
issues including access restriction bypass and information disclosure.

Resolution
==========

Upgrade to 11.5-1.

# pacman -Syu "postgresql>=11.5-1"

The problems have been fixed upstream in version 11.5.

Workaround
==========

None.

Description
===========

- CVE-2019-10208 (access restriction bypass)

A security issue has been found in PostgreSQL < 11.5 where given a
suitable SECURITY DEFINER function, an attacker can execute arbitrary
SQL under the identity of the function owner. An attack requires
EXECUTE permission on the function, which must itself contain a
function call having inexact argument type match. For example,
length('foo'::varchar) and length('foo') are inexact, while
length('foo'::text) is exact. As part of exploiting this vulnerability,
the attacker uses CREATE DOMAIN to create a type in a pg_temp schema.
The attack pattern and fix are similar to that for CVE-2007-2138.

- CVE-2019-10209 (information disclosure)

An issue has been found in PostgreSQL >= 11.0 and < 11.5. In a database
containing hypothetical, user-defined hash equality operators, an
attacker could read arbitrary bytes of server memory. For an attack to
become possible, a superuser would need to create unusual operators. It
is possible for operators not purpose-crafted for attack to have the
properties that enable an attack, but we are not aware of specific
examples.

Impact
======

An authenticated attacker can read arbitrary bytes of server memory or
execute arbitrary SQL commands under a different identity than its own.

References
==========

https://www.postgresql.org/about/news/1960/
https://bugzilla.redhat.com/show_bug.cgi?id=1734416
https://bugzilla.redhat.com/show_bug.cgi?id=1734447
https://security.archlinux.org/CVE-2019-10208
https://security.archlinux.org/CVE-2019-10209





Printed from Linux Compatible (https://www.linuxcompatible.org/news/story/chromium_and_postgresql_updates_for_arch_linux.html)