Arch Linux 791 Published by

Jelle van der Waa has announced 5 security updates for Arch Linux:

ASA-201902-16: firefox: multiple issues
ASA-201902-17: webkit2gtk: arbitrary code execution
ASA-201902-18: hiawatha: directory traversal
ASA-201902-19: cairo: arbitrary code execution
ASA-201902-20: flatpak: privilege escalation



ASA-201902-16: firefox: multiple issues

Arch Linux Security Advisory ASA-201902-16
==========================================

Severity: High
Date : 2019-02-13
CVE-ID : CVE-2018-18356 CVE-2018-18511 CVE-2019-5785
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-896

Summary
=======

The package firefox before version 65.0.1-1 is vulnerable to multiple
issues including arbitrary code execution and same-origin policy
bypass.

Resolution
==========

Upgrade to 65.0.1-1.

# pacman -Syu "firefox>=65.0.1-1"

The problems have been fixed upstream in version 65.0.1.

Workaround
==========

None.

Description
===========

- CVE-2018-18356 (arbitrary code execution)

A use-after-free has been found in the Skia component of chromium
before 71.0.3578.80 and firefox before 65.0.1.

- CVE-2018-18511 (same-origin policy bypass)

A cross-origin theft of images issue has been found in the
ImageBitmapRenderingContext component of firefox 65.0, where cross-
origin images can be read from a canvas element in violation of the
same-origin policy using the transferFromImageBitmap method. The issue
has been fixed in 65.0.1 and versions prior to 65.0 were not affected.

- CVE-2019-5785 (arbitrary code execution)

An integer overflow issue has been found in the Skia component of
firefox before 65.0.1.

Impact
======

A remote attacker can bypass the same-origin policy to access sensitive
information, or execute arbitrary code, via a crafted web content.

References
==========

https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html
https://bugs.chromium.org/p/chromium/issues/detail?id=883666
https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2018-18356
https://bugzilla.mozilla.org/show_bug.cgi?id=1525817
https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2019-5785
https://bugzilla.mozilla.org/show_bug.cgi?id=1526218
https://bugzilla.mozilla.org/show_bug.cgi?id=1525433
https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexity-confusion.html
https://security.archlinux.org/CVE-2018-18356
https://security.archlinux.org/CVE-2018-18511
https://security.archlinux.org/CVE-2019-5785


ASA-201902-17: webkit2gtk: arbitrary code execution

Arch Linux Security Advisory ASA-201902-17
==========================================

Severity: Critical
Date : 2019-02-15
CVE-ID : CVE-2019-6212 CVE-2019-6215
Package : webkit2gtk
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-899

Summary
=======

The package webkit2gtk before version 2.22.6-1 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 2.22.6-1.

# pacman -Syu "webkit2gtk>=2.22.6-1"

The problems have been fixed upstream in version 2.22.6.

Workaround
==========

None.

Description
===========

- CVE-2019-6212 (arbitrary code execution)

Multiple memory corruption issues have been found in WebKitGTK+ before
2.22.6, where processing maliciously crafted web content may lead to
arbitrary code execution.

- CVE-2019-6215 (arbitrary code execution)

A type confusion issue has been found in WebKitGTK+ before 2.22.6,
where processing maliciously crafted web content may lead to arbitrary
code execution.

Impact
======

A remote attacker can execute arbitrary code via maliciously crafted
web content.

References
==========

https://webkitgtk.org/security/WSA-2019-0001.html
https://webkitgtk.org/security/WSA-2019-0001.html#CVE-2019-6212
https://webkitgtk.org/security/WSA-2019-0001.html#CVE-2019-6215
https://security.archlinux.org/CVE-2019-6212
https://security.archlinux.org/CVE-2019-6215


ASA-201902-18: hiawatha: directory traversal

Arch Linux Security Advisory ASA-201902-18
==========================================

Severity: High
Date : 2019-02-16
CVE-ID : CVE-2019-8358
Package : hiawatha
Type : directory traversal
Remote : Yes
Link : https://security.archlinux.org/AVG-900

Summary
=======

The package hiawatha before version 10.8.4-1 is vulnerable to directory
traversal.

Resolution
==========

Upgrade to 10.8.4-1.

# pacman -Syu "hiawatha>=10.8.4-1"

The problem has been fixed upstream in version 10.8.4.

Workaround
==========

None.

Description
===========

In Hiawatha before 10.8.4 a remote attacker is able to do directory
traversal if AllowDotFiles is enabled.

Impact
======

A remote attacker is able to read arbitrary files from a hiawatha
server.

References
==========

https://www.hiawatha-webserver.org/changelog
https://security.archlinux.org/CVE-2019-8358


ASA-201902-19: cairo: arbitrary code execution

Arch Linux Security Advisory ASA-201902-19
==========================================

Severity: Critical
Date : 2019-02-17
CVE-ID : CVE-2018-19876
Package : cairo
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-826

Summary
=======

The package cairo before version 1.16.0-2 is vulnerable to arbitrary
code execution.

Resolution
==========

Upgrade to 1.16.0-2.

# pacman -Syu "cairo>=1.16.0-2"

The problem has been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

A memory-corruption issue has been found in cairo versions