Important information about recent security updates in BLFS

Good evening everyone,

I wanted to write up a email about some of the recent security updates 
that have gone into BLFS. The last time I wrote one of these was on 
October 9th, and that was spurred by the issues with CUPS, PHP, Qt6, 
xdg-desktop-portal, Thunderbird, Firefox, and WebKitGTK.

This time I'm writing this email primarily about WebKitGTK. I just 
pushed an update to the book which fixes two critical security 
vulnerabilities which have numerous reports of being exploited on 
machines, most of the time silently. One of these issues allows for 
remote code execution when processing malicious web content, while the 
other one allows for cross site scripting attacks. They were both fixed 
with improved checks and state management, and if you have WebKitGTK 
installed on your system, you need to update to 2.46.4 immediately. At 
the same time that you update WebKitGTK, you should also update Epiphany 
to 46.4 or later to fix issues with keyboard event handling.

In addition, we've had some additional vulnerability fixes in the 
following packages which are very important to fix:

- QtWebEngine had three security vulnerabilities fixed which could allow 
for remote code execution. These three were rated as High by NVD, and 
the issues occur in Skia, V8, and Dawn. Skia is used for text rendering, 
while V8 is used as the JavaScript engine, and Dawn is the 
implementation of WebGPU in Chromium. Because of the issues in V8 and 
Skia in particular, you should update to QtWebEngine-6.8.0.

- Spidermonkey had a security vulnerability fixed that could allow for 
memory corruption due to the JavaScript garbage collector miscoloring 
cross-compartment objects if an Out Of Memory condition was detected at 
the right point between two passes of the garbage collector. When 
updating Spidermonkey, there are two approaches that you can use. If you 
want to stay on Spidermonkey-115 (and not update gjs), you can update to 
Spidermonkey-115.16.1esr. However, if you want to move to the 128.x.x 
track so that you're aligned with Firefox in development BLFS, you 
should update to 128.5.1esr and then also update gjs to 1.82.0 or later.

- Wireshark has had a few security fixes, but they only apply to folks 
who use certain protocols. If you're capturing AppleTalk, RELOAD, ITS, 
FiveCo RAP, or ECMP packets, you should update to Wireshark-4.4.2.

- Xorg-server and Xwayland had a security vulnerability fixed that could 
allow for remote code execution (if the server is run over VNC or SSH X 
Forwarding), or for a denial of service (if the exploit is run locally). 
The issue is a heap buffer overflow in the _XkbSetCompatMap function, 
and it occurs because the function resizes the sym_interpret buffer 
incorrectly. It can be triggered by providing a modified bitmap to the 
server, so we recommended that you update to xorg-server-21.1.14 and 
Xwayland-24.1.4.

- mpg123 had a security vulnerability fixed that could allow for a 
denial of service or arbitrary code execution when decoding streams 
where output properties are changed, together with misusing libmpg123. 
The vulnerability can be exploited when concatenating several MP3 files 
together with varying formats. The issue has been named "Frankenstein's 
Monster", and updating to mpg123-1.32.8 is recommended if you are going 
to be playing (or modifying) MP3 files.

- libarchive had some security vulnerabilities fixed that could allow 
for crashes when processing crafted GZIP or TAR files. If you notice 
crashes when opening some GZIP or TAR files in a program that uses 
libarchive, you should update to libarchive-3.7.7.

- fetchmail had a security vulnerability fixed that could allow for a 
user to read another user's passwords due to insufficient permissions on 
a user's .netrc file. Upstream fixed this by not allowing .netrc to have 
any more than 0700 permissions if it contains passwords. Updating to 
fetchmail-6.5.0 will provide you with a warning if the permissions are 
too open, and will refuse to open the file until you've fixed it.

- OpenJDK had five security vulnerabilities fixed which could allow for 
a remote attacker to cause an application crash or potentially 
write/delete/access information on a system while running a Java 
application. They were found in the Hotspot, Networking, Compiler, and 
Serialization components, but they have been described as hard to 
exploit. Upstream rated most of these as low, but one was rated medium. 
If you are impacted, you should update to OpenJDK/Java 23.0.1.

- Fop had a security vulnerability fixed that could allow for a remote 
attacker to execute arbitrary code on a system while processing a 
crafted FO file. It occurs due to a XML External Entity Attack, and 
could happen without any user knowledge, and the attack complexity is 
low. If you have fop installed and use it for anything other than 
rendering PDFs of the LFS book, you should update to fop-2.10 immediately.

- cURL had a security vulnerability fixed that could allow for a minor 
denial of service problem that happens when trying to use HTTPS when an 
invalid response is returned by the server, which then could also result 
in cleartext transmission of data that was otherwise intended to be 
protected. It happens due to a comparison using incorrect factors, and 
can occur when the expiry time for a subdomain overwrites a parent 
domain's cache entry, making it end sooner (or later) than what was 
originally intended. The vulnerability has been rated as Low and is very 
difficult to exploit, but it still might be worth updating to cURL-8.11.0.

- wget had a security vulnerability fixed that could allow for 
server-side request forgery, phishing, data leakage, and 
man-in-the-middle attacks when using FTP URLs. It happens when a 
semicolon is used in a FTP URL (which allows for skipping credentials). 
The vulnerability is very difficult to exploit, but it has been rated as 
High by upstream due to the variety of attacks which could occur, so 
it's recommended that you update to wget-1.25.0 if you're using wget to 
download files over FTP. Note that shorthand FTP URLs will no longer be 
accepted when you update.

- Expat had a security vulnerability fixed which could allow for crashes 
when using the XML_ResumeParser function. It was fixed by not allowing 
XML_StopParser to stop or suspend a parser that was not started yet. You 
can tell if an exploitation was attempted based on whether an 
application crashes with an XML_ERROR_NOT_STARTED error. You should 
update to expat-2.6.4 if you notice crashes, but if you have 
docbook-utils installed you will need to add --without-docbook to the 
configure line.

- glib2 had a critical security vulnerability fixed that could allow for 
a buffer overflow when using the SOCKS4 proxy support in glib. If you 
don't use the SOCKS4 proxy support, you don't need to update, but if you 
do use it you should update due to the risk of remote code execution. If 
you do use SOCKS4 support, update to glib-2.82.1 or later.

- PostgreSQL had four security vulnerabilities fixed that could allow 
for users to complete unauthorized reads and modifications of data in a 
database, man-in-the-middle attackers to send fabricated error messages, 
for the SET ROLE and SET SESSION AUTHORIZATION to commands to assign 
permissions to the wrong user IDs, and for an unauthorized database user 
to change process environment variables to achieve arbitrary code 
execution. A proof of concept exploit exists for the arbitrary code 
execution vulnerability, but it requires the PL/Perl functionality to be 
enabled to exploit it. The issues were originally fixed in 17.1, but due 
to regressions we recommend that users update to 17.2. If you are on 
older versions of PostgreSQL, you should update to 16.6, 15.10, 14.15, 
13.18, and 12.22.

- PHP had several critical security vulnerabilities fixed that could 
allow for remote code execution when using the CLI interface to SAPI, 
remote code execution on 32-bit systems when using LDAP, unauthorized 
disclosure of MySQL query responses, remote code execution when using 
the Firebird and dblib quoters, CRLF injection when configuring a proxy 
in stream contexts (leading to HTTP request smuggling attacks), and for 
remotely exploitable crashes when using the 
convert.quoted-printable-decode filter in a program. Proof of exploits 
for *all* of these vulnerabilities are out in the wild. If you have a 
program that uses the CLI, LDAP, MySQLnd, PDO Firebird, PDO DBLIB, or 
Streams functionality, you need to update to PHP-8.4.1 immediately. If 
you want to stay on PHP 8.3, you should go to PHP 8.3.14.

- libsoup3 had three security vulnerabilities fixed that could allow for 
HTTP request smuggling, arbitrary code execution, and remotely 
exploitable crashes (due to running a system out of memory). The HTTP 
Request Smuggling vulnerability occurs because '\0' characters at the 
end of header names are ignored in some configurations, while the 
arbitrary code execution vulnerability occurs in applications that 
perform conversion to UTF-8 in soup_header_parse_param_list_strict. Note 
that input over the network cannot trigger the arbitrary code execution 
vulnerability. The infinite loop that causes out-of-memory errors 
happens when reading certain patterns of WebSocket data from clients.

- Firefox has had 16 security vulnerabilities fixed since the last 
email. These can cause website spoofing, content security policy 
bypasses, cross site scripting, URL bar spoofing, remotely exploitable 
crashes, improper keypress handling, remote code execution, permissions 
leaks, user confusion, origin spoofing, video frame leaks, and clipboard 
spoofing. If you use Firefox, we highly suggest updating to 128.5.1esr 
(128.5.0esr has a regression that causes websites to not load if using 
the SSL inspector).

- Thunderbird has the same security fixes, with one extra - a 
vulnerability was fixed in 128.4.3esr that could allow for messages 
encrypted with OpenPGP to be sent in plain text. You should also update 
to Thunderbird-128.5.0esr.

- libjxl had two security vulnerabilities fixed that could allow for 
arbitrary code execution or running the system out of memory. Both of 
the issues can be triggered by opening/loading a malicious JXL image, 
but the arbitrary code execution issue can also occur when calling 
JxlEncoderAddJPEGFrame to encode a frame in a JXL file. Updating to 
libjxl-0.11.1 is recommended.

For more information, please visit 
https://linuxfromscratch.org/blfs/advisories/consolidated.html and 
https://linuxfromscratch.org/blfs/advisories/12.2.html.

Thank you,

- Doug

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page