Important information about recent security updates in LFS and BLFS

Good evening folks,

There's been some pretty significant security fixes recently since the 
last email, so I'd like to bring them to everyone's attention so you can 
patch your systems!

The following packages received security updates recently:

- Python (LFS and BLFS)
- Subversion
- Jinja2 (LFS)
- Thunderbird
- WebKitGTK
- cURL
- Seamonkey
- Spidermonkey
- Firefox
- Libreoffice

Note that both Python and Jinja2 affect LFS as well as BLFS.

In Python, three security vulnerabilities were fixed which could allow 
for unauthorized command execution when spawning a virtual environment, 
for filtering bypasses (because IPv4-mapped IPv6 address properties were 
handled improperly), and for pyrepl to lead local files unexpectedly. 
This update did temporarily cause issues with Firefox and Thunderbird, 
but the issues were resolved in the updates which were released today. 
Unlike most of the vulnerabilities discussed today, only one of them was 
assigned a CVE - CVE-2024-9287. You can find additional information 
about the other two vulnerabilities at their respective upstream bug 
reports - https://github.com/python/cpython/issues/125140 and 
https://github.com/python/cpython/issues/122792. Updating this package 
is recommended if you are building packages or using a virtual 
environment with untrusted Python code, and also if you are experiencing 
filtering bypasses. If you use pyrepl, you should treat this update with 
urgency. With that said, we've rated the severity of this update at 
Medium, and you'll want to update to 3.12.8 (if you're on 3.12.x) or 
3.13.1 if you are tracking the development books.

In Subversion, a security vulnerability was fixed which could allow for 
a denial of service when a revision property is commited to a repository 
that uses special control characters. It's worth noting that this is 
only relevant if you are using the Subversion server, and if you are 
allowing access to your repository over HTTP using the mod_dav_svn 
Apache module. With that said though, if you *are* using this type of 
configuration, you need to treat this update as Critical as committing 
such a control character will require a full dump/load cycle as it will 
cause significant repository corruption. This is a repeat of 
CVE-2013-1968, and has been assigned CVE-2024-46901. There is no need to 
update if you don't use this configuration, but if you do, update to 
Subversion 1.14.5.

In Jinja2 (which is a python module installed in LFS), two security 
vulnerabilities were fixed that could allow for sandbox escapes and 
execution of attacker-controlled Python code. One of the issues happens 
due to an oversight in how Jinja's sandboxed environment detects calls 
to the str.format function, while the other occurs in Jinja2's compiler. 
You should treat this update as High priority, and update to 
Jinja2-3.1.5 as soon as possible.

In Thunderbird, a variety of security vulnerabilities were fixed which 
could allow for client-side path traversal when using the Matrix 
chatroom functionality in the chat client, "confused deputy" attacks via 
the WebChannel API (allowing privilege escalation), a use-after-free 
when breaking lines in text, for ALPN verification failures when using 
Alt-Svc and when the original server is redirecting to an insecure site, 
for compartment mismatches (leading to a use-after-free when parsing a 
JavaScript module as JSON), for memory corruption (when segmenting 
specially crafted text via JavaScript), and for remote code execution. 
If you have Thunderbird installed, you should update to 
Thunderbird-128.6.0esr to protect your system.

In WebKitGTK, four security vulnerabilities were fixed that could allow 
for remotely exploitable crashes and remote code execution. All four of 
them can be exploited via maliciously crafted web content (including 
advertisements on web pages), and they were fixed with improved checks 
and memory handling. If you have WebKitGTK installed, you should update 
to WebKitGTK-2.46.5.

In cURL, a security vulnerability was fixed that could allow for cURL to 
leak the password for hosts to redirected hosts. However, most users are 
unaffected. The only way that you are affected by this vulnerability is 
if you use a .netrc file, and when you're asking cURL to follow HTTP 
redirects. If you are using a .netrc file, you should update to 
cURL-8.11.1, but if you aren't there is no reason to update cURL.

In Seamonkey, fifteen security vulnerabilities were fixed which could 
allow for remote code execution, unauthorized information disclosure, 
applications to be mistakenly opened, remotely exploitable crashes, 
sandbox escapes, access to PDF and JSON objects as well as video frames 
cross origin, permission leaks, content security policy bypasses, and 
cross-site scripting exposure. One of these vulnerabilities is known to 
be exploited in the wild. This brings Seamonkey up to date with the 
security issues fixed in Firefox 128.6.0/115.19.0. In the past, we 
talked about potentially dropping Seamonkey, but upstream seems to be 
doing better with handling issues and resolving compatibility problems. 
That being said though, if you are using Seamonkey, you need to update 
to Seamonkey-2.53.20 immediately to resolve some critical issues which 
are being actively exploited. There have been a few changes to the 
instructions as part of this update, including some removed commands and 
some mozconfig options which are no longer recognized by the build 
system. Please pay attention to the instructions when updating this package.

In Spidermonkey, two security vulnerabilities were fixed that could 
allow for memory corruption and arbitrary code execution. One of these 
vulnerabilities occurs when parsing a JavaScript module as JSON, which 
could lead to cross-compartment access. This would allow for a 
use-after-free, potentially allowing for arbitrary code execution. The 
other vulnerability happens when segmenting specially crafted text, and 
causes memory corruption which leads to a exploitable crash. If you have 
Spidermonkey installed, you should update to Spidermonkey-128.6.0 - but 
note that if you update to 128.x, you will need to also update Gjs to 
the latest version from the development books. If you don't want to 
update to the 128.x series, please update to 115.19.0.

In Firefox, seven security vulnerabilities were fixed which could allow 
for "confused deputy" attacks via the WebChannel API (allowing privilege 
escalation), a use-after-free when breaking lines in text, for ALPN 
verification failures when using Alt-Svc and when the original server is 
redirecting to an insecure site, for compartment mismatches (leading to 
a use-after-free when parsing a JavaScript module as JSON), for memory 
corruption (when segmenting specially crafted text via JavaScript), and 
for remote code execution. If you have Firefox installed, you should 
update to Firefox-128.6.0esr to protect your system.

In Libreoffice, two security vulnerabilities were fixed which could 
allow for unauthorized information disclosure as well as for arbitrary 
file writes on the filesystem (with limitations). Both of these issues 
can be exploited by opening malicious documents, so if you don't update 
this package, you should be wary of downloading files that you use with 
Libreoffice (especially via email). The unauthorized information 
disclosure issue happens when URLs are constructed which expand 
environment variables or INI file values. This could allow for sensitive 
system details to be uploaded to a remote server when a documented is 
opened, and it was fixed by removing the expansion feature from document 
hosted URLs. The arbitrary file write vulnerability is a bit limited in 
that it can only write files with a .ttf suffix, but those files could 
contain any contents (including scripting content or malicious fonts). 
It happens due to a path traversal problem, and it can be exploited by 
opening a document that has embedded font file path names stored within 
it. If you use Libreoffice, you should update to Libreoffice-24.8.4.2.

There is one additional topic that I'd like to talk about in this email. 
There has been some chatter of a vulnerability in libxml2 which we fixed 
in July. The vulnerability was originally thought to cause XML External 
Entity Injection attacks, but recent information shows that it's being 
used in the wild for remote code execution attacks. If you haven't 
updated libxml2 in a long time, you should update to libxml2-2.13.5 
immediately to protect your system. The fixed version originally was 
2.13.3, but some additional regression fixes have happened since we 
updated the book to 2.13.3 in July of last year, and it is thus 
recommended to update to 2.13.5 instead.

For more information, please visit 
https://linuxfromscratch.org/blfs/advisories/consolidated.html and 
https://linuxfromscratch.org/blfs/advisories/12.2.html.


Thank you,

- Doug

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page