[Security] Mitigation & Patch

marav · 12-09-2023, 08:36 AM

Bluez 5.70

CVE-2023-45866

Code:

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and 
establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection 
of HID messages when no user interaction has occurred in the Central role to authorize such access. 
An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, 
a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

https://www.cve.org/CVERecord?id=CVE-2023-45866

Patch:
https://git.kernel.org/pub/scm/bluet...b3f0085eaeb675

marav · 12-17-2023, 04:11 PM

Bluez 5.71

Bug:

Code:

Bluez 5.71 causes initial auto-connect to fail with 
[Failed to load link keys for hci0]

https://github.com/bluez/bluez/issues/686

Patch:
adapter: Fix link key address type for old kernels
https://github.com/tedd-an/bluez-ups...f1bacf74243646

willysr · 12-17-2023, 07:45 PM

is this considered security fixes?

volkerdi · 12-17-2023, 07:47 PM

Quote:

Originally Posted by willysr

is this considered security fixes?

Since bluez 5.71 was considered a security fix and was pushed to stable (perhaps causing an unrelated DoS), I'd say it qualifies.

Aeterna · 12-18-2023, 08:40 PM

unfortunately, it disconnects bluetooth (headphones). I guess security by denying functionality is an option too...

Aeterna · 12-19-2023, 08:19 PM

Quote:

Originally Posted by volkerdi

Since bluez 5.71 was considered a security fix and was pushed to stable (perhaps causing an unrelated DoS), I'd say it qualifies.

Thank you,
After today's update bluetooth works fine.

marav · 01-16-2024, 05:52 AM

X.Org Server 21.1.11 and XWayland 23.2.4

Code:

Multiple issues have been found in the X server and Xwayland implementations 
published by X.Org for which we are releasing security fixes for in
xorg-server-21.1.11 and xwayland-23.2.4.

1) CVE-2023-6816 can be triggered by passing an invalid array index to DeviceFocusEvent or ProcXIQueryPointer.

2) CVE-2024-0229 can be triggered if a device has both a button and a key class and zero buttons.

3) CVE-2024-21885 can be triggered if a device with a given ID was removed and a new device with the same ID added both in the same operation.

4) CVE-2024-21886 can be triggered by disabling a master device with disabled slave devices.

5) CVE-2024-0409 can be triggered by enabling SELinux xserver_object_manager and running a client.

6) CVE-2024-0408 can be triggered by enabling SELinux xserver_object_manager and creating a GLX PBuffer.

https://lists.x.org/archives/xorg/20...ry/061525.html

GazL · 01-16-2024, 08:28 AM

Looks like Linux 5.15.147 includes a fix for CVE-2023-6040: a local information disclosure issue in netfilter that seems to be getting the odd mention out on the Webs.

nobodino · 01-23-2024, 12:51 AM

coreutils-9.4

CVE-2024-0684 GNU "Coreutils split split.c buffer overflow"

fixed with this patch from: https://github.com/coreutils/coreuti...0e3a13101637d9

volkerdi · 01-23-2024, 01:59 PM

Quote:

Originally Posted by nobodino

coreutils-9.4

CVE-2024-0684 GNU "Coreutils split split.c buffer overflow"

fixed with this patch from: https://github.com/coreutils/coreuti...0e3a13101637d9

Not vulnerable in Slackware 15.0, and doesn't seem to be much of a security issue from what I've read about it.

We'll see if it prompts upstream to make another coreutils release.

marav · 02-13-2024, 05:24 PM

dnsmasq 2.90

Code:

CVE 2023-50387 and CVE 2023-50868 apply.
Note that the is a security vulnerablity only when DNSSEC validation
is enabled.

https://thekelleys.org.uk/dnsmasq/CHANGELOG

marav · 02-13-2024, 05:28 PM

exiv2 0.28.2

Code:

* [CVE-2024-24826](https://github.com/Exiv2/exiv2/security/advisories/GHSA-g9xm-7538-mq8w)
    out-of-bounds read in QuickTimeVideo::NikonTagsDecoder.
* [CVE-2024-25112](https://github.com/Exiv2/exiv2/security/advisories/GHSA-crmj-qh74-2r36)
    denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder.

https://github.com/Exiv2/exiv2/blob/.../doc/ChangeLog

alex2grad · 02-20-2024, 11:50 AM

Improper Domain Lookup that potentially leads to SSRF attacks

https://github.com/libuv/libuv/secur...f74f-cvh7-c6q6

volkerdi · 02-20-2024, 01:10 PM

Quote:

Originally Posted by alex2grad

Improper Domain Lookup that potentially leads to SSRF attacks

https://github.com/libuv/libuv/secur...f74f-cvh7-c6q6

The version in Slackware 15.0 is not vulnerable.

I failed to mention this CVE in -current's ChangeLog, but then again upstream didn't mention it in theirs either.

alex2grad · 02-20-2024, 02:15 PM

Quote:

Originally Posted by volkerdi

The version in Slackware 15.0 is not vulnerable.

I failed to mention this CVE in -current's ChangeLog, but then again upstream didn't mention it in theirs either.

Affected versions > v1.24.0
The version 1.43.0 is in Slackware 15.0. Why it's not vulnerable?

CVE-2024-24806