Stay Secure with the Latest Linux Advisories

security advisorysoftware updatemedium severity

Arch Linux: 202107-34 Medium: Code Arbitrary Execution Alert

The package code before version 1.58.0-1 is vulnerable to arbitrary code execution. . Arch Linux Security Advisory ASA-202107-34 ========================================= Severity: Medium Date : 2021-07-20 CVE-ID : CVE-2021-31211 CVE-2021-31214 Package : code Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1963 Summary ====== The package code before version 1.58.0-1 is vulnerable to arbitrary code execution. Resolution ========= Upgrade to 1.58.0-1. # pacman -Syu "code> =1.58.0-1" The problems have been fixed upstream in version 1.58.0. Workaround ========= None. Description ========== - CVE-2021-31211 (arbitrary code execution) An arbitrary code execution vulnerability through crafted remote terminal settings has been found in Visual Studio Code before version 1.57.0. - CVE-2021-31214 (arbitrary code execution) An arbitrary code execution vulnerability in the Grunt, Gulp and Jake task auto detection has been found in Visual Studio Code before version 1.57.0. Impact ===== An attacker could execute arbitrary code through crafted remote terminal settings or JavaScript task runner configuration files without user interaction. References ========= https://github.com/microsoft/vscode/issues/123590 https://github.com/microsoft/vscode/commit/7259955ce318a2bb2a86ee121c34dcaab0a86e45 https://github.com/microsoft/vscode/issues/123588 https://github.com/microsoft/vscode/commit/5f3466a21e80b2c016a1c0cbe2af683c9072d0a7 https://security.archlinux.org/CVE-2021-31211 https://security.archlinux.org/CVE-2021-31214 . Update software bundle in response to high priority notification ASA-202107-34 concerning potential remote execution flaws.. Arch Linux Security, Code Package Update, Code Execution Risk. . Severity: Medium. LinuxSecurity.com Team

Jul 20, 2021 •Medium ArchLinux