Bug 47481 - ghostscript: Multiple issues (4.3)
ghostscript: Multiple issues (4.3)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.3
All Linux
: P3 normal (vote)
: UCS 4.3-1-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-08-08 07:41 CEST by Quality Assurance
Modified: 2018-08-15 13:14 CEST (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 7.0 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2018-08-08 07:41:17 CEST
New Debian ghostscript 9.20~dfsg-3.2+deb9u2 fixes:
This update addresses the following issue(s):
* 
* The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document. (CVE-2016-10317)
CVE_2017-7948 is open
CVE_2017-8908 is open
CVE_2017-9610 is open
CVE_2017-9618 is open
CVE_2017-9619 is open
CVE_2017-9620 is open
CVE_2017-9740 is open
* The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. (CVE-2018-10194)
CVE_2018-11645 is open

9.20~dfsg-3.2+deb9u2 (Sun, 29 Apr 2018 10:58:15 +0200) * Non-maintainer upload. * Segfault with fuzzing file in gxht_thresh_image_init * Buffer overflow in fill_threshold_buffer (CVE-2016-10317) * pdfwrite - Guard against trying to output an infinite number (CVE-2018-10194)
* CVE-2016-10317 ghostscript: Heap-buffer overflow in the fill_threshold_buffer function (CVE-2016-10317)
* CVE-2018-10194 ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c (CVE-2018-10194)
Comment 1 Quality Assurance univentionstaff 2018-08-08 19:09:59 CEST
--- mirror/ftp/4.3/unmaintained/4.3-0/source/ghostscript_9.20~dfsg-3.2+deb9u1.dsc
+++ apt/ucs_4.3-0-errata4.3-1/source/ghostscript_9.20~dfsg-3.2+deb9u2.dsc
@@ -1,3 +1,12 @@
+9.20~dfsg-3.2+deb9u2 [Sun, 29 Apr 2018 10:58:15 +0200] Salvatore Bonaccorso <carnil@debian.org>:
+
+  * Non-maintainer upload.
+  * Segfault with fuzzing file in gxht_thresh_image_init
+  * Buffer overflow in fill_threshold_buffer (CVE-2016-10317)
+    (Closes: #860869)
+  * pdfwrite - Guard against trying to output an infinite number
+    (CVE-2018-10194) (Closes: #896069)
+
 9.20~dfsg-3.2+deb9u1 [Thu, 28 Sep 2017 21:47:33 +0200] Salvatore Bonaccorso <carnil@debian.org>:
 
   * Non-maintainer upload by the Security Team.

<http://10.200.17.11/4.3-1/#1189116332664772647>
Comment 2 Philipp Hahn univentionstaff 2018-08-09 09:03:42 CEST
OK: patches
OK: piuparts
OK: yaml
OK: errata-announce ghostscript.yaml

[4.3-1] 7f6596f238 Bug #47481: ghostscript 9.20~dfsg-3.2+deb9u2
 doc/errata/staging/ghostscript.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
Comment 3 Arvid Requate univentionstaff 2018-08-15 13:14:36 CEST
<http://errata.software-univention.de/ucs/4.3/181.html>