Univention Bugzilla – Bug 47526
ghostscript: Multiple issues (4.2)
Last modified: 2018-08-15 16:20:02 CEST
New Debian ghostscript 9.06~dfsg-2+deb8u7 fixes: This update addresses the following issue(s): * * The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document. (CVE-2016-10317) * The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. (CVE-2018-10194) CVE_2018-11645 is open 9.06~dfsg-2+deb8u7 (Sun, 29 Apr 2018 11:58:34 +0200) * Non-maintainer upload. * Segfault with fuzzing file in gxht_thresh_image_init * Buffer overflow in fill_threshold_buffer (CVE-2016-10317) * pdfwrite - Guard against trying to output an infinite number (CVE-2018-10194) * CVE-2016-10317 ghostscript: Heap-buffer overflow in the fill_threshold_buffer function (CVE-2016-10317) * CVE-2018-10194 ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c (CVE-2018-10194)
--- mirror/ftp/4.2/unmaintained/4.2-4/source/ghostscript_9.06~dfsg-2+deb8u6.dsc +++ apt/ucs_4.2-0-errata4.2-4/source/ghostscript_9.06~dfsg-2+deb8u7.dsc @@ -1,3 +1,12 @@ +9.06~dfsg-2+deb8u7 [Sun, 29 Apr 2018 11:58:34 +0200] Salvatore Bonaccorso <carnil@debian.org>: + + * Non-maintainer upload. + * Segfault with fuzzing file in gxht_thresh_image_init + * Buffer overflow in fill_threshold_buffer (CVE-2016-10317) + (Closes: #860869) + * pdfwrite - Guard against trying to output an infinite number + (CVE-2018-10194) (Closes: #896069) + 9.06~dfsg-2+deb8u6 [Thu, 28 Sep 2017 21:55:37 +0200] Salvatore Bonaccorso <carnil@debian.org>: * Non-maintainer upload by the Security Team. <http://10.200.17.11/4.2-4/#7982427427211290792>
OK: yaml OK: errata-announce OK: patch OK: piuparts [4.2-4] 53975211f2 Bug #47526: ghostscript 9.06~dfsg-2+deb8u7 doc/errata/staging/ghostscript.yaml | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) [4.2-4] c10d657830 Bug #47526: ghostscript 9.06~dfsg-2+deb8u7 doc/errata/staging/ghostscript.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
<http://errata.software-univention.de/ucs/4.2/451.html>