Advisories ยป MGASA-2017-0133

Updated ghostscript packages fix security vulnerability

Publication date: 07 May 2017
Modification date: 07 May 2017
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-7976 , CVE-2016-7977 , CVE-2016-7978 , CVE-2016-7979 , CVE-2016-8602 , CVE-2016-9601 , CVE-2016-10217 , CVE-2016-10218 , CVE-2016-10219 , CVE-2016-10220 , CVE-2017-5951 , CVE-2017-7207 , CVE-2017-8291

Description

Various userparams in Ghostscript allow %pipe% in paths, allowing remote
shell command execution (CVE-2016-7976).

The .libfile function in Ghostscript doesn't check PermitFileReading
array, allowing remote file disclosure (CVE-2016-7977).

Reference leak in the .setdevice function in Ghostscript allows
use-after-free and remote code execution (CVE-2016-7978).

Type confusion in the .initialize_dsc_parser function in Ghostscript
allows remote code execution (CVE-2016-7979).

The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21
allows remote attackers to cause a denial of service (application crash)
or possibly execute arbitrary code via a crafted Postscript document
that calls .sethalftone5 with an empty operand stack (CVE-2016-8602).

A heap based buffer overflow was found in the ghostscript
jbig2_decode_gray_scale_image() function used to decode halftone segments
in a JBIG2 image. A document (PostScript or PDF) with an embedded,
specially crafted, jbig2 image could trigger a segmentation fault in
ghostscript (CVE-2016-9601).

The pdf14_open function in base/gdevp14.c in Ghostscript 9.20 allows
remote attackers to cause a denial of service (use-after-free and
application crash) via a crafted file that is mishandled in the color
management module (CVE-2016-10217).

The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF
Transparency module in Ghostscript 9.20 allows remote attackers to cause
a denial of service (NULL pointer dereference and application crash) via
a crafted file (CVE-2016-10218).

The intersect function in base/gxfill.c in Ghostscript 9.20 allows
remote attackers to cause a denial of service (divide-by-zero error and
application crash) via a crafted file (CVE-2016-10219).

The gs_makewordimagedevice function in base/gsdevmem.c in Ghostscript
9.20 allows remote attackers to cause a denial of service (NULL pointer
dereference and application crash) via a crafted file that is mishandled
in the PDF Transparency module (CVE-2016-10220).

The mem_get_bits_rectangle function in base/gdevmem.c in Ghostscript
9.20 allows remote attackers to cause a denial of service (NULL pointer
dereference and application crash) via a crafted file (CVE-2017-5951).

The mem_get_bits_rectangle function in Ghostscript 9.20 allows remote
attackers to cause a denial of service (NULL pointer dereference) via a
crafted PostScript document (CVE-2017-7207).

Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command
execution via .rsdparams type confusion with a "/OutputFile (%pipe%"
substring in a crafted .eps document that is an input to the gs program
(CVE-2017-8291).

References

SRPMS

5/core