ghostscript: CVE-2018-10194: Buffer overflow on pprintg1 due to mishandle postscript file data to pdf

Debian Bug report logs - #896069
ghostscript: CVE-2018-10194: Buffer overflow on pprintg1 due to mishandle postscript file data to pdf

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: ghostscript: CVE-2018-10194: Buffer overflow on pprintg1 due to mishandle postscript file data to pdf

Date: Thu, 19 Apr 2018 09:48:13 +0200

Source: ghostscript
Version: 9.06~dfsg-2
Severity: grave
Tags: patch security upstream
Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=699255

Hi,

The following vulnerability was published for ghostscript.

CVE-2018-10194[0]:
| The set_text_distance function in devices/vector/gdevpdts.c in the
| pdfwrite component in Artifex Ghostscript through 9.22 does not prevent
| overflows in text-positioning calculation, which allows remote
| attackers to cause a denial of service (application crash) or possibly
| have unspecified other impact via a crafted PDF document.

Unfortunately the upstream report at [1] ist not (yet) public, but the
commit upstream report association is given by the commit at [2].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-10194
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10194
[1] https://bugs.ghostscript.com/show_bug.cgi?id=699255
[2] http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879

Regards,
Salvatore

Message #12 received at 896069@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 860869@bugs.debian.org, 896069@bugs.debian.org

Subject: ghostscript: diff for NMU version 9.22~dfsg-2.1

Date: Fri, 20 Apr 2018 18:49:15 +0200

[Message part 1 (text/plain, inline)]

Control: tags 860869 + patch
Control: tags 860869 + pending
Control: tags 896069 + pending

Dear maintainer,

I've prepared an NMU for ghostscript (versioned as 9.22~dfsg-2.1) and
uploaded it to DELAYED/2. Please feel free to tell me if I
should delay it longer.

Regards,
Salvatore

[ghostscript-9.22~dfsg-2.1-nmu.diff (text/x-diff, attachment)]

Message #17 received at 896069-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 896069-close@bugs.debian.org

Subject: Bug#896069: fixed in ghostscript 9.22~dfsg-2.1

Date: Fri, 20 Apr 2018 18:20:25 +0000

Source: ghostscript
Source-Version: 9.22~dfsg-2.1

We believe that the bug you reported is fixed in the latest version of
ghostscript, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 896069@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated ghostscript package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 20 Apr 2018 12:28:29 +0200
Source: ghostscript
Binary: ghostscript ghostscript-x ghostscript-doc libgs9 libgs9-common libgs-dev ghostscript-dbg
Architecture: source
Version: 9.22~dfsg-2.1
Distribution: unstable
Urgency: medium
Maintainer: Debian Printing Team <debian-printing@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 860869 896069
Description: 
 ghostscript - interpreter for the PostScript language and for PDF
 ghostscript-dbg - interpreter for the PostScript language and for PDF - Debug symbo
 ghostscript-doc - interpreter for the PostScript language and for PDF - Documentati
 ghostscript-x - interpreter for the PostScript language and for PDF - X11 support
 libgs-dev  - interpreter for the PostScript language and for PDF - Development
 libgs9     - interpreter for the PostScript language and for PDF - Library
 libgs9-common - interpreter for the PostScript language and for PDF - common file
Changes:
 ghostscript (9.22~dfsg-2.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Buffer overflow in fill_threshold_buffer (CVE-2016-10317)
     (Closes: #860869)
   * pdfwrite - Guard against trying to output an infinite number
     (CVE-2018-10194) (Closes: #896069)
Checksums-Sha1: 
 b706d9247a412ef801d4bd2143a4ca24d589ca02 2905 ghostscript_9.22~dfsg-2.1.dsc
 76ef29dfa90800e17dcda8cc315b9580b0765ae3 105956 ghostscript_9.22~dfsg-2.1.debian.tar.xz
Checksums-Sha256: 
 00c0d5ee0651ff6ab96e74ab1d23627fc0ac7a75638043d3f6c82c1d6663cfba 2905 ghostscript_9.22~dfsg-2.1.dsc
 b9ff7049ff223c97c85862172d42a98c01b947c27277ae5f56af9367a2bf7102 105956 ghostscript_9.22~dfsg-2.1.debian.tar.xz
Files: 
 6cc02bb50fd60f4046899482ed087580 2905 text optional ghostscript_9.22~dfsg-2.1.dsc
 6783e389b486f699024d1c7baa6abce5 105956 text optional ghostscript_9.22~dfsg-2.1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlraGiJfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EPlcP/0twvUG55IDAB7KSQn7KGrfrwVoQQeS8
HxMNgllPj7TMnFsx/OU9Kga51ay0yNGsKavnew1IwG6MjQheTfFoBw7sAWNSC0Hb
qyfvR8ly9yhE/rFPtTPaNmK1FcfF8VRXvZ/jqDrc7EW4iIz6C+rarWz03FYFyOf/
vipD7d418XVBB4ySE1wGqeTXyDYeYO9QUBDlAN9VZBDn1RdFWdqlrUdoQyrJbG1Z
Pvo6pgFGeDMtYGGfLL2vZYauGdW6oZdQAnNBYzgWjrOUJv9lE1SzSPlUdVjiWKNx
LhxaONjq9i5/GmW2IC29uC0MpFa3+SjpZF+EpI/5mInILUyLOY8VjEDIfVEE5RAX
rzoARmt81jx8VU+K1GWVRLLxpbL2ER7Ghs+n1EAlEBX4reJM3AqvXvJXC9KOB0i4
a0ISwKYJgWiYbgjuZ/m1bRnDdIpdjpp+QLDtzPgcsA7Fu+Zgh4QiTpIy+s/4Ntsy
w7NhOtMc4LyaeGO0P46hMIaiSattFaRVY5D1ZzeJ2cMA3NATgcR1l5a423OSWhqx
fXLF4z2hfP0/NIVAP1Y+Q+4gE6AZeQsH3moroGoDBKR39uhhtybr5oD3mac1ji4F
RXY6Gu6Ij6qTD8xP0LU6U3lSyCXBXCbi2j0Uv77i5nLGKpG3R4w11Nn/fHvQyi68
Yyslp/5K4uMd
=blQ1
-----END PGP SIGNATURE-----

Message #22 received at 896069-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 896069-close@bugs.debian.org

Subject: Bug#896069: fixed in ghostscript 9.20~dfsg-3.2+deb9u2

Date: Mon, 28 May 2018 21:17:08 +0000

Source: ghostscript
Source-Version: 9.20~dfsg-3.2+deb9u2

We believe that the bug you reported is fixed in the latest version of
ghostscript, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 896069@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated ghostscript package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 29 Apr 2018 10:58:15 +0200
Source: ghostscript
Binary: ghostscript ghostscript-x ghostscript-doc libgs9 libgs9-common libgs-dev ghostscript-dbg
Architecture: source
Version: 9.20~dfsg-3.2+deb9u2
Distribution: stretch
Urgency: medium
Maintainer: Debian Printing Team <debian-printing@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 860869 896069
Description: 
 ghostscript - interpreter for the PostScript language and for PDF
 ghostscript-dbg - interpreter for the PostScript language and for PDF - Debug symbo
 ghostscript-doc - interpreter for the PostScript language and for PDF - Documentati
 ghostscript-x - interpreter for the PostScript language and for PDF - X11 support
 libgs-dev  - interpreter for the PostScript language and for PDF - Development
 libgs9     - interpreter for the PostScript language and for PDF - Library
 libgs9-common - interpreter for the PostScript language and for PDF - common file
Changes:
 ghostscript (9.20~dfsg-3.2+deb9u2) stretch; urgency=medium
 .
   * Non-maintainer upload.
   * Segfault with fuzzing file in gxht_thresh_image_init
   * Buffer overflow in fill_threshold_buffer (CVE-2016-10317)
     (Closes: #860869)
   * pdfwrite - Guard against trying to output an infinite number
     (CVE-2018-10194) (Closes: #896069)
Checksums-Sha1: 
 7f63bb209fce3ca558561ad9594b8bc262b7408c 3053 ghostscript_9.20~dfsg-3.2+deb9u2.dsc
 d8689dabc0c9e66e028cc9d9fbed305169480df6 119160 ghostscript_9.20~dfsg-3.2+deb9u2.debian.tar.xz
Checksums-Sha256: 
 5f2692799748054cea9aa59236af5343f302fc89e1b29850f89fc1ba1d876c44 3053 ghostscript_9.20~dfsg-3.2+deb9u2.dsc
 6f559fe60fc898ea6beeac1c08c100c9154e6ccb47db52c8c788aa524b7ed9e4 119160 ghostscript_9.20~dfsg-3.2+deb9u2.debian.tar.xz
Files: 
 b5fcbaefb7ecc0b0481b07a39b5a0797 3053 text optional ghostscript_9.20~dfsg-3.2+deb9u2.dsc
 50b28817368302aad4ac168bfb30aac9 119160 text optional ghostscript_9.20~dfsg-3.2+deb9u2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlsJJC5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89ExScP/jr2z5Qs74xcA/J3w7Y3HGB8FUl1xIVB
5IoWcb5kVvsGYyrHjvQs+hdbEGRLrkTWO4MWuWmngv//dP0thoE33yJjMBXl/9v/
5wFviNHHUNx3neKzxJQA+wRie6xQmkUX+1GgSiJ+pzW+KzF5E5moWXbuN/32I/ed
cM/nCU0wxCFV6Atkv/iir58Eom742AFmGyB4+KV4kpkAXSKys5vFfiE9k81G9Dep
7b5RO9GHT1HMREvkgl2DcmikZebz9MqZbaYqYO3gnAZwlJsyF8NEHqVeHAO2mDt+
u3cvN93ievfU8Viq/9JSLWHpOsVzfhXbQ03LNNhACJHX/3YbV51L/WhXBll5gpfS
md2OvJFScrCySLHQBf0LQnNy4xuMRYHUNiyNopa6HYRyxdO53B5syRlEKJjIqj/a
YnO3ue+Zw/47eehiQLQmRvLu3Qzp3O/gfJu4qCO2MwuHMSPlW637nPK7TtMS+lMJ
OxBdWytBREimyzm1k/qsmUAsWLScXkyXAVLhuPuKtKqfN0d6pey1jiiQEf0AAXvK
Aw12RE9mPjRBQmLNDq/160dLYJpkqaJzv8GAx0vn/jtem5avVQnEVMrftMAz0nfP
3CBGGNBFbSDtGv9cyustKddp+m/Pxwo+HatD0bF59u1YhzIX5/9LR5sypk7Ob4kq
pdV3AbJRP093
=1Xfy
-----END PGP SIGNATURE-----

Message #27 received at 896069-close@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 896069-close@bugs.debian.org

Subject: Bug#896069: fixed in ghostscript 9.06~dfsg-2+deb8u7

Date: Mon, 28 May 2018 21:17:39 +0000

Source: ghostscript
Source-Version: 9.06~dfsg-2+deb8u7

We believe that the bug you reported is fixed in the latest version of
ghostscript, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 896069@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated ghostscript package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 29 Apr 2018 11:58:34 +0200
Source: ghostscript
Binary: ghostscript ghostscript-x ghostscript-doc libgs9 libgs9-common libgs-dev ghostscript-dbg
Architecture: all source
Version: 9.06~dfsg-2+deb8u7
Distribution: jessie
Urgency: medium
Maintainer: Debian Printing Team <debian-printing@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 860869 896069
Description: 
 ghostscript - interpreter for the PostScript language and for PDF
 ghostscript-dbg - interpreter for the PostScript language and for PDF - Debug symbo
 ghostscript-doc - interpreter for the PostScript language and for PDF - Documentati
 ghostscript-x - interpreter for the PostScript language and for PDF - X11 support
 libgs-dev  - interpreter for the PostScript language and for PDF - Development
 libgs9     - interpreter for the PostScript language and for PDF - Library
 libgs9-common - interpreter for the PostScript language and for PDF - common file
Changes:
 ghostscript (9.06~dfsg-2+deb8u7) jessie; urgency=medium
 .
   * Non-maintainer upload.
   * Segfault with fuzzing file in gxht_thresh_image_init
   * Buffer overflow in fill_threshold_buffer (CVE-2016-10317)
     (Closes: #860869)
   * pdfwrite - Guard against trying to output an infinite number
     (CVE-2018-10194) (Closes: #896069)
Checksums-Sha1: 
 a22ce2320d10e74f121f3f7b14192f9d36a62571 3047 ghostscript_9.06~dfsg-2+deb8u7.dsc
 00bc5ae83b86c12d02017ca915d56c8a330cbc3a 104224 ghostscript_9.06~dfsg-2+deb8u7.debian.tar.xz
 d41c02e653e8e84add9ac587bd73ae67dfb81433 5068100 ghostscript-doc_9.06~dfsg-2+deb8u7_all.deb
 a422aa41cab7288480a8bf2501af308652e4d951 1981464 libgs9-common_9.06~dfsg-2+deb8u7_all.deb
Checksums-Sha256: 
 fead0e9c4fcea9a56203801de578d5de84f71c513ff38454e9c96da3b2f37b16 3047 ghostscript_9.06~dfsg-2+deb8u7.dsc
 a3e2b1e2fc5e1c1581f952105f1ec85a28e609dc027bea2c8b4d82c392cdfa24 104224 ghostscript_9.06~dfsg-2+deb8u7.debian.tar.xz
 2d128342670d19d9b20e125c0963cbd57662d44fd312f205ca560d498848aa60 5068100 ghostscript-doc_9.06~dfsg-2+deb8u7_all.deb
 2ddc623f6bde9c2ac32b6e59190b2ec01afc37d1cde4e0b849af8d3d8d91b501 1981464 libgs9-common_9.06~dfsg-2+deb8u7_all.deb
Files: 
 46f7d6cef86c990c1a34fcf760ec6231 3047 text optional ghostscript_9.06~dfsg-2+deb8u7.dsc
 b53c8f2b8223aafccb8e3362ed3e60a7 104224 text optional ghostscript_9.06~dfsg-2+deb8u7.debian.tar.xz
 0e1488d7a21abd82b84ff27a3bfd3af8 5068100 doc optional ghostscript-doc_9.06~dfsg-2+deb8u7_all.deb
 22aa9e7953f136e8438c770fb957a71c 1981464 libs optional libgs9-common_9.06~dfsg-2+deb8u7_all.deb

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlsJJnNfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89E/GIP/3pE978Q10vheUMg4V0jNXuYrBAKf/V0
Ju2TA3NDU3pJB+ij7Qqo1hV+SY8cOYpAGMinuyfU2wpj9KyudobUeJRh9rsjQKpk
/ysJRV+W6DRIpFwtutn5tWIY/XUwqAntWDoqrtY4Uy//ctFT7qlk6qkeACFUOuR9
aBDiv5ZgkJV+45/5dYBLU+8S1HIOAiJBo5FFDCRxThooavSgBa/OQdtJy7Sd0xFf
pSy8TRC79SLg9vDQuCv1dwnmyQH5oQalr3VTeAm5cMpoDvQG1sqRV1asAjMXasA1
wATh4lzLqmGGMyl+kYGzAJF8TKfn1bT5YB+2hGOYtKWVuR12ABAjMdn+5+yZpiBQ
xff/guaEuoI0/963TXNfzTatD9Nz7+S3pv6/0S14oXd5AJbkUdzK7p/OwjHXjsWg
XotXbSEDrRjGWATt9PwXKJs3HaBChDgLcxKmouRVKwapI1L8ySJFjHmhJJSWgGwY
knIgNu+2nbuTPJ49SRc4dbvhtOwFKCutjcnYoXSDYwdnQVms0z8mSnb34e9dBibU
YWjM/FgdWqjqfQdKgf7NEI2OTmrOsu/alEt0qi0t7aUZTfg39FdgUbr7qVcaZtq1
1eBm2fWS2oMvHSFXtM1aqIDjNkXrKMeZMHVVGLrbYzN1dhE55KwiNFeAIcLDW4fZ
4DQVRpaNm8nu
=xlc6
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.