Debian Bug report logs -
#869879
ghostscript: CVE-2017-9610 CVE-2017-9618 CVE-2017-9619 CVE-2017-9620 CVE-2017-9740
Reported by: Salvatore Bonaccorso <carnil@debian.org>
Date: Thu, 27 Jul 2017 11:24:01 UTC
Severity: normal
Tags: patch, security, upstream
Found in version ghostscript/9.21~dfsg-1
Fixed in version ghostscript/9.22~dfsg-1
Done: Salvatore Bonaccorso <carnil@debian.org>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian Printing Team <debian-printing@lists.debian.org>
:
Bug#869879
; Package src:ghostscript
.
(Thu, 27 Jul 2017 11:24:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>
:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Debian Printing Team <debian-printing@lists.debian.org>
.
(Thu, 27 Jul 2017 11:24:03 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: ghostscript
Version: 9.21~dfsg-1
Severity: normal
Tags: security patch upstream
Hi,
the following vulnerabilities were published for ghostscript. Note,
I'm collecting those in one bug, because they are currently
unimportant for Debian as xps/ not used during build. But it would be
nice to see those as well fixed for future. The security-tracker link
refer individually to the respective upstream bug and commit.
CVE-2017-9610[0]:
| The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript
| GhostXPS 9.22 allows remote attackers to cause a denial of service
| (heap-based buffer over-read and application crash) or possibly have
| unspecified other impact via a crafted document.
CVE-2017-9618[1]:
| The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript
| GhostXPS 9.22 allows remote attackers to cause a denial of service
| (buffer overflow and application crash) or possibly have unspecified
| other impact via a crafted document.
CVE-2017-9619[2]:
| The xps_true_callback_glyph_name function in xps/xpsttf.c in Artifex
| Ghostscript GhostXPS 9.22 allows remote attackers to cause a denial of
| service (Segmentation Violation and application crash) via a crafted
| file.
CVE-2017-9620[3]:
| The xps_select_font_encoding function in xps/xpsfont.c in Artifex
| Ghostscript GhostXPS 9.22 allows remote attackers to cause a denial of
| service (heap-based buffer over-read and application crash) or possibly
| have unspecified other impact via a crafted document, related to the
| xps_encode_font_char_imp function.
CVE-2017-9740[4]:
| The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex
| Ghostscript GhostXPS 9.22 allows remote attackers to cause a denial of
| service (heap-based buffer over-read and application crash) or possibly
| have unspecified other impact via a crafted document.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2017-9610
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9610
[1] https://security-tracker.debian.org/tracker/CVE-2017-9618
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9618
[2] https://security-tracker.debian.org/tracker/CVE-2017-9619
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9619
[3] https://security-tracker.debian.org/tracker/CVE-2017-9620
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9620
[4] https://security-tracker.debian.org/tracker/CVE-2017-9740
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9740
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
-- System Information:
Debian Release: buster/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.11.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Marked as fixed in versions ghostscript/9.22~dfsg-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Fri, 20 Apr 2018 10:15:03 GMT) (full text, mbox, link).
Marked Bug as done
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Fri, 20 Apr 2018 10:15:05 GMT) (full text, mbox, link).
Notification sent
to Salvatore Bonaccorso <carnil@debian.org>
:
Bug acknowledged by developer.
(Fri, 20 Apr 2018 10:15:06 GMT) (full text, mbox, link).
Message sent on
to Salvatore Bonaccorso <carnil@debian.org>
:
Bug#869879.
(Fri, 20 Apr 2018 10:15:07 GMT) (full text, mbox, link).
Message #14 received at 869879-submitter@bugs.debian.org (full text, mbox, reply):
close 869879 9.22~dfsg-1
thanks
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org
.
(Thu, 24 May 2018 07:28:23 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 14:05:49 2019;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.