[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#896069: marked as done (ghostscript: CVE-2018-10194: Buffer overflow on pprintg1 due to mishandle postscript file data to pdf)

Your message dated Mon, 28 May 2018 21:17:08 +0000
with message-id <E1fNPVs-000HqV-Ii@fasolo.debian.org>
and subject line Bug#896069: fixed in ghostscript 9.20~dfsg-3.2+deb9u2
has caused the Debian Bug report #896069,
regarding ghostscript: CVE-2018-10194: Buffer overflow on pprintg1 due to mishandle postscript file data to pdf
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
896069: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=896069
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Source: ghostscript
Version: 9.06~dfsg-2
Severity: grave
Tags: patch security upstream
Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=699255

Hi,

The following vulnerability was published for ghostscript.

CVE-2018-10194[0]:
| The set_text_distance function in devices/vector/gdevpdts.c in the
| pdfwrite component in Artifex Ghostscript through 9.22 does not prevent
| overflows in text-positioning calculation, which allows remote
| attackers to cause a denial of service (application crash) or possibly
| have unspecified other impact via a crafted PDF document.

Unfortunately the upstream report at [1] ist not (yet) public, but the
commit upstream report association is given by the commit at [2].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-10194
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10194
[1] https://bugs.ghostscript.com/show_bug.cgi?id=699255
[2] http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879

Regards,
Salvatore

--- End Message ---
--- Begin Message --- 
Source: ghostscript
Source-Version: 9.20~dfsg-3.2+deb9u2

We believe that the bug you reported is fixed in the latest version of
ghostscript, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 896069@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated ghostscript package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 29 Apr 2018 10:58:15 +0200
Source: ghostscript
Binary: ghostscript ghostscript-x ghostscript-doc libgs9 libgs9-common libgs-dev ghostscript-dbg
Architecture: source
Version: 9.20~dfsg-3.2+deb9u2
Distribution: stretch
Urgency: medium
Maintainer: Debian Printing Team <debian-printing@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 860869 896069
Description: 
 ghostscript - interpreter for the PostScript language and for PDF
 ghostscript-dbg - interpreter for the PostScript language and for PDF - Debug symbo
 ghostscript-doc - interpreter for the PostScript language and for PDF - Documentati
 ghostscript-x - interpreter for the PostScript language and for PDF - X11 support
 libgs-dev  - interpreter for the PostScript language and for PDF - Development
 libgs9     - interpreter for the PostScript language and for PDF - Library
 libgs9-common - interpreter for the PostScript language and for PDF - common file
Changes:
 ghostscript (9.20~dfsg-3.2+deb9u2) stretch; urgency=medium
 .
   * Non-maintainer upload.
   * Segfault with fuzzing file in gxht_thresh_image_init
   * Buffer overflow in fill_threshold_buffer (CVE-2016-10317)
     (Closes: #860869)
   * pdfwrite - Guard against trying to output an infinite number
     (CVE-2018-10194) (Closes: #896069)
Checksums-Sha1: 
 7f63bb209fce3ca558561ad9594b8bc262b7408c 3053 ghostscript_9.20~dfsg-3.2+deb9u2.dsc
 d8689dabc0c9e66e028cc9d9fbed305169480df6 119160 ghostscript_9.20~dfsg-3.2+deb9u2.debian.tar.xz
Checksums-Sha256: 
 5f2692799748054cea9aa59236af5343f302fc89e1b29850f89fc1ba1d876c44 3053 ghostscript_9.20~dfsg-3.2+deb9u2.dsc
 6f559fe60fc898ea6beeac1c08c100c9154e6ccb47db52c8c788aa524b7ed9e4 119160 ghostscript_9.20~dfsg-3.2+deb9u2.debian.tar.xz
Files: 
 b5fcbaefb7ecc0b0481b07a39b5a0797 3053 text optional ghostscript_9.20~dfsg-3.2+deb9u2.dsc
 50b28817368302aad4ac168bfb30aac9 119160 text optional ghostscript_9.20~dfsg-3.2+deb9u2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlsJJC5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89ExScP/jr2z5Qs74xcA/J3w7Y3HGB8FUl1xIVB
5IoWcb5kVvsGYyrHjvQs+hdbEGRLrkTWO4MWuWmngv//dP0thoE33yJjMBXl/9v/
5wFviNHHUNx3neKzxJQA+wRie6xQmkUX+1GgSiJ+pzW+KzF5E5moWXbuN/32I/ed
cM/nCU0wxCFV6Atkv/iir58Eom742AFmGyB4+KV4kpkAXSKys5vFfiE9k81G9Dep
7b5RO9GHT1HMREvkgl2DcmikZebz9MqZbaYqYO3gnAZwlJsyF8NEHqVeHAO2mDt+
u3cvN93ievfU8Viq/9JSLWHpOsVzfhXbQ03LNNhACJHX/3YbV51L/WhXBll5gpfS
md2OvJFScrCySLHQBf0LQnNy4xuMRYHUNiyNopa6HYRyxdO53B5syRlEKJjIqj/a
YnO3ue+Zw/47eehiQLQmRvLu3Qzp3O/gfJu4qCO2MwuHMSPlW637nPK7TtMS+lMJ
OxBdWytBREimyzm1k/qsmUAsWLScXkyXAVLhuPuKtKqfN0d6pey1jiiQEf0AAXvK
Aw12RE9mPjRBQmLNDq/160dLYJpkqaJzv8GAx0vn/jtem5avVQnEVMrftMAz0nfP
3CBGGNBFbSDtGv9cyustKddp+m/Pxwo+HatD0bF59u1YhzIX5/9LR5sypk7Ob4kq
pdV3AbJRP093
=1Xfy
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: