Bug 1625836 (CVE-2018-16510)

Summary:	CVE-2018-16510 ghostscript: Incorrect exec stack handling in the "CS" and "SC" PDF primitives (699671)
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	deekej, twaugh, zdohnal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ghostscript 9.24	Doc Type:	If docs needed, set a value
Doc Text:	It was discovered that ghostscript did not properly handle certain error conditions related to the SC and CS PDF operators. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-09-19 15:19:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1625837, 1625838
Bug Blocks:	1619570

Description Sam Fowler 2018-09-06 05:14:17 UTC

An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact.


External Reference:

https://www.kb.cert.org/vuls/id/332928


Upstream Bug:

https://bugs.ghostscript.com/show_bug.cgi?id=699671


Upstream Patch:

http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=ea735ba3

Comment 1 Sam Fowler 2018-09-06 05:14:45 UTC

Created ghostscript tracking bugs for this issue:

Affects: fedora-all [bug 1625837]

Comment 4 Stefan Cornelius 2018-09-19 15:19:41 UTC

Statement:

This issue did not affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.