Bug 1446063 (CVE-2017-8291) - CVE-2017-8291 ghostscript: corruption of operand stack
Summary: CVE-2017-8291 ghostscript: corruption of operand stack
Status: CLOSED ERRATA
Alias: CVE-2017-8291
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20170426,repo...
Keywords: Security
: 1445359 (view as bug list)
Depends On: 1446064 1447220 1447221 1447222 1447223
Blocks: 1445360 1446066
TreeView+ depends on / blocked
 
Reported: 2017-04-27 08:03 UTC by Adam Mariš
Modified: 2019-06-08 21:58 UTC (History)
9 users (show)

(edit)
It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection.
Clone Of:
(edit)
Last Closed: 2017-05-12 11:51:35 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1230 normal SHIPPED_LIVE Important: ghostscript security update 2017-05-12 14:19:52 UTC

Description Adam Mariš 2017-04-27 08:03:21 UTC
It was reported that Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program.

Upstream issue:

https://bugs.ghostscript.com/show_bug.cgi?id=697808

Comment 1 Adam Mariš 2017-04-27 08:03:53 UTC
Created ghostscript tracking bugs for this issue:

Affects: fedora-all [bug 1446064]

Comment 3 Cedric Buissart 🐶 2017-04-28 12:46:45 UTC
This is a duplicate of https://bugzilla.redhat.com/show_bug.cgi?id=1445359

Comment 4 Cedric Buissart 🐶 2017-04-28 14:51:43 UTC
*** Bug 1445359 has been marked as a duplicate of this bug. ***

Comment 9 Cedric Buissart 🐶 2017-05-03 14:56:20 UTC
Note:
The original patch has a regression in some rare conditions (when using the "DELAYBIND" feature). In such situation, the additional patch is required :
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=57f20719

Comment 10 Cedric Buissart 🐶 2017-05-11 13:21:34 UTC
It appears that the additional patch in comment 9 has its own regression.

Comment 11 Cedric Buissart 🐶 2017-05-11 13:52:43 UTC
One more patch :
* Bug 697892: fix check for op stack underflow.
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac

Comment 12 errata-xmlrpc 2017-05-12 10:20:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1230 https://access.redhat.com/errata/RHSA-2017:1230


Note You need to log in before you can comment on or make changes to this bug.