Bug 1619750 – CVE-2018-16513 ghostscript: setcolor missing type check (699655)

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1619750 - (CVE-2018-16513) CVE-2018-16513 ghostscript: setcolor missing type check (699655)

Summary:	CVE-2018-16513 ghostscript: setcolor missing type check (699655)

Status:	CLOSED NOTABUG

Aliases:	CVE-2018-16513

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,public=20180821,repo...
Keywords:	Security

Depends On:
Blocks:	1619570
	Show dependency tree / graph

Reported:	2018-08-21 12:07 EDT by Stefan Cornelius
Modified:	2018-09-24 19:21 EDT (History)
CC List:	15 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	It was discovered that the ghostscript did not properly validate the operands passed to the setcolor function. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-09-19 05:38:48 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Stefan Cornelius 2018-08-21 12:07:51 EDT

It was discovered that the ghostscript did not properly validate the operands passed to the setcolor function. A specially crafted PostScript document could possibly exploit this to crash ghostscript or, possibly, execute arbitrary code in the context of the ghostscript process.

Comment 1 Stefan Cornelius 2018-08-21 12:25:34 EDT

External References:

http://seclists.org/oss-sec/2018/q3/142

Comment 2 Stefan Cornelius 2018-08-22 06:19:46 EDT

Mitigation:

Please see https://bugzilla.redhat.com/show_bug.cgi?id=1619748#c3

Comment 3 Stefan Cornelius 2018-08-23 10:25:58 EDT

Patch:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b326a716

Comment 4 Stefan Cornelius 2018-08-23 11:36:40 EDT

Acknowledgments:

Name: Tavis Ormandy (Google Project Zero)

Comment 6 Stefan Cornelius 2018-09-19 05:39:03 EDT

Statement:

This issue did not affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Note You need to log in before you can comment on or make changes to this bug.