Fedora Account System
Red Hat Associate
Red Hat Customer
In Ghostscript 9.27, some ephemeral routines in .setuserparams2 can expose .forceput operator when hooking errors. This issue is similar to upstream bug https://bugs.ghostscript.com/show_bug.cgi?id=700317. The actual root-cause is in .setuserparams2 however there is no direct path to invoke the operator. http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=Resource/Init/gs_lev2.ps;h=98d55fe74251e2b8f384a0a97d0a92a9f88949b6;hb=ebfaa2db4cb518a2bc99c1532d4429201a13dfab#l156 156 /userparams .systemvar 3 1 roll .forceput % userparams is read-only 157 } executeonly 158 { 159 pop pop 160 } ifelse 161 } forall We can reach .setuserparams2 via setuserparams. http://git.ghostscript.com/?p=ghostpdl.git;a=blob;f=Resource/Init/gs_lev2.ps;h=98d55fe74251e2b8f384a0a97d0a92a9f88949b6;hb=ebfaa2db4cb518a2bc99c1532d4429201a13dfab#l169 169 /setuserparams { % <dict> setuserparams - 170 {.setuserparams2} stopped 171 {/setuserparams load $error /errorname get signalerror} if 172 } .bind odef This can be used to disable -dSAFER and, for example, access files outside of the restricted area, or command execution. Reference: https://bugs.ghostscript.com/show_bug.cgi?id=701444
Upstream fix : http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33
Mitigation: Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Acknowledgments: Name: Artifex Software Upstream: Hiroki MATSUKUMA (Cyber Defense Institute)
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:2586 https://access.redhat.com/errata/RHSA-2019:2586
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:2591 https://access.redhat.com/errata/RHSA-2019:2591
Created ghostscript tracking bugs for this issue: Affects: fedora-all [bug 1747907]
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-14812