Bug 1627959 (CVE-2018-16802) - CVE-2018-16802 ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
Summary: CVE-2018-16802 ghostscript: Incorrect "restoration of privilege" checking whe...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-16802
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1627960 1627961 1650060 1650061
Blocks: 1619570
TreeView+ depends on / blocked
 
Reported: 2018-09-12 00:49 UTC by Sam Fowler
Modified: 2021-02-16 23:03 UTC (History)
2 users (show)

Fixed In Version: ghostscript 9.25
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-12-18 09:17:13 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:3834 0 None None None 2018-12-17 19:58:20 UTC

Description Sam Fowler 2018-09-12 00:49:21 UTC 
An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.


References:

https://seclists.org/oss-sec/2018/q3/228
https://seclists.org/oss-sec/2018/q3/229
https://seclists.org/oss-sec/2018/q3/233


Upstream Patches:

https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=643b24db
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3e5d316b
https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5812b1b7
Comment 1 Sam Fowler 2018-09-12 00:49:56 UTC 
Created ghostscript tracking bugs for this issue:

Affects: fedora-all [bug 1627960]
Comment 4 Stefan Cornelius 2018-09-18 12:25:10 UTC 
Statement:

This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 7. This issue did not affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5 and 6.
Comment 6 errata-xmlrpc 2018-12-17 19:58:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3834 https://access.redhat.com/errata/RHSA-2018:3834
Comment 7 Cedric Buissart 2018-12-18 09:17:15 UTC 
Mitigation:

Please refer to the "Mitigation" section of CVE-2018-16509 : https://access.redhat.com/security/cve/cve-2018-16509
Note You need to log in before you can comment on or make changes to this bug.