[ASA-201904-5] ghostscript: sandbox escape
Remi Gacogne
rgacogne at archlinux.org
Wed Apr 24 13:14:15 UTC 2019
Arch Linux Security Advisory ASA-201904-5
=========================================
Severity: High
Date : 2019-04-11
CVE-ID : CVE-2019-3835 CVE-2019-3838
Package : ghostscript
Type : sandbox escape
Remote : Yes
Link : https://security.archlinux.org/AVG-929
Summary
=======
The package ghostscript before version 9.27-1 is vulnerable to sandbox
escape.
Resolution
==========
Upgrade to 9.27-1.
# pacman -Syu "ghostscript>=9.27-1"
The problems have been fixed upstream in version 9.27.
Workaround
==========
None.
Description
===========
- CVE-2019-3835 (sandbox escape)
It was found that the superexec operator was available in the internal
dictionary. A specially crafted PostScript file could use this flaw in
order to, for example, have access to the file system outside of the
constrains imposed by -dSAFER.
- CVE-2019-3838 (sandbox escape)
It was found that the forceput operator could be extracted from the
DefineResource method using methods similar to the ones described in
CVE-2019-6116. A specially crafted PostScript file could use this flaw
in order to, for example, have access to the file system outside of the
constrains imposed by -dSAFER.
Impact
======
A remote attacker is able to escape the sandbox via a specially crafted
PostScript document.
References
==========
https://bugs.archlinux.org/task/62102
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d683d1e6
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd95bb01
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e8f95a
https://security.archlinux.org/CVE-2019-3835
https://security.archlinux.org/CVE-2019-3838
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20190424/92124822/attachment.sig>
More information about the arch-security
mailing list