Mageia alert MGASA-2017-0133 (ghostscript)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2017-0133: Updated ghostscript packages fix security vulnerability 
Date:
    	     
 
Mon, 8 May 2017 00:16:29 +0200
Message-ID:
    	     
 
<20170507221629.D5FF79F857@duvel.mageia.org>
MGASA-2017-0133 - Updated ghostscript packages fix security vulnerability

Publication date: 07 May 2017
URL: http://advisories.mageia.org/MGASA-2017-0133.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-7976,
     CVE-2016-7977,
     CVE-2016-7978,
     CVE-2016-7979,
     CVE-2016-8602,
     CVE-2016-9601,
     CVE-2016-10217,
     CVE-2016-10218,
     CVE-2016-10219,
     CVE-2016-10220,
     CVE-2017-5951,
     CVE-2017-7207,
     CVE-2017-8291

Description:
Various userparams in Ghostscript allow %pipe% in paths, allowing remote
shell command execution (CVE-2016-7976).

The .libfile function in Ghostscript doesn't check PermitFileReading
array, allowing remote file disclosure (CVE-2016-7977).

Reference leak in the .setdevice function in Ghostscript allows
use-after-free and remote code execution (CVE-2016-7978).

Type confusion in the .initialize_dsc_parser function in Ghostscript
allows remote code execution (CVE-2016-7979).

The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21
allows remote attackers to cause a denial of service (application crash)
or possibly execute arbitrary code via a crafted Postscript document
that calls .sethalftone5 with an empty operand stack (CVE-2016-8602).

A heap based buffer overflow was found in the ghostscript
jbig2_decode_gray_scale_image() function used to decode halftone segments
in a JBIG2 image. A document (PostScript or PDF) with an embedded,
specially crafted, jbig2 image could trigger a segmentation fault in
ghostscript (CVE-2016-9601).

The pdf14_open function in base/gdevp14.c in Ghostscript 9.20 allows
remote attackers to cause a denial of service (use-after-free and
application crash) via a crafted file that is mishandled in the color
management module (CVE-2016-10217).

The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF
Transparency module in Ghostscript 9.20 allows remote attackers to cause
a denial of service (NULL pointer dereference and application crash) via
a crafted file (CVE-2016-10218).

The intersect function in base/gxfill.c in Ghostscript 9.20 allows
remote attackers to cause a denial of service (divide-by-zero error and
application crash) via a crafted file (CVE-2016-10219).

The gs_makewordimagedevice function in base/gsdevmem.c in Ghostscript
9.20 allows remote attackers to cause a denial of service (NULL pointer
dereference and application crash) via a crafted file that is mishandled
in the PDF Transparency module (CVE-2016-10220).

The mem_get_bits_rectangle function in base/gdevmem.c in Ghostscript
9.20 allows remote attackers to cause a denial of service (NULL pointer
dereference and application crash) via a crafted file (CVE-2017-5951).

The mem_get_bits_rectangle function in Ghostscript 9.20 allows remote
attackers to cause a denial of service (NULL pointer dereference) via a
crafted PostScript document (CVE-2017-7207).

Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command
execution via .rsdparams type confusion with a "/OutputFile (%pipe%"
substring in a crafted .eps document that is an input to the gs program
(CVE-2017-8291).

References:
- https://bugs.mageia.org/show_bug.cgi?id=19542
- http://openwall.com/lists/oss-security/2016/10/05/15
-
https://lists.fedoraproject.org/archives/list/package-ann...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7976
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7977
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7978
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7979
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8602
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9601
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10217
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10218
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10219
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10220
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5951
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7207
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8291

SRPMS:
- 5/core/ghostscript-9.20-1.mga5
- 5/core/gutenprint-5.2.10-5.1.mga5
- 5/core/libspectre-0.2.7-5.1.mga5