oss-sec mailing list archives
Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?
From: Tavis Ormandy <taviso () google com>
Date: Mon, 27 Aug 2018 16:02:46 -0700
Here is an update, Artifex made a press release <https://www.darkreading.com/prnewswire2.asp?rkey=20180824UN89145&filter=3930> listing some necessary commits, but the list was incomplete. Here is a list of relevant commits I'm aware of so far, some issues are still open with working exploits available. It's my understanding that no new release is planned until late September, and vendors need to either ship a git snapshot when all issues are resolved, or apply patches. I have testcases for each problem, but I think the bugs will be visible eventually so I'm not posting them here. http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ea735ba37dc0fd5f5622d031830b9a559dec1cc9 # 699671 handling /undefined results in SEGV http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0edd3d6c63 # 699659 missing type check in ztype http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=78911a01b6 # 699654 A /invalidaccess checks stop working after a failed restore http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5516c614dc33 # 699654 B /invalidaccess checks stop working after a failed restore http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=79cccf641486 # 699654 C /invalidaccess checks stop working after a failed restore http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b326a716 # 699655 - missing type checking in setcolor http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=c3476dde # 699656 - LockDistillerParams boolean missing type checks http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a054156d42 # 699658 - Bypassing PermitFileReading by handling undefinedfilename errors http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0b6cd1918e1ec4ffd087400a754a845180a4522b # 699660 - shading_param incomplete type checking http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=e01e77a36cbb2e0277bc3a63852244bec41be0f6 # 699660 - shading_param incomplete type checking http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=c432131c3f # 699661 - pdf14 garbage collection memory corruption http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=971472c83a345a16dac9f90f91258bb22dd77f22 # 699663 - .setdistillerkeys memory corruption http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=241d911127 # 699664 - corrupt device object after error in job http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0d3901189f # 699657 - .tempfile SAFER restrictions seem to be broken http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=8e9ce5016db968b40e4ec255a3005f2786cce45f # 699665 - memory corruption in aesdecode http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b575e1ec42 # 699668 - .definemodifiedfont memory corruption if /typecheck is handled Tavis On Thu, Aug 23, 2018 at 8:05 AM Bob Friesenhahn < bfriesen () simple dallas tx us> wrote:
On Thu, 23 Aug 2018, Leonardo Taccari wrote:(Regarding the `file.ps2' and `file.ps3' examples without `PS2:' or `PS3:' prefixes according `convert -debug Policy -log "%e"' it seems that they ends up as: Domain: Coder; rights=Read; pattern="PS" ... ...so should be blocked by the workaround described in VU#332928. But please correct me if I'm wrong.)This is likely due to header magic detection (e.g. "%!PS-Adobe"). It is possible that a different path will be taken if the common Postscript header is not detected. The file extension may then be used as a hint. Also, there are a wide varieties of ImageMagick versions in use, with a wide variety of behaviors. The version of ImageMagick provided by the Ubuntu Linux I am using at this moment dates from 2012! Bob -- Bob Friesenhahn bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/ GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Current thread:
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default?, (continued)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Aug 21)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? AmitB (Aug 22)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Bob Friesenhahn (Aug 22)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Aug 22)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Leonardo Taccari (Aug 23)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Mateusz Lenik (Aug 23)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Leonardo Taccari (Aug 23)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Bob Friesenhahn (Aug 23)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Leonardo Taccari (Aug 23)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Bob Friesenhahn (Aug 23)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Aug 27)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Perry E. Metzger (Aug 27)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Marcus Meissner (Aug 28)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Aug 29)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Aug 29)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Marcus Meissner (Sep 03)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Sep 04)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Sep 04)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Brandon Perry (Sep 04)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Sep 04)
- Re: Re: More Ghostscript Issues: Should we disable PS coders in policy.xml by default? Tavis Ormandy (Sep 05)