Re: Re: Ghostscript 9.24 issues

[Marcus Meissner <meissner () suse de>]

On Sun, Sep 09, 2018 at 12:26:01PM -0700, Tavis Ormandy wrote:
> On Sat, Sep 8, 2018 at 3:42 AM Marius Bakke <mbakke () fastmail com> wrote:
>
> > Tavis Ormandy <taviso () google com> writes:
> >
> > > Quick update, this
> > > <http://git.ghostscript.com/?p=ghostpdl.git&a=commitdiff&h=5812b1b78fc4>
> > > commit fixes that problem, but I noticed that fix is incomplete and can
> > be
> > > bypassed, so filed another bug for that (the new bug is 699718).
> >
> > I see <https://bugs.chromium.org/p/project-zero/issues/detail?id=1640>
> > is now closed.  As far as I can tell, these are the (only) commits
> > necessary on top of 9.24[*]:
> >
> >
> > https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5812b1b78fc4d36fdc293b7859de69241140d590
> >
> > https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=3e5d316b72e3965b7968bb1d96baa137cd063ac6
> >
> > https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=643b24dbd002fb9c131313253c307cf3951b3d47
> >
> > Which are all variations of CVE-2018-16509.  Is my understanding correct?

Mitre has assigned CVE-2018-16802 to these 3 commits.

Ciao, Marcus