From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: ghostscript vulnerabilities Date: Sat, 15 Oct 2016 03:36:45 -0400 Message-ID: <87a8e6jc6q.fsf@netris.org> References: <87insx37ss.fsf@gmail.com> <87mvi9l17x.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:44741) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bvJWr-0004YT-QG for guix-devel@gnu.org; Sat, 15 Oct 2016 03:37:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bvJWn-0000o9-Ge for guix-devel@gnu.org; Sat, 15 Oct 2016 03:37:12 -0400 In-Reply-To: <87mvi9l17x.fsf@gnu.org> ("Ludovic \=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\= \=\?utf-8\?Q\?s\?\= message of "Wed, 12 Oct 2016 23:13:54 +0200") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Ludovic =?utf-8?Q?Court=C3=A8s?= Cc: didier@famille-link.fr, guix-devel@gnu.org, bug-ghostscript@gnu.org ludo@gnu.org (Ludovic Court=C3=A8s) writes: > Hello Didier and all, > > We are wondering about the applicability to GNU=C2=A0Ghostscript of the > recent vulnerabilities discovered in AGPL=C2=A0Ghostscript: > > Alex Vong skribis: > >> Salvatore Bonaccorso writes: >> >>> -----------------------------------------------------------------------= -- >>> Debian Security Advisory DSA-3691-1 security@debian.o= rg >>> https://www.debian.org/security/ Salvatore Bonaccor= so >>> October 12, 2016 https://www.debian.org/security/f= aq >>> -----------------------------------------------------------------------= -- >>> >>> Package : ghostscript >>> CVE ID : CVE-2013-5653 CVE-2016-7976 CVE-2016-7977 CVE-2016-797= 8=20 >>> CVE-2016-7979 CVE-2016-8602 >>> Debian Bug : 839118 839260 839841 839845 839846 840451 >>> >>> Several vulnerabilities were discovered in Ghostscript, the GPL >>> PostScript/PDF interpreter, which may lead to the execution of arbitrary >>> code or information disclosure if a specially crafted Postscript file is >>> processed. > > [...] > >> I've checked just now. GNU Ghostscript is also affected at least by >> CVE-2016-8602. Looking at the patch in this bug report[0] and the >> source[1], one can see that the vulnerable lines are present in GNU >> Ghostscript. What should we do now? >> >> [0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D840451 >> [1]: http://git.savannah.gnu.org/cgit/ghostscript.git/tree/psi/zht2.c > > WDYT? Perhaps a new release incorporating the fixes is in order? FYI, I ported the upstream patches to GNU ghostscript for GNU Guix. You can find them here: http://git.savannah.gnu.org/cgit/guix.git/commit/?id=3D1de17a648fa631f0074d= 315bfff0716220ce4880 Mark