From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alex Vong Subject: Re: ghostscript vulnerabilities Date: Sun, 16 Oct 2016 23:47:39 +0800 Message-ID: <87twcc5m90.fsf@gmail.com> References: <87insx37ss.fsf@gmail.com> <87mvi9l17x.fsf@gnu.org> <87a8e6jc6q.fsf@netris.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42391) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bvnfT-0000qj-Jg for guix-devel@gnu.org; Sun, 16 Oct 2016 11:48:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bvnfS-0004XH-Hi for guix-devel@gnu.org; Sun, 16 Oct 2016 11:48:07 -0400 In-Reply-To: (Didier Link's message of "Sun, 16 Oct 2016 11:16:44 +0200") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Didier Link Cc: guix-devel@gnu.org, bug-ghostscript@gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hello, I notice the patch for CVE-2016-7977[0] handles the problem differently than GNU Ghostscript[1] does. Maybe you can take a look at it. [0]: http://git.ghostscript.com/?p=3Dghostpdl.git;a=3Dcommitdiff;h=3D8abd22= 010eb4db0fb1b10e430d5f5d83e015ef70 [1]: http://git.savannah.gnu.org/cgit/ghostscript.git/tree/psi/zfile.c Thanks, Alex Didier Link writes: > Hello all > > I will review the Mark's patches and apply them for a security release ne= xt week. > > Thanks for your help ! > > Best regards > > Didier > > Le 15/10/2016 =C3=A0 09:36, Mark H Weaver a =C3=A9crit : > > ludo@gnu.org (Ludovic Court=C3=A8s) writes: > > Hello Didier and all, > > We are wondering about the applicability to GNU=C2=A0Ghostscript of the > recent vulnerabilities discovered in AGPL=C2=A0Ghostscript: > > Alex Vong skribis: > > Salvatore Bonaccorso writes: > > ------------------------------------------------------------------------- >=20=20 > Debian Security Advisory DSA-3691-1 security@debian.org > https://www.debian.org/security/ Salvatore Bonaccorso > October 12, 2016 https://www.debian.org/security/faq > ------------------------------------------------------------------------- > > Package : ghostscript > CVE ID : CVE-2013-5653 CVE-2016-7976 CVE-2016-7977 CVE-2016-7978= =20 > CVE-2016-7979 CVE-2016-8602 > Debian Bug : 839118 839260 839841 839845 839846 840451 > > Several vulnerabilities were discovered in Ghostscript, the GPL > PostScript/PDF interpreter, which may lead to the execution of arbitrary > code or information disclosure if a specially crafted Postscript file is > processed. > > [...] > > I've checked just now. GNU Ghostscript is also affected at least by > CVE-2016-8602. Looking at the patch in this bug report[0] and the > source[1], one can see that the vulnerable lines are present in GNU > Ghostscript. What should we do now? > > [0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D840451 > [1]: http://git.savannah.gnu.org/cgit/ghostscript.git/tree/psi/zht2.c > > WDYT? Perhaps a new release incorporating the fixes is in order? > > FYI, I ported the upstream patches to GNU ghostscript for GNU Guix. > You can find them here: > > http://git.savannah.gnu.org/cgit/guix.git/commit/?id=3D1de17a648fa631f007= 4d315bfff0716220ce4880 > > Mark --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJYA6EbAAoJEMWKuHkX9RGuanYP/icemWPmz0BWQ5M/609MvCH/ Sl79Kzx9SfMD+U5MFm4VonPuUWWSrdqGDTv6vmhfiEtrX8O9p41EoyuWkYd3eTSo rTaeP3zHfY1YwKAP2XAtd39wwNkF/k8mCe59ukUTpowiAr3ls4uTLUU7Uz5YXXnO z6ixOvShKB5aDUGfOPS74FJxJihYxN4t95VRkSgLJjYzdlPCOhtpQC5EoAA/Dt7o jJ0gTjdgwh7aiwzkwe5lFD3g7RMdIkeph2IANz/i3vadF1Mp1TdLNyXfgBxlIn79 uGwhXS2B7VCbmLCyC+QMaONI3U1nHbRERFd6B0/bYfE19vUJTy8CUWG4e3/7KU0T NFXlMJ2z8GI6PxNt7PyubTAWFXmzyV03ktHWv3Xd4x3ve1GDchrSWhlPheNZc3lZ xdPnO92qtZiGFlQ5bjjpz/FkM2FHzRinecZWAKaUcMnFS+U2ll0BLp6VLKkJeYIU v6HXkHBXLQqdsNi/cc6MluoXRCkfNxiZzTFnNY2Ged7+9iEoc7zu185w7PTYt+rZ 9AGunvWeFdNl2vAx5lyISgtJiNOI4feGP8XRICZ9OK5N6bDnb+hR7eBDdQUwFWRJ zSD+VQK74vZ6Ip+lG2l5u5WVBaQzMB6C6rvZEil4yAqpR3GYXgAjrdU9OjzdDYsh 7ujdpLVAQRDNN4EVRNPi =vOTW -----END PGP SIGNATURE----- --=-=-=--