RHSA-2018:3834 - Security Advisory

Topic

An update for ghostscript is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

• ghostscript: Incorrect free logic in pagedevice replacement (699664) (CVE-2018-16541)
• ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling (CVE-2018-16802)
• ghostscript: User-writable error exception table (CVE-2018-17183)
• ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183) (CVE-2018-17961)
• ghostscript: Saved execution stacks can leak operator arrays (CVE-2018-18073)
• ghostscript: 1Policy operator allows a sandbox protection bypass (CVE-2018-18284)
• ghostscript: Type confusion in setpattern (700141) (CVE-2018-19134)
• ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c (CVE-2018-19409)
• ghostscript: Uninitialized memory access in the aesdecode operator (699665) (CVE-2018-15911)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Tavis Ormandy (Google Project Zero) for reporting CVE-2018-16541.

Bug Fix(es):

• It has been found that ghostscript-9.07-31.el7_6.1 introduced regression during the handling of shading objects, causing a "Dropping incorrect smooth shading object" warning. With this update, the regression has been fixed and the described problem no longer occurs. (BZ#1657822)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x

Fixes

• BZ - 1625832 - CVE-2018-15911 ghostscript: Uninitialized memory access in the aesdecode operator (699665)
• BZ - 1625846 - CVE-2018-16541 ghostscript: Incorrect free logic in pagedevice replacement (699664)
• BZ - 1627959 - CVE-2018-16802 ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
• BZ - 1632471 - CVE-2018-17183 ghostscript: User-writable error exception table
• BZ - 1642578 - CVE-2018-17961 ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183)
• BZ - 1642584 - CVE-2018-18073 ghostscript: Saved execution stacks can leak operator arrays
• BZ - 1642940 - CVE-2018-18284 ghostscript: 1Policy operator allows a sandbox protection bypass
• BZ - 1652583 - CVE-2018-19409 ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c
• BZ - 1655599 - CVE-2018-19134 ghostscript: Type confusion in setpattern (700141)
• BZ - 1657822 - ghostscript: Regression: Warning: Dropping incorrect smooth shading object (Error: /rangecheck in --run--) [rhel-7.6.z]

CVEs

• CVE-2018-15911
• CVE-2018-16541
• CVE-2018-16802
• CVE-2018-17183
• CVE-2018-17961
• CVE-2018-18073
• CVE-2018-18284
• CVE-2018-19134
• CVE-2018-19409

References

• https://access.redhat.com/security/updates/classification/#important