208999 CVE-2008-0411 2008-02-05 13:58 0000 app-text/ghostscript-* Stack-based buffer overflow in .seticcspace (CVE-2008-0411) 2008-03-08 18:30:41 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All Linux RESOLVED FIXED http://scary.beasts.org/security/CESA-2008-001.html A2 [glsa] P2 major --- 1 rbu@gentoo.org security@gentoo.org arm@gentoo.org corsair@gentoo.org dertobi123@gentoo.org fauli@gentoo.org ferdy@gentoo.org fmccor@gentoo.org genstef@gentoo.org jer@gentoo.org m68k@gentoo.org printing@gentoo.org pva@gentoo.org s390@gentoo.org sh@gentoo.org tgall@gentoo.org welp@gentoo.org rbu@gentoo.org 2008-02-05 13:58:41 0000 Stack-based buffer overflow in the zseticcspace() function in zicc.c, will result in arbitrary code execution. Currently under embargo, awaiting upstream patch. The $URL is private. rbu@gentoo.org 2008-02-14 02:28:20 0000 Tom and Stefan, can you please create an ebuild with the patch applied and attach it to this bug. Do not commit anything to CVS yet as long as this bug is under embargo. rbu@gentoo.org 2008-02-14 02:28:50 0000 Created an attachment (id=143467) ghostscript-8.60-CVE-2008-0411.diff rbu@gentoo.org 2008-02-24 11:17:28 0000 Tom and Stefan, can you please prepare an ebuild so we can test this before Feb. 27? pva@gentoo.org 2008-02-25 07:32:37 0000 Created an attachment (id=144554) ghostscript-gnu-8.60.0-r1.ebuild.patch I'll attach patch's for maintainer and others review. This one is for ghostscript-gnu. Other ghostscript packages will follow as soon as I test them... pva@gentoo.org 2008-02-25 08:57:02 0000 Created an attachment (id=144560) ghostscript-esp-8.15.4.ebuild.patch Patch for ghostscript-esp. Includes lot's of quotations fixes. pva@gentoo.org 2008-02-25 09:00:50 0000 Created an attachment (id=144561) ghostscript-gpl-8.61-r2.ebuild.patch And this is patch for ghostscript-gpl. But note during commit patch itself should go into ghostscript-gpl-8.61-patchset-4.tar.bz2. So this patch is for testing purposes only. rbu@gentoo.org 2008-02-25 16:05:59 0000 Arch Security Liaisons, please test the attached ebuilds and report stable on this bug. =app-text/ghostscript-esp-8.15.4-r1 Target keywords : "alpha amd64 arm hppa ia64 m68k mips ppc ppc64 release s390 sh sparc x86" =app-text/ghostscript-gnu-8.60.0-r2 Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 release sh sparc x86" =app-text/ghostscript-gpl-8.61-r3 Target keywords : "ppc64 release" CC'ing current Liaisons: alpha : ferdy amd64 : welp hppa : jer ppc : dertobi123 ppc64 : corsair release : pva sparc : fmccor x86 : opfer rbu@gentoo.org 2008-02-25 16:06:53 0000 Oh, and thanks Peter for preparing the ebuilds and doing some QA on the existing ones. jer@gentoo.org 2008-02-25 17:47:34 0000 Both are good for HPPA. fauli@gentoo.org 2008-02-25 17:51:23 0000 (In reply to comment #7) > Arch Security Liaisons, please test the attached ebuilds and report stable on > this bug. There is something wrong with the keywords: > =app-text/ghostscript-gpl-8.61-r3 > Target keywords : "ppc64 release" Especially this one. jer@gentoo.org 2008-02-25 17:55:49 0000 (In reply to comment #10) > (In reply to comment #7) > > Arch Security Liaisons, please test the attached ebuilds and report stable on > > this bug. > > There is something wrong with the keywords: > > =app-text/ghostscript-gpl-8.61-r3 > > Target keywords : "ppc64 release" > > Especially this one. Not just that - AFAIK ghostscript-esp is getting dropped somewhere in the future and this bug doesn't have an attachment that patches a ghostscript-esp ebuild. Also odd is that patch to a few ebuilds were posted instead of the new ebuilds themselves as is common practice. fauli@gentoo.org 2008-02-25 17:58:24 0000 (In reply to comment #11) > (In reply to comment #10) > > (In reply to comment #7) > > > Arch Security Liaisons, please test the attached ebuilds and report stable on > > > this bug. > > > > There is something wrong with the keywords: > > > =app-text/ghostscript-gpl-8.61-r3 > > > Target keywords : "ppc64 release" > > > > Especially this one. > > Not just that - AFAIK ghostscript-esp is getting dropped somewhere in the > future and this bug doesn't have an attachment that patches a ghostscript-esp > ebuild. It does. See comment #5. > Also odd is that patch to a few ebuilds were posted instead of the new ebuilds > themselves as is common practice. Not that bad. rbu@gentoo.org 2008-02-25 18:03:07 0000 (In reply to comment #10) > There is something wrong with the keywords: Yes, sorry. I mixed up gpl and gnu. =app-text/ghostscript-esp-8.15.4-r1 Target keywords : "alpha amd64 arm hppa ia64 m68k mips ppc ppc64 release s390 sh sparc x86" =app-text/ghostscript-gnu-8.60.0-r2 Target keywords : "ppc64 release" =app-text/ghostscript-gpl-8.61-r3 Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 release sh sparc x86" fauli@gentoo.org 2008-02-25 18:09:57 0000 Ok...-gpl and -esp fine on x86, they survived my stress test with different things on a really huge PostScript file. jer@gentoo.org 2008-02-25 18:15:39 0000 (In reply to comment #12) > It does. See comment #5. Ow, missed that. Sorry. > > Also odd is that patch to a few ebuilds were posted instead of the new ebuilds > > themselves as is common practice. > > Not that bad. It's bad when you require seven people to download and apply three patches individually - it's one more step to perform in testing each of the ebuilds. pva@gentoo.org 2008-02-25 18:28:03 0000 Jeroen I didn't knew that and will do next time. Right now I've downloaded 5 patches for shorewall* packages and believe me - patches are not so hard to use ;) Just 2-3 additional commands but they worth it as patch greatly simplify review. If that's necessary I can attach full ebuilds now. jer@gentoo.org 2008-02-26 04:22:32 0000 ghostscript-esp is good for HPPA too. dertobi123@gentoo.org 2008-02-26 19:55:47 0000 looks good on ppc ... corsair@gentoo.org 2008-02-28 08:33:09 0000 looks good on ppc64, too. fmccor@gentoo.org 2008-02-28 21:13:30 0000 ghostscript-gpl-8.61.r2 is good on sparc; the others look good on sparc. I also thought ghostscript-esp was either dying or dead, but it does look good. Why are we keeping it around? welp@gentoo.org 2008-02-28 21:51:44 0000 Looks good for amd64 too. rbu@gentoo.org 2008-02-29 08:54:28 0000 This is public now. Peter/Printing, can you commit this to the tree with the stable keywords mentioned here. I can re-cc the missing arches. pva@gentoo.org 2008-02-29 12:22:14 0000 Commited in the tree. Target keywords left: =app-text/ghostscript-esp-8.15.4-r1: "release, alpha, arm, ia64, m68k, mips, s390, sh" =app-text/ghostscript-gpl-8.61-r3: "release, alpha, arm, ia64, m68k, sh" Seems that the only reason to keep app-text/ghostscript-esp in the tree is that mips, s390 and sh still have not keyworded/stabilized app-text/ghostscript-{gpl,gnu}. armin76@gentoo.org 2008-03-01 20:21:17 0000 alpha/ia64 stable, Robert, i think i told you to cc me on restricted bugs, i hate you now! :P dirtyepic@gentoo.org 2008-03-01 22:18:18 0000 mips is going all ~arch. pva@gentoo.org 2008-03-02 08:32:11 0000 Fixed in release snapshot. jaervosz@gentoo.org 2008-03-02 15:26:05 0000 Seems ready for GLSA. tgurr@gentoo.org 2008-03-04 21:08:21 0000 Just a note: I committed ghostscript-gpl-8.62 to the tree a few minutes ago which had the fix applied upstream. py@gentoo.org 2008-03-08 18:30:41 0000 GLSA 200803-14 143467 2008-02-14 02:28 0000 ghostscript-8.60-CVE-2008-0411.diff ghostscript-8.60-CVE-2008-0411.diff text/plain LS0tIHNyYy96aWNjLmMKKysrIHNyYy96aWNjLmMJMjAwOC0wMi0wNSAxNjoxMTo1OS4wMDAwMDAw MDAgKzAwMDAKQEAgLTc3LDYgKzc3LDkgQEAgenNldGljY3NwYWNlKGlfY3R4X3QgKiBpX2N0eF9w KQogICAgIGRpY3RfZmluZF9zdHJpbmcob3AsICJOIiwgJnBudmFsKTsKICAgICBuY29tcHMgPSBw bnZhbC0+dmFsdWUuaW50dmFsOwogCisgICAgaWYgKDIqbmNvbXBzID4gc2l6ZW9mKHJhbmdlX2J1 ZmYpL3NpemVvZihmbG9hdCkpCisJcmV0dXJuX2Vycm9yKGVfcmFuZ2VjaGVjayk7CisKICAgICAv KiB2ZXJpZnkgdGhlIERhdGFTb3VyY2UgZW50cnkgKi8KICAgICBpZiAoZGljdF9maW5kX3N0cmlu ZyhvcCwgIkRhdGFTb3VyY2UiLCAmcHN0cm12YWwpIDw9IDApCiAgICAgICAgIHJldHVybl9lcnJv cihlX3VuZGVmaW5lZCk7Cg== 144554 2008-02-25 07:32 0000 ghostscript-gnu-8.60.0-r1.ebuild.patch ghostscript-gnu-8.60.0-r1.ebuild.patch text/plain LS0tIC91c3IvcG9ydGFnZS9hcHAtdGV4dC9naG9zdHNjcmlwdC1nbnUvZ2hvc3RzY3JpcHQtZ251 LTguNjAuMC1yMS5lYnVpbGQJMjAwNy0xMS0xNCAwOTozNTozMS4wMDAwMDAwMDAgKzAzMDAKKysr IGdob3N0c2NyaXB0LWdudS04LjYwLjAtcjIuZWJ1aWxkCTIwMDgtMDItMjUgMDk6NDI6NTIuMDAw MDAwMDAwICswMzAwCkBAIC01Niw2ICs1Niw3IEBACiAJY2QgIiR7U30iCiAKIAllcGF0Y2ggIiR7 RklMRVNESVJ9Ii9naG9zdHNjcmlwdC1DVkUtMjAwNy0yNzIxLnBhdGNoCisJZXBhdGNoICIke0ZJ TEVTRElSfSIvZ2hvc3RzY3JpcHQtOC42MC1DVkUtMjAwOC0wNDExLmRpZmYKIAogCSMgc2VhcmNo IHBhdGggZml4CiAJc2VkIC1pIC1lICJzOlwkXChnc2RhdGFkaXJcKS9saWI6L3Vzci9zaGFyZS9n aG9zdHNjcmlwdC8ke1BWTX0vJChnZXRfbGliZGlyKToiIFwK 144560 2008-02-25 08:57 0000 ghostscript-esp-8.15.4.ebuild.patch ghostscript-esp-8.15.4.ebuild.patch text/plain LS0tIC91c3IvcG9ydGFnZS9hcHAtdGV4dC9naG9zdHNjcmlwdC1lc3AvZ2hvc3RzY3JpcHQtZXNw LTguMTUuNC5lYnVpbGQJMjAwOC0wMi0wOSAxNTowNTozNy4wMDAwMDAwMDAgKzAzMDAKKysrIGdo b3N0c2NyaXB0LWVzcC04LjE1LjQtcjEuZWJ1aWxkCTIwMDgtMDItMjUgMTE6MjM6MTAuMDAwMDAw MDAwICswMzAwCkBAIC0yMiw3ICsyMiw3IEBACiAKIExJQ0VOU0U9IkdQTC0yIExHUEwtMiBDUEwt MS4wIgogU0xPVD0iMCIKLUtFWVdPUkRTPSJhbHBoYSB+YW1kNjQgfmhwcGEgaWE2NCB+bTY4ayB+ cHBjIHBwYzY0IHNwYXJjIHg4NiB+eDg2LWZic2QiCitLRVlXT1JEUz0ifmFscGhhIH5hbWQ2NCB+ aHBwYSB+aWE2NCB+bTY4ayB+cHBjIH5wcGM2NCB+c3BhcmMgfng4NiB+eDg2LWZic2QiCiBJVVNF PSJYIGN1cHMgY2prIGd0ayB0aHJlYWRzIHhtbCBkanZ1IgogCiBERVA9InZpcnR1YWwvbGliYwpA QCAtNTQsMjUgKzU0LDI3IEBACiBzcmNfdW5wYWNrKCkgewogCXVucGFjayAke0EvYWRvYmUtY21h cHMtMjAwNDA2LnRhci5neiBhY3JvNS1jbWFwcy0yMDAxLnRhci5nen0KIAlpZiB1c2UgY2prOyB0 aGVuCi0JCWNhdCAke0ZJTEVTRElSfS9naG9zdHNjcmlwdC1lc3AtOC4xNS4yLWNpZGZtYXAuY2pr ID4+ICR7U30vbGliL2NpZGZtYXAKLQkJY2F0ICR7RklMRVNESVJ9L2dob3N0c2NyaXB0LWVzcC04 LjE1LjItRkFQSWNpZGZtYXAuY2prID4+ICR7U30vbGliL0ZBUEljaWRmbWFwCi0JCWNkICR7U30v UmVzb3VyY2UKKwkJY2F0ICIke0ZJTEVTRElSfSIvZ2hvc3RzY3JpcHQtZXNwLTguMTUuMi1jaWRm bWFwLmNqayA+PiAiJHtTfSIvbGliL2NpZGZtYXAKKwkJY2F0ICIke0ZJTEVTRElSfSIvZ2hvc3Rz Y3JpcHQtZXNwLTguMTUuMi1GQVBJY2lkZm1hcC5jamsgPj4gIiR7U30iL2xpYi9GQVBJY2lkZm1h cAorCQljZCAiJHtTfSIvUmVzb3VyY2UKIAkJdW5wYWNrIGFkb2JlLWNtYXBzLTIwMDQwNi50YXIu Z3oKIAkJdW5wYWNrIGFjcm81LWNtYXBzLTIwMDEudGFyLmd6CiAJZmkKLQljZCAke1N9CisJY2Qg IiR7U30iCiAKIAkjIGh0dHA6Ly9jdXBzLm9yZy9lc3Bncy9zdHIucGhwP0wyMDAwCi0JZXBhdGNo ICR7RklMRVNESVJ9L2dob3N0c2NyaXB0LWVzcC04LjE1LjEtZlBJQy5wYXRjaAorCWVwYXRjaCAi JHtGSUxFU0RJUn0iL2dob3N0c2NyaXB0LWVzcC04LjE1LjEtZlBJQy5wYXRjaAorCisJZXBhdGNo ICIke0ZJTEVTRElSfSIvZ2hvc3RzY3JpcHQtOC42MC1DVkUtMjAwOC0wNDExLmRpZmYKIAogCWlm IHVzZSBkanZ1OyB0aGVuCiAJCXVucGFjayBnc2RqdnUtJHtHU0RKVlVfUFZ9LnRhci5negotCQlj cCBnc2RqdnUtJHtHU0RKVlVfUFZ9L2dzZGp2dSAke1N9Ci0JCWNwIGdzZGp2dS0ke0dTREpWVV9Q Vn0vZ2RldmRqdnUuYyAke1N9L3NyYwotCQljcCBnc2RqdnUtJHtHU0RKVlVfUFZ9L3BzMnV0Zjgu cHMgJHtTfS9saWIKLQkJY3AgJHtTfS9zcmMvY29udHJpYi5tYWsgJHtTfS9zcmMvY29udHJpYi5t YWsuZ3NkanZ1Ci0JCWdyZXAgLXEgZGp2dXNlcCAke1N9L3NyYy9jb250cmliLm1hayB8fCBcCi0J CQljYXQgZ3NkanZ1LSR7R1NESlZVX1BWfS9nc2RqdnUubWFrID4+ICR7U30vc3JjL2NvbnRyaWIu bWFrCisJCWNwIGdzZGp2dS0ke0dTREpWVV9QVn0vZ3NkanZ1ICIke1N9IgorCQljcCBnc2RqdnUt JHtHU0RKVlVfUFZ9L2dkZXZkanZ1LmMgIiR7U30iL3NyYworCQljcCBnc2RqdnUtJHtHU0RKVlVf UFZ9L3BzMnV0ZjgucHMgIiR7U30iL2xpYgorCQljcCAiJHtTfSIvc3JjL2NvbnRyaWIubWFrICIk e1N9Ii9zcmMvY29udHJpYi5tYWsuZ3NkanZ1CisJCWdyZXAgLXEgZGp2dXNlcCAiJHtTfSIvc3Jj L2NvbnRyaWIubWFrIHx8IFwKKwkJCWNhdCBnc2RqdnUtJHtHU0RKVlVfUFZ9L2dzZGp2dS5tYWsg Pj4gIiR7U30iL3NyYy9jb250cmliLm1hawogCWZpCiAKIAkjIHNlYXJjaCBwYXRoIGZpeApAQCAt MTE5LDEwICsxMjEsMTAgQEAKIAogCXVzZSBkanZ1ICYmIGRvYmluIGdzZGp2dQogCi0Jcm0gLWZy ICR7RH0vdXNyL3NoYXJlL2RvYy8ke1BGfS9odG1sL3tSRUFETUUsUFVCTElDfQorCXJtIC1mciAi JHtEfSIvdXNyL3NoYXJlL2RvYy8ke1BGfS9odG1sL3tSRUFETUUsUFVCTElDfQogCWRvZG9jIGRv Yy9SRUFETUUKIAotCWNkICR7U30vaWpzCisJY2QgIiR7U30iL2lqcwogCWVtYWtlIERFU1RESVI9 IiR7RH0iIGluc3RhbGwgfHwgZGllICJlbWFrZSBpanMgaW5zdGFsbCBmYWlsZWQiCiB9CiAK 144561 2008-02-25 09:00 0000 ghostscript-gpl-8.61-r2.ebuild.patch ghostscript-gpl-8.61-r2.ebuild.patch text/plain LS0tIGdob3N0c2NyaXB0LWdwbC04LjYxLXIyLmVidWlsZAkyMDA4LTAyLTI1IDA5OjI4OjU0LjAw MDAwMDAwMCArMDMwMAorKysgZ2hvc3RzY3JpcHQtZ3BsLTguNjEtcjMuZWJ1aWxkCTIwMDgtMDIt MjUgMTE6MTc6MTEuMDAwMDAwMDAwICswMzAwCkBAIC03Nyw2ICs3Nyw4IEBACiAJIyBhZGRpdGlv bmFsIEdlbnRvbyBwYXRjaCwgY29tcGlsZSBmaXgKIAllcGF0Y2ggIiR7V09SS0RJUn0vcGF0Y2hl cy8ke1BOfS04LjYxLXJpbmtqLnBhdGNoIgogCisJZXBhdGNoICIke0ZJTEVTRElSfSIvZ2hvc3Rz Y3JpcHQtOC42MC1DVkUtMjAwOC0wNDExLmRpZmYKKwogCWlmIHVzZSBiaW5kaXN0ICYmIHVzZSBk anZ1IDsgdGhlbgogCQlld2FybiAiWW91IGhhdmUgYmluZGlzdCBpbiB5b3VyIFVTRSwgZGp2dSBz dXBwb3J0IHdpbGwgTk9UIGJlIGNvbXBpbGVkISIKIAkJZXdhcm4gIlNlZSBodHRwOi8vZGp2dS5z b3VyY2Vmb3JnZS5uZXQvZ3NkanZ1L0NPUFlJTkcgZm9yIGRldGFpbHMgb24gbGljZW5zaW5nIGlz c3Vlcy4iCg==