Bug 852944 (CVE-2022-2085)

Summary:	<app-text/ghostscript-gpl-9.56.1: null pointer dereference
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	codec, mgorny, printing
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://bugs.ghostscript.com/show_bug.cgi?id=704945
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=844115 https://bugs.gentoo.org/show_bug.cgi?id=851141
Whiteboard:	A3 [glsa+]
Package list:		Runtime testing required:	---
Bug Depends on:	862133
Bug Blocks:

Description John Helmert III archtester

2022-06-18 19:07:24 UTC

CVE-2022-2085:

A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an init_device_procs defined for the device that uses it as a prototype that depends upon the number of bits per pixel. For bpp > 64, mem_x_device is used and does not have an init_device_procs defined. This flaw allows an attacker to parse a large number of bits (more than 64 bits per pixel), which triggers a NULL pointer dereference flaw, causing an application to crash.

Patch: http://git.ghostscript.com/?p=ghostpdl.git;h=ae1061d948d88667bdf51d47d918c4684d0f67df

Comment 1 Michał Górny archtester

2022-06-18 19:24:29 UTC

We should backport the patch, 9.56.1 is completely useless.

Comment 2 John Helmert III archtester

2022-11-18 20:58:37 UTC

GLSA request filed

Comment 3 Larry the Git Cow gentoo-dev

2022-11-22 04:01:26 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=ae2df9a36eb30967fc9dd392f63bc7af60249272

commit ae2df9a36eb30967fc9dd392f63bc7af60249272
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-11-22 03:53:57 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-11-22 03:59:40 +0000

    [ GLSA 202211-11 ] GPL Ghostscript: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/812509
    Bug: https://bugs.gentoo.org/852944
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202211-11.xml | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

Comment 4 John Helmert III archtester

2022-11-22 04:06:47 UTC

GLSA released, waiting for cleanup