Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 904245 (CVE-2023-28879) - <app-text/ghostscript-gpl-10.01.1: Shell in the Ghost vulnerability
Summary: <app-text/ghostscript-gpl-10.01.1: Shell in the Ghost vulnerability
Status: RESOLVED FIXED
Alias: CVE-2023-28879
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: https://offsec.almond.consulting/ghos...
Whiteboard: A2 [glsa+]
Keywords:
Depends on: 904246
Blocks:
  Show dependency tree
 
Reported: 2023-04-13 01:05 UTC by Sam James
Modified: 2023-09-17 05:28 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-04-13 01:05:54 UTC
From https://www.openwall.com/lists/oss-security/2023/04/12/4:
"""
> Artifex Ghostscript, version 10.01.0. A CVE (Common Vulnerabilities
> and Exposures) identifier has been assigned to the issue,
> https://nvd.nist.gov/vuln/detail/CVE-2023-28879 [2].
> On March 23, 2023, a security researcher, Hadrien Perrineau,
> reported
> the buffer overflow and exploit, on March 24 Artifex fixed the overflow
> and removed other related code reducing the attack surface. Fixes were
> published here:
> https://git.ghostscript.com/?p=ghostpdl.git;h=37ed5022cecd584de868933b5b60da2e995b3179 [3]
> https://git.ghostscript.com/?p=ghostpdl.git;h=37ed5022cecd584de868933b5b60da2e995b3179 [4]
> A release, Ghostscript and GhostPDL 10.01.1, was published on March
> 27.
> An email alert was sent out to all Artifex customers on March 27
> notifying them of the bug and the fix. Artifex worked with customers to
> integrate the solution into their products as quickly as possible.
> On April 7 the bug was made public.
> Users of Ghostscript are urged to update their software to the
> latest
> version immediately. By doing so, they will be able to mitigate the risk
> associated with this vulnerability and ensure the security and integrity
> of their systems.

A report from those who found the bug, including their POC, was published
yesterday:

https://offsec.almond.consulting/ghostscript-cve-2023-28879.html [5]
"""
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2023-04-13 01:07:18 UTC
>In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-07-25 03:31:00 UTC
GLSA request filed
Comment 3 Larry the Git Cow gentoo-dev 2023-09-17 05:26:33 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=9c38541fc770d5ef98f0327092ae33c0bab71167

commit 9c38541fc770d5ef98f0327092ae33c0bab71167
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-09-17 05:24:21 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-09-17 05:26:26 +0000

    [ GLSA 202309-03 ] GPL Ghostscript: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/904245
    Bug: https://bugs.gentoo.org/910294
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202309-03.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
Comment 4 Larry the Git Cow gentoo-dev 2023-09-17 05:28:39 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=06aefb6bdc737876b90bc434f910484b735facf9

commit 06aefb6bdc737876b90bc434f910484b735facf9
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-09-17 05:28:29 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-09-17 05:28:32 +0000

    app-text/ghostscript-gpl: drop 10.0.0-r5, 10.01.0
    
    Bug: https://bugs.gentoo.org/904245
    Signed-off-by: Sam James <sam@gentoo.org>

 app-text/ghostscript-gpl/Manifest                  |   2 -
 .../ghostscript-gpl-10.0.0-r5.ebuild               | 194 ---------------------
 .../ghostscript-gpl/ghostscript-gpl-10.01.0.ebuild | 190 --------------------
 3 files changed, 386 deletions(-)