From ae76035af8c990d008c6cc00378d0a4d3a8afc59 Mon Sep 17 00:00:00 2001 From: junovitch Date: Tue, 1 Sep 2015 22:12:57 +0000 Subject: Document denial of service (crash) via crafted Postscript files for Ghostscript PR: 202781 Security: CVE-2015-3228 Security: fc1f6658-4f53-11e5-934b-002590263bf5 Approved by: feld (mentor) --- security/vuxml/vuln.xml | 59 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 73fe006748f8..2bffba646168 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,65 @@ Notes: --> + + ghostscript -- denial of service (crash) via crafted Postscript files + + + ghostscript7 + ghostscript7-nox11 + ghostscript7-base + ghostscript7-x11 + 7.07_32 + + + ghostscript8 + ghostscript8-nox11 + ghostscript8-base + ghostscript8-x11 + 8.71_19 + + + ghostscript9 + ghostscript9-nox11 + ghostscript9-base + ghostscript9-x11 + 9.06_11 + + + ghostscript9-agpl + ghostscript9-agpl-nox11 + 9.15_2 + + + ghostscript9-agpl-base + ghostscript9-agpl-x11 + 9.16_2 + + + + +

MITRE reports:

+
Integer overflow in the gs_heap_alloc_bytes function in + base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote + attackers to cause a denial of service (crash) via a crafted + Postscript (ps) file, as demonstrated by using the ps2pdf command, + which triggers an out-of-bounds read or write.
+

+ + + + CVE-2015-3228 + http://bugs.ghostscript.com/show_bug.cgi?id=696041 + http://bugs.ghostscript.com/show_bug.cgi?id=696070 + http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859 + + + 2015-06-17 + 2015-08-30 + + + ffmpeg -- out-of-bounds array access -- cgit