Arch Linux: ASA-201904-5 High: Ghostscript Sandbox Escape

Arch Linux Security Advisory ASA-201904-5
========================================
Severity: High
Date    : 2019-04-11
CVE-ID  : CVE-2019-3835 CVE-2019-3838
Package : ghostscript
Type    : sandbox escape
Remote  : Yes
Link    : https://security.archlinux.org/AVG-929

Summary
======
The package ghostscript before version 9.27-1 is vulnerable to sandbox
escape.

Resolution
=========
Upgrade to 9.27-1.

# pacman -Syu "ghostscript>=9.27-1"

The problems have been fixed upstream in version 9.27.

Workaround
=========
None.

Description
==========
- CVE-2019-3835 (sandbox escape)

It was found that the superexec operator was available in the internal
dictionary.  A specially crafted PostScript file could use this flaw in
order to, for example, have access to the file system outside of the
constrains imposed by -dSAFER.

- CVE-2019-3838 (sandbox escape)

It was found that the forceput operator could be extracted from the
DefineResource method using methods similar to the ones described in
CVE-2019-6116. A specially crafted PostScript file could use this flaw
in order to, for example, have access to the file system outside of the
constrains imposed by -dSAFER.

Impact
=====
A remote attacker is able to escape the sandbox via a specially crafted
PostScript document.

References
=========
https://bugs.archlinux.org/task/62102




https://security.archlinux.org/CVE-2019-3835
https://security.archlinux.org/CVE-2019-3838