ArchLinux: 201904-5: ghostscript: sandbox escape
Summary
- CVE-2019-3835 (sandbox escape)
It was found that the superexec operator was available in the internal
dictionary. A specially crafted PostScript file could use this flaw in
order to, for example, have access to the file system outside of the
constrains imposed by -dSAFER.
- CVE-2019-3838 (sandbox escape)
It was found that the forceput operator could be extracted from the
DefineResource method using methods similar to the ones described in
CVE-2019-6116. A specially crafted PostScript file could use this flaw
in order to, for example, have access to the file system outside of the
constrains imposed by -dSAFER.
Resolution
Upgrade to 9.27-1.
# pacman -Syu "ghostscript>=9.27-1"
The problems have been fixed upstream in version 9.27.
References
https://bugs.archlinux.org/task/62102 https://git.ghostscript.com/;a=commitdiff;h=2055917 https://git.ghostscript.com/;a=commitdiff;h=d683d1e6 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd95bb01 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e8f95a https://security.archlinux.org/CVE-2019-3835 https://security.archlinux.org/CVE-2019-3838
Workaround
None.