[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#793489: marked as done (ghostscript: CVE-2015-3228: Integer overflow)

Your message dated Sun, 02 Aug 2015 17:47:20 +0000
with message-id <E1ZLxM0-0003v2-VP@franck.debian.org>
and subject line Bug#793489: fixed in ghostscript 9.06~dfsg-2+deb8u1
has caused the Debian Bug report #793489,
regarding ghostscript: CVE-2015-3228: Integer overflow
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
793489: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=793489
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: ghostscript
Severity: important
Tags: security patch

Hi,

the following vulnerability was published for ghostscript.

CVE-2015-3228[0]: Integer overflow

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-3228
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3228
    Please adjust the affected versions in the BTS as needed.

All the versions in Debian are affected by the underlying problem
in the memory allocation (see
http://bugs.ghostscript.com/show_bug.cgi?id=696070) but experimental
(9.15~rc1~dfsg-1) does not trigger the segfault due do other changes.

You can reproduce the problem with this:
$ wget http://bugs.ghostscript.com/attachment.cgi?id=11776 -O /tmp/test.ps
$ ps2pdf /tmp/test.ps
Segmentation fault

The suggested patch is here:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: http://www.freexian.com/services/debian-lts.html
Learn to master Debian: http://debian-handbook.info/get/

--- End Message ---
--- Begin Message --- 
Source: ghostscript
Source-Version: 9.06~dfsg-2+deb8u1

We believe that the bug you reported is fixed in the latest version of
ghostscript, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 793489@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated ghostscript package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 26 Jul 2015 14:03:18 +0200
Source: ghostscript
Binary: ghostscript ghostscript-x ghostscript-doc libgs9 libgs9-common libgs-dev ghostscript-dbg
Architecture: source all amd64
Version: 9.06~dfsg-2+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Debian Printing Team <debian-printing@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description:
 ghostscript - interpreter for the PostScript language and for PDF
 ghostscript-dbg - interpreter for the PostScript language and for PDF - Debug symbo
 ghostscript-doc - interpreter for the PostScript language and for PDF - Documentati
 ghostscript-x - interpreter for the PostScript language and for PDF - X11 support
 libgs-dev  - interpreter for the PostScript language and for PDF - Development
 libgs9     - interpreter for the PostScript language and for PDF - Library
 libgs9-common - interpreter for the PostScript language and for PDF - common file
Closes: 793489
Changes:
 ghostscript (9.06~dfsg-2+deb8u1) jessie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Add CVE-2015-3228.patch patch.
     CVE-2015-3228: Integer overflow in gs_heap_alloc_bytes() (Closes: #793489)
Checksums-Sha1:
 0b321b3d2706315968d853fb7d1d2936db1d5952 2875 ghostscript_9.06~dfsg-2+deb8u1.dsc
 0599b1ceb95f6b0215c4db0031645c9f2a5f8542 18454793 ghostscript_9.06~dfsg.orig.tar.gz
 0dcd1577bd3213bef3f4eb179d520b4e1e27f77e 93124 ghostscript_9.06~dfsg-2+deb8u1.debian.tar.xz
 bf0c0f35e7bcf5585ba9c7159e9b41efd6b84565 5066770 ghostscript-doc_9.06~dfsg-2+deb8u1_all.deb
 06f0133d79b1a22b310046b3edc00972c29b5c4b 1979092 libgs9-common_9.06~dfsg-2+deb8u1_all.deb
Checksums-Sha256:
 02a54072aa10b8de4a30681f2ef51065c5fb5b9501c1c482191eec4cec10eccc 2875 ghostscript_9.06~dfsg-2+deb8u1.dsc
 4a98384df28f0a1cc90943292714311ce33d600c6358c24c80e182a40592dbbf 18454793 ghostscript_9.06~dfsg.orig.tar.gz
 1bd081e3f4305dc5a2b6a6257646f2bdaf0d9c5a1a352798cb0e61d902f8a4ad 93124 ghostscript_9.06~dfsg-2+deb8u1.debian.tar.xz
 06c94eaa384e8b2fc7f034f480a202f8f3b15059c955a4ae6310f68754972017 5066770 ghostscript-doc_9.06~dfsg-2+deb8u1_all.deb
 82382c18b1282970215bfdacbaaa49f0cfc1d006bc9e04af2c025763443fac63 1979092 libgs9-common_9.06~dfsg-2+deb8u1_all.deb
Files:
 faf5fec3e809127c63a5b5be171986f3 2875 text optional ghostscript_9.06~dfsg-2+deb8u1.dsc
 68d22f8b67369af932d9f0a396a1f63d 18454793 text optional ghostscript_9.06~dfsg.orig.tar.gz
 1ceb17b0df71c0ee3d126c156065169f 93124 text optional ghostscript_9.06~dfsg-2+deb8u1.debian.tar.xz
 a145398017040b40d9f9605e2d4f7f35 5066770 doc optional ghostscript-doc_9.06~dfsg-2+deb8u1_all.deb
 52368504114ae9276ca0c8b024ca46a7 1979092 libs optional libgs9-common_9.06~dfsg-2+deb8u1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVvGI+AAoJEAVMuPMTQ89EproQAJxu1c+zYiE9LCngzcJntRQ9
76wyeJ+gF73pVUOrDBJG0BTvjMRw4L3oZRELNdUyUm3R0IwrdiRSfsHeHc7vj47z
2YucnFZnQXKAo/JqmhV0QkNkAKKPh+n4CEx3J5jEZjhx+V1hOHgLHKSCF93ZPir+
QOt+ramYYW2Z467UZ85ttUQ1TcMY1JXnskbtcwp+Oe/VN+rbAhqBXaeNBVxgYJdA
+G13TlGr8iCcKmm9IkfTxNJTCJ6FZ0aOkcWETAZ+kVlX+r+TU9vCvU98Bl4W0Rbx
jHz06uMTJCFb+pl4MCdGWLc2aOfLJDYv6HdLQaDTzDLwjrJBeDPCHvv8riJurRRM
HA5Vu9lWjo+YYjbW2ZZMmiz9e3F/Dtf0QjSLGpAMdnh0OfMFWbIevijEVVzKhQqR
IiXqXFneoCXlgL5YqdvaqAkCRcXhUf9jczy5OJHKHQf8BWW9/iPY5AapOPbXjJbp
kvgC9UK2ucqR51ccu3mmpy0ZuUXLX5nHlOYEFcWlgQqqYh27wABTONhNchx/0V3V
y0NkAcJ1FBLqAf4zg7LKO0lWl3Dljmen/M9DmeW5mavWz3j+jeZQ2INNxsMhavoO
hz8C2hNE+WVDpUKeCRHANiTF53vN80NCOqta4S8COHW2NFojpNsFv3OLnlPdW8Bj
SZdB5lw1Ak4qLJhEywhw
=VIT2
-----END PGP SIGNATURE-----

--- End Message ---
Reply to: