Bug 31758 - ghostscript new security issue CVE-2023-28879
Summary: ghostscript new security issue CVE-2023-28879
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2023-04-05 02:13 CEST by David Walser
Modified: 2023-04-13 17:03 CEST (History)
7 users (show)

See Also:
Source RPM: ghostscript-9.53.3-2.3.mga8.src.rpm
CVE: CVE-2023-28879
Status comment:


Attachments

Description David Walser 2023-04-05 02:13:22 CEST
Debian-LTS has issued an advisory today (April 4):
https://www.debian.org/lts/security/2023/dla-3381

Mageia 8 is also affected.
David Walser 2023-04-05 02:13:30 CEST

Whiteboard: (none) => MGA8TOO

Comment 1 Marja Van Waes 2023-04-05 17:55:20 CEST
Assigning to all packagers collectively, since there is no registered maintainer for this package.

CC: (none) => marja11
Assignee: bugsquad => pkg-bugs

Comment 2 Nicolas Salguero 2023-04-06 10:53:10 CEST
Suggested advisory:
========================

The updated packages fix a security vulnerability:

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written. (CVE-2023-28879)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28879
https://www.debian.org/lts/security/2023/dla-3381
========================

Updated packages in core/updates_testing:
========================
ghostscript-9.53.3-2.4.mga8
ghostscript-X-9.53.3-2.4.mga8
ghostscript-common-9.53.3-2.4.mga8
ghostscript-dvipdf-9.53.3-2.4.mga8
ghostscript-doc-9.53.3-2.4.mga8
ghostscript-module-X-9.53.3-2.4.mga8
lib(64)gs9-9.53.3-2.4.mga8
lib(64)gs-devel-9.53.3-2.4.mga8
lib(64)ijs1-0.35-162.4.mga8
lib(64)ijs-devel-0.35-162.4.mga8

from SRPM:
ghostscript-9.53.3-2.4.mga8.src.rpm

CC: (none) => nicolas.salguero
CVE: (none) => CVE-2023-28879
Version: Cauldron => 8
Source RPM: ghostscript-10.00.0-5.mga9.src.rpm => ghostscript-9.53.3-2.3.mga8.src.rpm
Whiteboard: MGA8TOO => (none)
Status: NEW => ASSIGNED
Assignee: pkg-bugs => qa-bugs

Comment 3 David Walser 2023-04-06 18:51:19 CEST
Debian has issued an advisory for this on April 5:
https://www.debian.org/security/2023/dsa-5383
Comment 4 Morgan Leijström 2023-04-07 08:51:31 CEST
mga8-64 OK simple test

Clean update of the packages this system had installed, to

- ghostscript-9.53.3-2.4.mga8.x86_64
- ghostscript-common-9.53.3-2.4.mga8.x86_64
- ghostscript-module-X-9.53.3-2.4.mga8.x86_64
- lib64gs9-9.53.3-2.4.mga8.x86_64

rebooted

Printing works

$ gs some.pdf
opens that pdf in a window.

CC: (none) => fri

PC LX 2023-04-07 21:40:29 CEST

CC: (none) => mageia

Comment 5 Thomas Andrews 2023-04-09 16:14:19 CEST
 An additional test using VirtualBox:

No installation issues in the MGA8-64 guest.

It was determined in Bug 22590 that Okular uses ghostscript libraries to render .ps files, so I loaded a simple .ps file from a shared folder on the host machine, which rendered correctly. I then saved a copy in the guest's home directory as a .ps file, closed Okular, and displayed the file using ghostscript-x's gs command. Looked good.

Giving this an OK, and validating. Advisory in comment 2.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs
Whiteboard: (none) => MGA8-64-OK

Dave Hodgins 2023-04-11 00:49:36 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 6 Mageia Robot 2023-04-11 21:03:50 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0134.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED

Comment 7 David Walser 2023-04-13 17:03:28 CEST
More details about this were posted on oss-security yesterday:
https://www.openwall.com/lists/oss-security/2023/04/12/4

Note You need to log in before you can comment on or make changes to this bug.