From 858683345a0c6b150f6f2992de92a3d10c4a701e Mon Sep 17 00:00:00 2001 From: Zdenek Dohnal Date: Wed, 17 Jul 2024 08:44:35 +0200 Subject: [PATCH] RHEL-46575 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction Resolves: RHEL-46575 --- 0001-Bug-707691.patch | 43 +++++++++++++++++++++++++++++++++++++++++++ ghostscript.spec | 7 ++++++- 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 0001-Bug-707691.patch diff --git a/0001-Bug-707691.patch b/0001-Bug-707691.patch new file mode 100644 index 0000000..65c01cc --- /dev/null +++ b/0001-Bug-707691.patch @@ -0,0 +1,43 @@ +diff --git a/base/gpmisc.c b/base/gpmisc.c +index c4a69b0..b0d5c71 100644 +--- a/base/gpmisc.c ++++ b/base/gpmisc.c +@@ -1090,6 +1090,27 @@ gp_validate_path_len(const gs_memory_t *mem, + rlen = len; + } + else { ++ char *test = (char *)path, *test1; ++ uint tlen = len, slen; ++ ++ /* Look for any pipe (%pipe% or '|' specifications between path separators ++ * Reject any path spec which has a %pipe% or '|' anywhere except at the start. ++ */ ++ while (tlen > 0) { ++ if (test[0] == '|' || (tlen > 5 && memcmp(test, "%pipe", 5) == 0)) { ++ code = gs_note_error(gs_error_invalidfileaccess); ++ goto exit; ++ } ++ test1 = test; ++ slen = search_separator((const char **)&test, path + len, test1, 1); ++ if(slen == 0) ++ break; ++ test += slen; ++ tlen -= test - test1; ++ if (test >= path + len) ++ break; ++ } ++ + rlen = len+1; + bufferfull = (char *)gs_alloc_bytes(mem->thread_safe_memory, rlen + prefix_len, "gp_validate_path"); + if (bufferfull == NULL) +@@ -1164,8 +1185,8 @@ gp_validate_path_len(const gs_memory_t *mem, + + continue; + } +- else if (code < 0 && cdirstrl > 0 && prefix_len == 0 && buffer == bufferfull) { +- buffer = bufferfull + cdirstrl + dirsepstrl; ++ else if (code < 0 && cdirstrl > 0 && prefix_len == 0 && buffer == bufferfull ++ && memcmp(buffer, cdirstr, cdirstrl) && !memcmp(buffer + cdirstrl, dirsepstr, dirsepstrl)) { + continue; + } + break; diff --git a/ghostscript.spec b/ghostscript.spec index 08a694f..5146cd9 100644 --- a/ghostscript.spec +++ b/ghostscript.spec @@ -45,7 +45,7 @@ Name: ghostscript Summary: Interpreter for PostScript language & PDF Version: 10.02.1 -Release: 12%{?dist} +Release: 13%{?dist} License: AGPL-3.0-or-later @@ -127,6 +127,8 @@ Patch: 0001-Bug-707510-3-Bounds-checks-when-using-CIDFont-relate.patch Patch: 0001-Bug-707510-don-t-allow-PDF-files-with-bad-Filters-to.patch # RHEL-44727 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass) Patch: 0001-Uniprint-device-prevent-string-configuration-changes.patch +# RHEL-46575 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction +Patch: 0001-Bug-707691.patch # Downstream patches -- these should be always included when doing rebase: # ------------------ @@ -443,6 +445,9 @@ done # ============================================================================= %changelog +* Wed Jul 17 2024 Zdenek Dohnal - 10.02.1-13 +- RHEL-46575 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction + * Tue Jul 16 2024 Zdenek Dohnal - 10.02.1-12 - RHEL-46149 CVE-2024-29509 ghostscript: heap buffer overflow via the PDFPassword parameter - RHEL-46131 CVE-2024-29508 ghostscript: heap pointer leak in pdf_base_font_alloc()