Bug 202781

Summary:

print/ghostscript7 *: security/vuxml: denial of service (crash) via crafted Postscript files (CVE-2015-3228)

Product:

Ports & Packages

Reporter:

Jason Unovitch <junovitch>

Component:

Individual Port(s)

Assignee:

Jason Unovitch <junovitch>

Status:

Closed FIXED

Severity:

Affects Some People

CC:

hrs

Priority:

---

Keywords:

security

Version:

Latest

Flags:

bugzilla: maintainer-feedback? (ports-secteam)

Hardware:

Any

OS:

Any

Attachments:

Description	Flags
print/ghostscript* backport CVE-2015-2015-3228 fixes from HEAD to 2015Q3	none
security/vuxml for ghostscript*	none

Description Jason Unovitch freebsd_committer

2015-08-30 21:18:13 UTC

Note this is already fixed in ports/head.  We just need the documentation and a backport of the fix.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3228

Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.

Comment 1 Jason Unovitch freebsd_committer

2015-08-30 21:26:19 UTC

Created attachment 160537 [details]
print/ghostscript* backport CVE-2015-2015-3228 fixes from HEAD to 2015Q3

Log:

Manual Merge security relevant change in r395047

- Apply fix for CVE-2015-3228, denial of service (crash) via crafted Postscript files.

Security: CVE-2015-3228
Security: fc1f6658-4f53-11e5-934b-002590263bf5
Approved by: TBD


Notes:
The patch is from `svn diff --show-copies-as-adds` just to help see the changes.  The version in my repository was produced by doing the commands at the bottom to get the fixes introduced by hrs@ in r395047.  My thought is since r395047 introduced such a large change to the ghostcript* ports that we should only apply the security relevant portion to quarterly.
svn copy svn+ssh://junovitch@repo.freebsd.org/ports/head/print/ghostscript7-base/files/patch-src-gsmalloc.c print/ghostscript7/files/
svn copy svn+ssh://junovitch@repo.freebsd.org/ports/head/print/ghostscript8-base/files/patch-base-gsmalloc.c print/ghostscript8/files/
svn copy svn+ssh://junovitch@repo.freebsd.org/ports/head/print/ghostscript9-base/files/patch-base-gsmalloc.c print/ghostscript9/files/
svn copy svn+ssh://junovitch@repo.freebsd.org/ports/head/print/ghostscript9-agpl-base/files/patch-base-gsmalloc.c print/ghostscript9-agpl/files/

Comment 2 Jason Unovitch freebsd_committer

2015-08-30 21:30:36 UTC

Created attachment 160538 [details]
security/vuxml for ghostscript*

Document denial of service (crash) via crafted Postscript files for Ghostscript

PR:		202781
Security:	CVE-2015-3228
Security:	fc1f6658-4f53-11e5-934b-002590263bf5
Approved by:	TBD

Validation:
% make validate
/bin/sh /usr/ports/security/vuxml/files/tidy.sh "/usr/ports/security/vuxml/files/tidy.xsl" "/usr/ports/security/vuxml/vuln.xml" > "/usr/ports/security/vuxml/vuln.xml.tidy"
>>> Validating...
/usr/local/bin/xmllint --valid --noout /usr/ports/security/vuxml/vuln.xml
>>> Successful.
Checking if tidy differs...
... seems okay
Checking for space/tab...
... seems okay
/usr/local/bin/python2.7 /usr/ports/security/vuxml/files/extra-validation.py /usr/ports/security/vuxml/vuln.xml

% env PKG_DBDIR=/usr/ports/security/vuxml pkg audit ghostscript9-9.06_10
ghostscript9-9.06_10 is vulnerable:
ghostscript -- denial of service (crash) via crafted Postscript files
CVE: CVE-2015-3228
WWW: https://vuxml.FreeBSD.org/freebsd/fc1f6658-4f53-11e5-934b-002590263bf5.html

1 problem(s) in the installed packages found.
% env PKG_DBDIR=/usr/ports/security/vuxml pkg audit ghostscript9-9.06_11
0 problem(s) in the installed packages found.

Comment 3 Jason Unovitch freebsd_committer

2015-08-30 21:35:07 UTC

Poudriere logs are too big of an attachment but I've validated build of the following list of ports on 2015Q3:

print/ghostscript7
print/ghostscript7-nox11
print/ghostscript8
print/ghostscript8-nox11
print/ghostscript9
print/ghostscript9-nox11
print/ghostscript9-agpl
print/ghostscript9-agpl-nox11

The full list was built on:
9.3-RELEASE-p23      amd64
9.3-RELEASE-p23      i386
10.1-RELEASE-p18     amd64
10.1-RELEASE-p18     i386
10.2-RELEASE-p1      amd64
10.2-RELEASE-p1      i386
11.0-CURRENT r286886 amd64
11.0-CURRENT r286888 i386

Comment 4 commit-hook freebsd_committer

2015-09-01 22:13:54 UTC

A commit references this bug:

Author: junovitch
Date: Tue Sep  1 22:12:58 UTC 2015
New revision: 395802
URL: https://svnweb.freebsd.org/changeset/ports/395802

Log:
  Document denial of service (crash) via crafted Postscript files for Ghostscript

  PR:		202781
  Security:	CVE-2015-3228
  Security:	fc1f6658-4f53-11e5-934b-002590263bf5
  Approved by:	feld (mentor)

Changes:
  head/security/vuxml/vuln.xml

Comment 5 commit-hook freebsd_committer

2015-09-01 23:16:00 UTC

A commit references this bug:

Author: junovitch
Date: Tue Sep  1 23:15:09 UTC 2015
New revision: 395804
URL: https://svnweb.freebsd.org/changeset/ports/395804

Log:
  MFH: r395047 (security relevant change only)

  - Apply fix for CVE-2015-3228, denial of service via crafted Postscript files.

  The security relevant change was applied manually as r395047 split the
  Ghostscript ports into separate X11-independent and -dependent parts.

  PR:		202781
  Security:	CVE-2015-3228
  Security:	fc1f6658-4f53-11e5-934b-002590263bf5
  Approved by:	ports-secteam (feld), feld,delphij (mentors)

Changes:
  branches/2015Q3/print/ghostscript7/Makefile
  branches/2015Q3/print/ghostscript7/files/patch-src-gsmalloc.c
  branches/2015Q3/print/ghostscript8/Makefile
  branches/2015Q3/print/ghostscript8/files/patch-base-gsmalloc.c
  branches/2015Q3/print/ghostscript9/Makefile
  branches/2015Q3/print/ghostscript9/files/patch-base-gsmalloc.c
  branches/2015Q3/print/ghostscript9-agpl/Makefile
  branches/2015Q3/print/ghostscript9-agpl/files/patch-base-gsmalloc.c

Comment 6 Jason Unovitch freebsd_committer

2015-09-02 00:34:16 UTC

Closing PR. r395047 had already covered the fix for ports/head.  r395802 and r395804 cover the documentation and 2015Q3.  No futher actions are needed.