huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-16640: ImageMagick: memory leak in ReadOneJNGImage function in coders/png.c
Component: ImageMagick
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-07-06T00:00:00+00:00

ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.

Statement: This issue affects the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-6
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 76efa969342568841ecf320b5a041685a6d24e0b
CVE-2018-16642: ImageMagick: out-of-bounds write in InsertRow function in coders/cut.c
Component: ImageMagick
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2018-06-01T00:00:00+00:00

The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial of service via a crafted image file due to an out-of-bounds write.

Statement: This issue affects the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: 7.0.7-39
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: cc4ac341f29fa368da6ef01c207deaf8c61f6a2e
CVE-2018-16643: ImageMagick: missing check for fputc function in multiple files
Component: ImageMagick
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-07-05T00:00:00+00:00

The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c, and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc function, which allows remote attackers to cause a denial of service via a crafted image file.

Statement: This issue affects the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-6
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 6b6bff054d569a77973f2140c0e86366e6168a6c
CVE-2018-16644: ImageMagick: improper check for length in ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c
Component: ImageMagick
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-08-27T00:00:00+00:00

There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image.

Statement: This issue affects the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-11
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: 16916c8979c32765c542e216b31cee2671b7afe7
CVE-2018-16645: ImageMagick: Out-of-memory ReadBMPImage of coders/bmp.c and ReadDIBImage of codes/dib.c
Component: ImageMagick
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-08-27T00:00:00+00:00

There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a crafted image file.

Statement: This issue affects the versions of ImageMagick as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: 7.0.8-11
Upstream repository: https://github.com/ImageMagick/ImageMagick
Upstream fix commit: ecb31dbad39ccdc65868d5d2a37f0f0521250832
CVE-2018-16658: kernel: Information leak in cdrom_ioctl_drive_status
Component: kernel
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2018-04-26T00:00:00+00:00

An information leak was discovered in the Linux kernel in cdrom_ioctl_drive_status() function in drivers/cdrom/cdrom.c that could be used by local attackers to read kernel memory at certain location.


Affected upstream versions: n/a
Fixed upstream versions: v4.19
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4
CVE-2018-16749: ImageMagick: reachable assertion in ReadOneJNGImage in coders/png.c
Component: ImageMagick
Severity: Low
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-09-11T00:00:00+00:00

In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file.


Affected upstream versions: n/a
Fixed upstream versions: 6.9.9-42
Upstream repository: https://github.com/ImageMagick/ImageMagick6
Upstream fix commit: 1007b98f8795ad4bea6bc5f68a32d83e982fdae4
CVE-2018-16802: ghostscript: Incorrect "restoration of privilege" checking when running out of stack during exception handling
Component: ghostscript
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during exception handling could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. This is due to an incomplete fix for CVE-2018-16509.

Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 7. This issue did not affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5 and 6.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 5812b1b78fc4d36fdc293b7859de69241140d590
CVE-2018-16839: curl: Integer overflow leading to heap-based buffer overflow in Curl_sasl_create_plain_message()
Component: curl
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2018-10-31T00:00:00+00:00

Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.


Affected upstream versions: from 7.33.0 to 7.61.1
Fixed upstream versions: curl-7_62_0
Upstream repository: https://github.com/curl/curl
Upstream fix commit: f3a24d7916b9173c69a3e0ee790102993833d6c5
CVE-2018-16840: curl: Use-after-free when closing "easy" handle in Curl_close()
Component: curl
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2018-10-31T00:00:00+00:00

A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.


Affected upstream versions: from 7.59.0 to 7.61.1
Fixed upstream versions: curl-7_62_0
Upstream repository: https://github.com/curl/curl
Upstream fix commit: 81d135d67155c5295b1033679c606165d4e28f3f
CVE-2018-16842: curl: Heap-based buffer over-read in the curl tool warning formatting
Component: curl
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.6 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L)
Public date: 2018-10-31T00:00:00+00:00

Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.


Affected upstream versions: from 7.14.1 to 7.61.1
Fixed upstream versions: curl-7_62_0
Upstream repository: https://github.com/curl/curl
Upstream fix commit: d530e92f59ae9bb2d47066c3c460b25d2ffeb211
CVE-2018-16863: ghostscript: incomplete fix for CVE-2018-16509
Component: ghostscript
Severity: Important
CWE: CWE-184 (Incomplete List of Disallowed Inputs)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-12-03T00:00:00+00:00

It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document.

Statement: This vulnerability affects only Red Hat Enterprise Linux version 7. Red Hat Enterprise Linux version 6 is not affected by this vulnerability because the set of fixes for CVE-2018-16509, released via  RHSA-2018:3760, was complete.

Affected upstream versions: 9.07
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 5516c614dc33
CVE-2018-17082: php: Cross-site scripting (XSS) flaw in Apache2 component via body of 'Transfer-Encoding: chunked' request
Component: php
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 4.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2018-09-13T00:00:00+00:00

A cross-site scripting (XSS) vulnerability in Apache2 component of PHP was found. When using 'Transfer-Encoding: chunked', the request allows remote attackers to potentially run a malicious script in a victim's browser. This vulnerability can be exploited only by producing malformed requests and it's believed it's unlikely to be used in practical cross-site scripting attack.

Statement: This issue affects the versions of php as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of php as shipped with Red Hat Enterprise Linux 6. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the versions of php as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having a security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Fixed upstream versions: php-5.6.38
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 23b057742e3cf199612fa8050ae86cae675e214e
CVE-2018-17182: kernel: Use-after-free in the vmacache_flush_all function resulting in a possible privilege escalation
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-09-13T00:00:00+00:00

A security flaw was discovered in the Linux kernel. The vmacache_flush_all() function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.


Affected upstream versions: n/a
Fixed upstream versions: v4.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 7a9cdebdcc17e426fb5287e4a82db1dfe86339b2
CVE-2018-17183: ghostscript: User-writable error exception table
Component: ghostscript
Severity: Important
CWE: CWE-460 (Improper Cleanup on Thrown Exception)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-09-19T00:00:00+00:00

Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: fb713b3818b52d8a6cf62c951eba2e1795ff9624
CVE-2018-17204: openvswitch: Mishandle of group mods in lib/ofp-util.c:parse_group_prop_ntr_selection_method() allows for assertion failure
Component: openvswitch
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 2.7 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-09-25T00:00:00+00:00

An issue was discovered in Open vSwitch (OvS), 2.4.x through 2.4.1, 2.5.x through 2.5.5, 2.6.x through 2.6.3, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and2.9.x through 2.9.2, affecting the parse_group_prop_ntr_selection_method in lib/ofp-util.c. On controllers with the OpenFlow 1.5 decoder enabled, a specially crafted group update can cause an assertion failure, potentially leading to a Denial of Service condition.


Affected upstream versions: n/a
Fixed upstream versions: v2.7.7
Upstream repository: https://github.com/openvswitch/ovs
Upstream fix commit: 4af6da3b275b764b1afe194df6499b33d2bf4cde
CVE-2018-17205: openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash
Component: openvswitch
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-09-25T00:00:00+00:00

An issue was discovered in Open vSwitch (OvS), 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2, where the ofproto_rule_insert__() function inside ofproto/ofproto.c is affected by an assertion failure under certain circumstances.
A specially crafted flow update applied using the bundling feature of Open vSwitch could potentially cause the assertion failure, potentially leading to incorrect flow information being applied, or a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v2.7.7
Upstream repository: https://github.com/openvswitch/ovs
Upstream fix commit: 0befd1f3745055c32940f5faf9559be6a14395e6
CVE-2018-17206: openvswitch: Buffer over-read in lib/ofp-actions.c:decode_bundle()
Component: openvswitch
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.9 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-09-25T00:00:00+00:00

An issue was discovered in Open vSwitch (OvS) 2.5.x through 2.5.5, 2.6.x through 2.6.3, 2.7.x through 2.7.6, 2.8.x through 2.8.4, and 2.9.x through 2.9.2 where the decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue during BUNDLE action decoding.
A specially crafted flow update applied using the bundling feature of Open vSwitch could potentially cause a crash leading to a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v2.7.7
Upstream repository: https://github.com/openvswitch/ovs
Upstream fix commit: 9237a63c47bd314b807cda0bd2216264e82edbe8
CVE-2018-17407: texlive: Buffer overflow in t1_check_unusual_charstring function in writet1.c
Component: texlive
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-09-23T00:00:00+00:00

An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.

Statement: This issue affects the versions of texlive as shipped with Red Hat Enterprise Linux 6 and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: build-svn50573
Upstream repository: https://github.com/TeX-Live/texlive-source
Upstream fix commit: 6ed0077520e2b0da1fd060c7f88db7b2e6068e4c
CVE-2018-17419: dns: Denial of Service (DoS)
Component: dns
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-03-08T00:00:00+00:00

The Miek Gieben DNS library is vulnerable to a denial of service caused by a segmentation violation in setTA in scan_rr.go. By persuading a victim to open a specially-crafted file, a remote attacker can cause the application to crash.

Statement: The opportunity for a denial of service is limited to the golang runtime. In the case of the OpenShift Container Platform, this would be restricted within each individual container. There are multiple layers of guide rails (Golang’s Garbage Collector; OpenShift’s resource constraints imposed at the container and cluster levels) which would require a malicious user to continue submitting attacks for there to be any enduring impact. They would also need access to external server resources to be able to send a massive volume of requests to cause a significant impact on server operations.

Affected upstream versions: n/a
Fixed upstream versions: v1.0.10
Upstream repository: https://github.com/miekg/dns
Upstream fix commit: 501e858f679edecd4a38a86317ce50271014a80d
CVE-2018-17456: git: arbitrary code execution via .gitmodules
Component: git
Severity: Important
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-10-05T00:00:00+00:00

An option injection flaw has been discovered in git when it recursively clones a repository with sub-modules. A remote attacker may configure a malicious repository and trick a user into recursively cloning it, thus executing arbitrary commands on the victim's machine.

Statement: OpenShift Container Platform (OCP) source-to-image uses the git client packaged with the OCP container images. Since RHEL7 and its associated images are impacted, source-to-image is also impacted. The atomic-openshift package running on the masters controls the code that determines the source-to-image build image in use, therefore a cluster update is required to patch this issue. Full instructions will be provided in Security Errata provided for this issue.

In OCP 3.6 and earlier, source-to-image executes in a privileged container on the node. Therefore the severity of this CVE is important for these versions. OCP 3.7 and later execute source-to-image git pulls in an unprivileged init container.

Affected upstream versions: n/a
Fixed upstream versions: v2.17.2
Upstream repository: https://github.com/git/git
Upstream fix commit: 1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404
CVE-2018-17961: ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183)
Component: ghostscript
Severity: Important
CWE: CWE-460 (Improper Cleanup on Thrown Exception)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-10-10T00:00:00+00:00

Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: a5a9bf8c6a63