huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-16228: tcpdump: Access to uninitialized buffer in print_prefix() function in print-hncp.c
Component: tcpdump
Severity: Low
CWE: CWE-665 (Improper Initialization)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

A flaw was found in tcpdump where an uninitialized buffer is accessed in tcpdump while printing HNCP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application. System availability is the highest threat from this vulnerability.

Statement: This issue does not affect the versions of tcpdump as shipped with Red Hat Enterprise Linux 7 as they already include the patch.

Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 83a412a5275cac973c5841eca3511c766bed778d
CVE-2018-16229: tcpdump: Buffer over-read in dccp_print_option() function in print-dccp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in tcpdump while printing DCCP packets captured in a pcap file or coming from the network. A remote attacker may abuse this flaw by sending specially crafted packets that, when printed, would trigger the flaw and crash the application.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 211124b972e74f0da66bc8b16f181f78793e2f66
CVE-2018-16230: tcpdump: Buffer over-read in bgp_attr_print() function in print-bgp.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 13d52e9c0e7caf7e6325b0051bc90a49968be67f
CVE-2018-16300: tcpdump: Resource exhaustion in bgp_attr_print() function in print-bgp.c
Component: tcpdump
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

An uncontrolled resource consumption flaw was discovered in the way tcpdump prints BGP packets. The BGP protocol allows ATTR_SET to be nested as many times as the message can accommodate, however when a specially crafted packet is crafted and parsed by tcpdump, this may lead to stack exhaustion due to uncontrolled recursion. System availability is the highest threat from this vulnerability.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: af2cf04a9394c1a56227c2289ae8da262828294a
CVE-2018-16391: opensc: Buffer overflows handling responses from Muscle Cards in card-muscle.c:muscle_list_files()
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

Several buffer overflows when handling responses from a Muscle Card in muscle_list_files in libopensc/card-muscle.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 360e95d45ac4123255a4c796db96337f332160ad
CVE-2018-16392: opensc: Buffer overflows handling responses from TCOS Cards in card-tcos.c:tcos_select_file()
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

Several buffer overflows when handling responses from a TCOS Card in tcos_select_file in libopensc/card-tcos.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 360e95d45ac4123255a4c796db96337f332160ad
CVE-2018-16393: opensc: Buffer overflows handling responses from Gemsafe V1 Smartcards in pkcs15-gemsafeV1.c:gemsafe_get_cert_len()
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

Several buffer overflows when handling responses from a Gemsafe V1 Smartcard in gemsafe_get_cert_len in libopensc/pkcs15-gemsafeV1.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 360e95d45ac4123255a4c796db96337f332160ad
CVE-2018-16403: elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash
Component: elfutils
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-08-15T00:00:00+00:00

libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.


Affected upstream versions: n/a
Upstream repository: https://sourceware.org/git/elfutils.git
Upstream fix commit: 6983e59b727458a6c64d9659c85f08218bc4fcda
CVE-2018-16418: opensc: Buffer overflow handling string concatention in tools/util.c:util_acl_to_str()
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 360e95d45ac4123255a4c796db96337f332160ad
CVE-2018-16419: opensc: Buffer overflow handling responses from Cryptoflex cards in cryptoflex-tool.c:read_public_key()
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

Several buffer overflows when handling responses from a Cryptoflex card in read_public_key in tools/cryptoflex-tool.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 360e95d45ac4123255a4c796db96337f332160ad
CVE-2018-16420: opensc: Buffer overflows handling responses from ePass 2003 Cards in card-epass2003.c:decrypt_response()
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

Several buffer overflows when handling responses from an ePass 2003 Card in decrypt_response in libopensc/card-epass2003.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 360e95d45ac4123255a4c796db96337f332160ad
CVE-2018-16421: opensc: Buffer overflows handling responses from CAC Cards in card-cac.c:cac_get_serial_nr_from_CUID()
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

Several buffer overflows when handling responses from a CAC Card in cac_get_serial_nr_from_CUID in libopensc/card-cac.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 360e95d45ac4123255a4c796db96337f332160ad
CVE-2018-16422: opensc: Buffer overflow handling responses from esteid cards in pkcs15-esteid.c:sc_pkcs15emu_esteid_init()
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

A single byte buffer overflow when handling responses from an esteid Card in sc_pkcs15emu_esteid_init in libopensc/pkcs15-esteid.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 360e95d45ac4123255a4c796db96337f332160ad
CVE-2018-16423: opensc: Double free handling responses from smartcards in libopensc/sc.c:sc_file_set_sec_attr()
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

A double free when handling responses from a smartcard in sc_file_set_sec_attr in libopensc/sc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 360e95d45ac4123255a4c796db96337f332160ad
CVE-2018-16426: opensc: Infinite recusrion handling responses from IAS-ECC cards in card-iasecc.c:iasecc_select_file()
Component: opensc
Severity: Low
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 2.4 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2018-09-12T00:00:00+00:00

Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 03628449b75a93787eb2359412a3980365dda49b
CVE-2018-16427: opensc: Out of bounds reads handling responses from smartcards
Component: opensc
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 4.3 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-12T00:00:00+00:00

Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.


Affected upstream versions: n/a
Fixed upstream versions: 0.19.0
Upstream repository: https://github.com/OpenSC/OpenSC
Upstream fix commit: 8fe377e93b4b56060e5bbfb6f3142ceaeca744fa
CVE-2018-16435: lcms2: Integer overflow in AllocateDataSet() in cmscgats.c leading to heap-based buffer overflow
Component: lcms2
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2018-08-13T00:00:00+00:00

Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile.

Statement: This issue affects the versions of lcms2 as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: lcms2.10
Upstream repository: https://github.com/mm2/Little-CMS
Upstream fix commit: 768f70ca405cd3159d990e962d54456773bb8cf8
CVE-2018-16451: tcpdump: Buffer over-read in print_trans() function in print-smb.c
Component: tcpdump
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

The SMB parser in tcpdump before 4.9.3 has buffer over-reads in print-smb.c:print_trans() for \MAILSLOT\BROWSE and \PIPE\LANMAN.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 96480ab95308cd9234b4f09b175ebf60e17792c6
CVE-2018-16452: tcpdump: Resource exhaustion in smb_fdata() funtion in smbutil.c
Component: tcpdump
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-10-02T00:00:00+00:00

The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.


Affected upstream versions: n/a
Fixed upstream versions: tcpdump-4.9.3
Upstream repository: https://github.com/the-tcpdump-group/tcpdump
Upstream fix commit: 24182d959f661327525a20d9a94c98a8ec016778
CVE-2018-16509: ghostscript: /invalidaccess bypass after failed restore (699654)
Component: ghostscript
Severity: Important
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-08-21T00:00:00+00:00

It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell commands via a specially crafted PostScript document.

Statement: This issue did affect the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7. 

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 5516c614dc33662a2afdc377159f70218e67bde5
CVE-2018-16511: ghostscript: missing type check in type checker (699659)
Component: ghostscript
Severity: Important
CWE: CWE-704 (Incorrect Type Conversion or Cast)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-08-24T00:00:00+00:00

It was discovered that the ghostscript .type operator did not properly validate its operands. A specially crafted PostScript document could exploit this to crash ghostscript or, possibly, execute arbitrary code in the context of the ghostscript process.

Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 0edd3d6c634a577db261615a9dc2719bca7f6e01
CVE-2018-16539: ghostscript: incorrect access checking in temp file handling to disclose contents of files (699658)
Component: ghostscript
Severity: Moderate
CWE: CWE-377 (Insecure Temporary File)
CVSS v3: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2018-09-06T00:00:00+00:00

It was discovered that the ghostscript did not properly restrict access to files open prior to enabling the -dSAFER mode. An attacker could possibly exploit this to bypass the -dSAFER protection and disclose the content of affected files via a specially crafted PostScript document.

Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: a054156d425b4dbdaaa9fda4b5f1182b27598c2b
CVE-2018-16540: ghostscript: use-after-free in copydevice handling (699661)
Component: ghostscript
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-06T00:00:00+00:00

It was discovered that the ghostscript PDF14 compositor did not properly handle the copying of a device. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.

Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: c432131c3fdb2143e148e8ba88555f7f7a63b25e
CVE-2018-16541: ghostscript: Incorrect free logic in pagedevice replacement (699664)
Component: ghostscript
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-06T00:00:00+00:00

It was discovered that the ghostscript device cleanup did not properly handle devices replaced with a null device. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.

Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 241d91112771a6104de10b3948c3f350d6690c1d
CVE-2018-16542: ghostscript: .definemodifiedfont memory corruption if /typecheck is handled (699668)
Component: ghostscript
Severity: Important
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-06T00:00:00+00:00

It was discovered that ghostscript did not properly handle certain stack overflow error conditions. An attacker could possibly exploit this to bypass the -dSAFER protection and crash ghostscript or, possibly, execute arbitrary code in the ghostscript context via a specially crafted PostScript document.

Statement: This issue affects the versions of ghostscript as shipped with Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: b575e1ec42cc86f6a58c603f2a88fcc2af699cc8
CVE-2018-16597: kernel: overlayfs file truncation without permissions
Component: kernel
Severity: Moderate
CWE: CWE-862 (Missing Authorization)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-18T00:00:00+00:00

An issue was discovered in the Linux kernel where an incorrect access check in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.


Affected upstream versions: n/a
Fixed upstream versions: v4.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c0ca3d70e8d3cf81e2255a217f7ca402f5ed0862