huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2018-18021: kernel: Privilege escalation on arm64 via KVM hypervisor
Component: kernel
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6.7 (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-10-03T00:00:00+00:00

A vulnerability was discovered in the Linux kernel that allows an attacker to escalate privileges with using a 64-bit ARM architecture. A local attacker with permission to create KVM-based virtual machines can both panic the hypervisor by triggering an illegal exception return (resulting in a DoS) and to redirect execution elsewhere within the hypervisor with full register control, instead of causing a return to the guest.


Affected upstream versions: n/a
Fixed upstream versions: v4.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2a3f93459d689d990b3ecfbe782fec89b97d3279
CVE-2018-18073: ghostscript: Saved execution stacks can leak operator arrays
Component: ghostscript
Severity: Important
CWE: CWE-460 (Improper Cleanup on Thrown Exception)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2018-10-09T00:00:00+00:00

Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 34cc326eb2c5695833361887fe0b32e8d987741c
CVE-2018-18074: python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
Component: python-requests
Severity: Low
CWE: CWE-522 (Insufficiently Protected Credentials)
CVSS v3: 2.6 (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2018-06-29T00:00:00+00:00

A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user's valid credentials.


Affected upstream versions: n/a
Fixed upstream versions: v2.20.0
Upstream repository: https://github.com/requests/requests
Upstream fix commit: c45d7c49ea75133e52ab22a8e9e13173938e36ff
CVE-2018-18281: kernel: TLB flush happens too late on mremap
Component: kernel
Severity: Moderate
CWE: CWE-672 (Operation on a Resource after Expiration or Release)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2018-10-18T00:00:00+00:00

Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused.


Affected upstream versions: n/a
Fixed upstream versions: v4.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: eb66ae030829605d61fbef1909ce310e29f78821
CVE-2018-18311: perl: Integer overflow leading to buffer overflow in Perl_my_setenv()
Component: perl
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-11-29T00:00:00+00:00

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

Statement: This vulnerability is present in versions of perl included with Red Hat Virtualization Hypervisor and Management Appliance, however it is not exposed in any meaningful way. Perl is only included in these images as a dependency of components which do not manipulate ENV, and are not exposed to user input. A future update may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v5.29.1
Upstream repository: https://github.com/Perl/perl5
Upstream fix commit: 34716e2a6ee2af96078d62b065b7785c001194be
CVE-2018-18313: perl: Heap-based buffer read overflow in S_grok_bslash_N()
Component: perl
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2018-11-29T00:00:00+00:00

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.


Affected upstream versions: n/a
Fixed upstream versions: v5.27.6
Upstream repository: https://github.com/Perl/perl5
Upstream fix commit: 43b2f4ef399e2fd7240b4eeb0658686ad95f8e62
CVE-2018-18314: perl: Heap-based buffer overflow in S_regatom()
Component: perl
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2018-11-29T00:00:00+00:00

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.


Affected upstream versions: n/a
Fixed upstream versions: v5.27.7
Upstream repository: https://github.com/Perl/perl5
Upstream fix commit: 19a498a461d7c81ae3507c450953d1148efecf4f
CVE-2018-18386: kernel: Type confusion in drivers/tty/n_tty.c allows for a denial of service
Component: kernel
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2017-12-20T00:00:00+00:00

A security flaw was found in the Linux kernel in drivers/tty/n_tty.c which allows local attackers (ones who are able to access pseudo terminals) to lock them up and block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ handler.


Affected upstream versions: n/a
Fixed upstream versions: v4.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 966031f340185eddd05affcf72b740549f056348
CVE-2018-18397: kernel: userfaultfd bypasses tmpfs file permissions
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N)
Public date: 2018-11-26T00:00:00+00:00

A flaw was found in the Linux kernel with files on tmpfs and hugetlbfs. An attacker is able to bypass file permissions on filesystems mounted with tmpfs/hugetlbs to modify a file and possibly disrupt normal system behavior. At this time there is an understanding there is no crash or privilege escalation but the impact of modifications on these filesystems of files in production systems may have adverse affects.


Affected upstream versions: n/a
Fixed upstream versions: v4.20
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 29ec90660d68bbdd69507c1c8b4e33aa299278b1
CVE-2018-18445: kernel: Faulty computation of numberic bounds in the BPF verifier
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.7 (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2018-10-05T00:00:00+00:00

A security flaw was found in the Linux kernel in the adjust_scalar_min_max_vals() function in kernel/bpf/verifier.c. A faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because this function mishandles 32-bit right shifts. A local unprivileged user cannot leverage this flaw, but as a privileged user ("root") this can lead to a system panic and a denial of service or other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.


Affected upstream versions: n/a
Fixed upstream versions: v4.19
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b799207e1e1816b09e7a5920fbb2d5fcf6edd681
CVE-2018-18557: libtiff: Out-of-bounds write in tif_jbig.c
Component: libtiff
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2018-10-14T00:00:00+00:00

LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.4beta, 4.0.5, 4.0.6, 4.0.7, 4.0.8 and 4.0.9 (with JBIG enabled) decodes arbitrarily-sized JBIG into a buffer, ignoring the buffer size, which leads to a tif_jbig.c JBIGDecode out-of-bounds write.

Statement: This issue did not affect the versions of libtiff as shipped with Red Hat Enterprise Linux 5 and 6.

This issue affects the versions of libtiff as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: v4.0.10
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 681748ec2f5ce88da5f9fa6831e1653e46af8a66
CVE-2018-18584: libmspack: Out-of-bounds write in mspack/cab.h
Component: libmspack
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2018-10-17T00:00:00+00:00

In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.

Statement: This issue affects the versions of libmspack as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: v1.8
Upstream repository: https://github.com/kyz/libmspack
Upstream fix commit: 40ef1b4093d77ad3a5cfcee1f5cb6108b3a3bcc2
CVE-2018-18585: libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes
Component: libmspack
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2018-10-17T00:00:00+00:00

chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).

Statement: This issue affects the versions of libmspack as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: v1.8
Upstream repository: https://github.com/kyz/libmspack
Upstream fix commit: 8759da8db6ec9e866cb8eb143313f397f925bb4f
CVE-2018-18690: kernel: filesystem corruption due to an unchecked error condition during an xfs attribute change
Component: kernel
Severity: Moderate
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2018-03-15T00:00:00+00:00

In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short to long form.


Affected upstream versions: n/a
Fixed upstream versions: v4.17
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 7b38460dc8e4eafba06c78f8e37099d3b34d473c
CVE-2018-19044: keepalived: Improper pathname validation allows for overwrite of arbitrary filenames via symlinks
Component: keepalived
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-11-08T00:00:00+00:00

keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protected_symlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or /tmp/keepalived.stats to /etc/passwd.

Statement: This issue affects the versions of keepalived as shipped with Red Hat Enterprise Linux 6 and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

The keepalived packages shipped with Red Hat Enterprise Linux 6 and 7 are not built with dbus support, therefore vulnerable PrintData and PrintStats methods are not compiled in resulting RPM, which means this issue cannot be exploited via dbus messages on Red Hat Enterprise Linux 6 and 7. However, creation of pidfiles is also vulnerable to symlink attack and it is possible for local attacker to overwrite arbitrary file with the process identifiers of keepalived processes, but only if keepalived was launched with option to change pidfile location pointing to unsafe location and attacker is able to exploit Time-of-check Time-of-use race condition and create a symlink during a very small time frame in the same location the pidfile was specified. The default location used for pidfiles is safe. Red Hat Enterprise Linux 7 is by default configured with fs.protected_symlinks=1 which largely mitigates symlink attacks.

Affected upstream versions: n/a
Fixed upstream versions: v2.0.9
Upstream repository: https://github.com/acassen/keepalived
Upstream fix commit: 04f2d32871bb3b11d7dc024039952f2fe2750306
CVE-2018-19115: keepalived: Heap-based buffer overflow when parsing HTTP status codes allows for denial of service or possibly arbitrary code execution
Component: keepalived
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 8.1 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2018-11-08T00:00:00+00:00

Heap-based buffer overflow vulnerability in extract_status_code() function in lib/html.c that parses HTTP status code returned from web server allows malicious web server or man-in-the-middle attacker pretending to be a web server to cause either a denial of service or potentially execute arbitrary code on keepalived load balancer.

Statement: This issue affects the versions of keepalived as shipped with Red Hat Enterprise Linux 6 and 7.

Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: v2.0.7
Upstream repository: https://github.com/acassen/keepalived
Upstream fix commit: f28015671a4b04785859d1b4b1327b367b6a10e9
CVE-2018-19134: ghostscript: Type confusion in setpattern (700141)
Component: ghostscript
Severity: Important
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-11-20T00:00:00+00:00

In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 693baf02152119af6e6afd30bb8ec76d14f84bbf
CVE-2018-19198: uriparser: Out-of-bounds write via uriComposeQuery* or uriComposeQueryEx* function
Component: uriparser
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-23T00:00:00+00:00

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts.

Statement: This issue affects the versions of uriparser as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: uriparser-0.9.0
Upstream repository: https://github.com/uriparser/uriparser
Upstream fix commit: 864f5d4c127def386dd5cc926ad96934b297f04e
CVE-2018-19199: uriparser: Integer overflow via uriComposeQuery* or uriComposeQueryEx* function
Component: uriparser
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-09-23T00:00:00+00:00

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriComposeQueryEx* function because of an unchecked multiplication.

Statement: This issue affects the versions of uriparser as shipped with Red Hat Enterprise Linux 7.

Affected upstream versions: n/a
Fixed upstream versions: uriparser-0.9.0
Upstream repository: https://github.com/uriparser/uriparser
Upstream fix commit: f76275d4a91b28d687250525d3a0c5509bbd666f
CVE-2018-19360: jackson-databind: improper polymorphic deserialization in axis2-transport-jms class
Component: jackson-databind
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-11-18T00:00:00+00:00

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the axis2-transport-jms class. An attacker could use this flaw to execute arbitrary code.

Statement: Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't include axis2-transport-jms jar.

Red Hat Virtualization 4 is not affected by this issue, since it does not include axis2-transport-jms jar.

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.7.9.5
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 42912cac4753f3f718ece875e4d486f8264c2f2b
CVE-2018-19361: jackson-databind: improper polymorphic deserialization in openjpa class
Component: jackson-databind
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-11-18T00:00:00+00:00

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the OpenJPA class. An attacker could use this flaw to execute arbitrary code.

Statement: Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't bundle openjpa jar.

Red Hat Virtualization 4 is not affected by this issue, since its candlepin component doesn't bundle openjpa jar.

Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.7.9.5
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 42912cac4753f3f718ece875e4d486f8264c2f2b
CVE-2018-19362: jackson-databind: improper polymorphic deserialization in jboss-common-core class
Component: jackson-databind
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-11-18T00:00:00+00:00

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the jboss-common-core class. An attacker could use this flaw to execute arbitrary code.

Statement: Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn't bundle jboss-common-core jar.

Red Hat Virtualization 4 is not affected by this issue, since its candlepin component doesn't bundle jboss-common-core jar.

Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.7.9.5
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 42912cac4753f3f718ece875e4d486f8264c2f2b
CVE-2018-19409: ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c
Component: ghostscript
Severity: Important
CWE: CWE-391 (Unchecked Error Condition)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-11-14T00:00:00+00:00

An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 661e8d8fb8248c38d67958beda32f3a5876d0c3f
CVE-2018-19475: ghostscript: access bypass in psi/zdevice2.c (700153)
Component: ghostscript
Severity: Important
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-11-20T00:00:00+00:00

psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-9.26
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 3005fcb9bb160af199e761e03bc70a9f249a987e
CVE-2018-19476: ghostscript: access bypass in psi/zicc.c (700169)
Component: ghostscript
Severity: Important
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 7.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2018-11-20T00:00:00+00:00

psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion.

Statement: Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-9.26
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 67d760ab775dae4efe803b5944b0439aa3c0b04a