fix CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817
This commit is contained in:
chengquan
parent
c65c33446a
commit
923f56f7d3
63
CVE-2019-14811-CVE-2019-14812-CVE-2019-14813.patch
Normal file
63
CVE-2019-14811-CVE-2019-14812-CVE-2019-14813.patch
Normal file
@ -0,0 +1,63 @@
|
||||
From 885444fcbe10dc42787ecb76686c8ee4dd33bf33 Mon Sep 17 00:00:00 2001
|
||||
From: Ken Sharp <ken.sharp@artifex.com>
|
||||
Date: Tue, 20 Aug 2019 10:10:28 +0100
|
||||
Subject: [PATCH] make .forceput inaccessible
|
||||
|
||||
Bug #701343, #701344, #701345
|
||||
|
||||
More defensive programming. We don't want people to access .forecput
|
||||
even though it is no longer sufficient to bypass SAFER. The exploit
|
||||
in #701343 didn't work anyway because of earlier work to stop the error
|
||||
handler being used, but nevertheless, prevent access to .forceput from
|
||||
.setuserparams2.
|
||||
---
|
||||
Resource/Init/gs_lev2.ps | 6 +++---
|
||||
Resource/Init/gs_pdfwr.ps | 4 ++--
|
||||
2 files changed, 5 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/Resource/Init/gs_lev2.ps b/Resource/Init/gs_lev2.ps
|
||||
index 4cc7f82..0fd4164 100644
|
||||
--- a/Resource/Init/gs_lev2.ps
|
||||
+++ b/Resource/Init/gs_lev2.ps
|
||||
@@ -158,7 +158,7 @@ end
|
||||
{
|
||||
pop pop
|
||||
} ifelse
|
||||
- } forall
|
||||
+ } executeonly forall
|
||||
% A context switch might have occurred during the above loop,
|
||||
% causing the interpreter-level parameters to be reset.
|
||||
% Set them again to the new values. From here on, we are safe,
|
||||
@@ -229,9 +229,9 @@ end
|
||||
{ pop pop
|
||||
}
|
||||
ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
forall pop
|
||||
-} .bind odef
|
||||
+} .bind executeonly odef
|
||||
|
||||
% Initialize the passwords.
|
||||
% NOTE: the names StartJobPassword and SystemParamsPassword are known to
|
||||
diff --git a/Resource/Init/gs_pdfwr.ps b/Resource/Init/gs_pdfwr.ps
|
||||
index c158a8f..422e66e 100644
|
||||
--- a/Resource/Init/gs_pdfwr.ps
|
||||
+++ b/Resource/Init/gs_pdfwr.ps
|
||||
@@ -658,11 +658,11 @@ currentdict /.pdfmarkparams .undef
|
||||
systemdict /.pdf_hooked_DSC_Creator //true .forceput
|
||||
} executeonly if
|
||||
pop
|
||||
- } if
|
||||
+ } executeonly if
|
||||
} {
|
||||
pop
|
||||
} ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
pop
|
||||
} ifelse
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
231
CVE-2019-14817.patch
Normal file
231
CVE-2019-14817.patch
Normal file
@ -0,0 +1,231 @@
|
||||
From cd1b1cacadac2479e291efe611979bdc1b3bdb19 Mon Sep 17 00:00:00 2001
|
||||
From: Ken Sharp <ken.sharp@artifex.com>
|
||||
Date: Wed, 21 Aug 2019 10:10:51 +0100
|
||||
Subject: [PATCH] PDF interpreter - review .forceput security
|
||||
|
||||
Bug #701450 "Safer Mode Bypass by .forceput Exposure in .pdfexectoken"
|
||||
|
||||
By abusing the error handler it was possible to get the PDFDEBUG portion
|
||||
of .pdfexectoken, which uses .forceput left readable.
|
||||
|
||||
Add an executeonly appropriately to make sure that clause isn't readable
|
||||
no mstter what.
|
||||
|
||||
Review all the uses of .forceput searching for similar cases, add
|
||||
executeonly as required to secure those. All cases in the PostScript
|
||||
support files seem to be covered already.
|
||||
---
|
||||
Resource/Init/pdf_base.ps | 2 +-
|
||||
Resource/Init/pdf_draw.ps | 14 +++++++-------
|
||||
Resource/Init/pdf_font.ps | 29 ++++++++++++++++-------------
|
||||
Resource/Init/pdf_main.ps | 6 +++---
|
||||
Resource/Init/pdf_ops.ps | 11 ++++++-----
|
||||
5 files changed, 33 insertions(+), 29 deletions(-)
|
||||
|
||||
diff --git a/Resource/Init/pdf_base.ps b/Resource/Init/pdf_base.ps
|
||||
index 2e28cdd..02503ee 100644
|
||||
--- a/Resource/Init/pdf_base.ps
|
||||
+++ b/Resource/Init/pdf_base.ps
|
||||
@@ -157,7 +157,7 @@ currentdict /num-chars-dict .undef
|
||||
{
|
||||
dup ==only () = flush
|
||||
} ifelse % PDFSTEP
|
||||
- } if % PDFDEBUG
|
||||
+ } executeonly if % PDFDEBUG
|
||||
2 copy .knownget {
|
||||
exch pop exch pop exch pop exec
|
||||
} {
|
||||
diff --git a/Resource/Init/pdf_draw.ps b/Resource/Init/pdf_draw.ps
|
||||
index 11eb485..fe3fc56 100644
|
||||
--- a/Resource/Init/pdf_draw.ps
|
||||
+++ b/Resource/Init/pdf_draw.ps
|
||||
@@ -501,8 +501,8 @@ end
|
||||
( Output may be incorrect.\n) pdfformaterror
|
||||
//pdfdict /.gs_warning_issued //true .forceput
|
||||
PDFSTOPONERROR { /gs /undefined signalerror } if
|
||||
- } if
|
||||
- }
|
||||
+ } executeonly if
|
||||
+ } executeonly
|
||||
ifelse
|
||||
} bind executeonly def
|
||||
|
||||
@@ -1152,7 +1152,7 @@ currentdict end readonly def
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
currentglobal //pdfdict gcheck .setglobal
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
@@ -1160,8 +1160,8 @@ currentdict end readonly def
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
end
|
||||
- } ifelse
|
||||
- } loop
|
||||
+ } executeonly ifelse
|
||||
+ } executeonly loop
|
||||
{
|
||||
(\n **** Error: File has unbalanced q/Q operators \(too many q's\)\n Output may be incorrect.\n)
|
||||
//pdfdict /.Qqwarning_issued .knownget
|
||||
@@ -1175,14 +1175,14 @@ currentdict end readonly def
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
currentglobal //pdfdict gcheck .setglobal
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- } if
|
||||
+ } executeonly if
|
||||
pop
|
||||
|
||||
% restore pdfemptycount
|
||||
diff --git a/Resource/Init/pdf_font.ps b/Resource/Init/pdf_font.ps
|
||||
index da07da5..81b7af1 100644
|
||||
--- a/Resource/Init/pdf_font.ps
|
||||
+++ b/Resource/Init/pdf_font.ps
|
||||
@@ -638,7 +638,7 @@ currentdict end readonly def
|
||||
currentglobal 2 index dup gcheck setglobal
|
||||
/FontInfo 5 dict dup 5 1 roll .forceput
|
||||
setglobal
|
||||
- } if
|
||||
+ } executeonly if
|
||||
dup /GlyphNames2Unicode .knownget not {
|
||||
//true % No existing G2U, make one
|
||||
} {
|
||||
@@ -668,10 +668,12 @@ currentdict end readonly def
|
||||
pop % font-res font-dict encoding|null font-info
|
||||
pop % font-res font-dict encoding|null
|
||||
//false % We built a GlyphNames2Unicode table, don't need to process further
|
||||
- }{
|
||||
+ } executeonly
|
||||
+ {
|
||||
//true % name is not Identity-V or H, fail by falling through
|
||||
}ifelse
|
||||
- } {
|
||||
+ } executeonly
|
||||
+ {
|
||||
//true
|
||||
} ifelse % not a name, try as a dictionary (as specified)
|
||||
|
||||
@@ -759,9 +761,9 @@ currentdict end readonly def
|
||||
PDFDEBUG {
|
||||
(.processToUnicode end) =
|
||||
} if
|
||||
- } if
|
||||
- } if
|
||||
- } stopped
|
||||
+ } executeonly if
|
||||
+ } executeonly if
|
||||
+ } executeonly stopped
|
||||
{
|
||||
.dstackdepth 1 countdictstack 1 sub
|
||||
{pop end} for
|
||||
@@ -1298,19 +1300,20 @@ currentdict /eexec_pdf_param_dict .undef
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
} executeonly if
|
||||
Q
|
||||
- } repeat
|
||||
+ } executeonly repeat
|
||||
Q
|
||||
- } PDFfile fileposition 2 .execn % Keep pdfcount valid.
|
||||
+ } executeonly PDFfile fileposition 2 .execn % Keep pdfcount valid.
|
||||
PDFfile exch setfileposition
|
||||
- } ifelse
|
||||
- } {
|
||||
+ } executeonly ifelse
|
||||
+ } executeonly
|
||||
+ {
|
||||
% PDF Type 3 fonts don't use .notdef
|
||||
% d1 implementation adjusts the width as needed
|
||||
0 0 0 0 0 0
|
||||
pdfopdict /d1 get exec
|
||||
} ifelse
|
||||
end end
|
||||
- } bdef
|
||||
+ } executeonly bdef
|
||||
dup currentdict Encoding .processToUnicode
|
||||
currentdict end .completefont exch pop
|
||||
} bind executeonly odef
|
||||
@@ -2124,9 +2127,9 @@ currentdict /CMap_read_dict undef
|
||||
(Will continue, but content may be missing.) = flush
|
||||
} ifelse
|
||||
} if
|
||||
- } if
|
||||
+ } executeonly if
|
||||
/findresource cvx /undefined signalerror
|
||||
- } loop
|
||||
+ } executeonly loop
|
||||
} bind executeonly odef
|
||||
|
||||
/buildCIDType0 { % <CIDFontType0-font-resource> buildCIDType0 <font>
|
||||
diff --git a/Resource/Init/pdf_main.ps b/Resource/Init/pdf_main.ps
|
||||
index 00d7e36..7690bae 100644
|
||||
--- a/Resource/Init/pdf_main.ps
|
||||
+++ b/Resource/Init/pdf_main.ps
|
||||
@@ -2771,15 +2771,15 @@ currentdict /PDF2PS_matrix_key undef
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
currentglobal //pdfdict gcheck .setglobal
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- } if
|
||||
- } if
|
||||
+ } executeonly if
|
||||
+ } executeonly if
|
||||
pop
|
||||
count PDFexecstackcount sub { pop } repeat
|
||||
(after exec) VMDEBUG
|
||||
diff --git a/Resource/Init/pdf_ops.ps b/Resource/Init/pdf_ops.ps
|
||||
index a15c8c6..d594035 100644
|
||||
--- a/Resource/Init/pdf_ops.ps
|
||||
+++ b/Resource/Init/pdf_ops.ps
|
||||
@@ -192,14 +192,14 @@ currentdict /gput_always_allow .undef
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
currentglobal //pdfdict gcheck .setglobal
|
||||
//pdfdict /.Qqwarning_issued //true .forceput
|
||||
.setglobal
|
||||
pdfformaterror
|
||||
} executeonly ifelse
|
||||
- } if
|
||||
+ } executeonly if
|
||||
} bind executeonly odef
|
||||
|
||||
% Save PDF gstate
|
||||
@@ -446,11 +446,12 @@ currentdict /gput_always_allow .undef
|
||||
dup type /booleantype eq {
|
||||
.currentSMask type /dicttype eq {
|
||||
.currentSMask /Processed 2 index .forceput
|
||||
+ } executeonly
|
||||
+ {
|
||||
+ .setSMask
|
||||
+ }ifelse
|
||||
} executeonly
|
||||
{
|
||||
- .setSMask
|
||||
- }ifelse
|
||||
- }{
|
||||
.setSMask
|
||||
}ifelse
|
||||
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
@ -9,7 +9,7 @@
|
||||
|
||||
Name: ghostscript
|
||||
Version: 9.27
|
||||
Release: 3
|
||||
Release: 4
|
||||
Summary: An interpreter for PostScript and PDF files
|
||||
License: AGPLv3+
|
||||
URL: https://ghostscript.com/
|
||||
@ -20,6 +20,8 @@ Patch100: ghostscript-9.23-100-run-dvipdf-securely.patch
|
||||
|
||||
# Patch6000 from http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5b85ddd19
|
||||
Patch6000: CVE-2019-10216.patch
|
||||
Patch6001: CVE-2019-14811-CVE-2019-14812-CVE-2019-14813.patch
|
||||
Patch6002: CVE-2019-14817.patch
|
||||
|
||||
BuildRequires: automake gcc
|
||||
BuildRequires: adobe-mappings-cmap-devel adobe-mappings-pdf-devel
|
||||
@ -180,6 +182,12 @@ make check
|
||||
%{_bindir}/dvipdf
|
||||
|
||||
%changelog
|
||||
* Fri Jan 3 2020 wangxiao<wangxiao65@huawei.com> - 9.27-4
|
||||
- Type:CVE
|
||||
- ID:NA
|
||||
- SUG:NA
|
||||
- DESC:fix CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817
|
||||
|
||||
* Mon Sep 23 2019 openEuler Buildteam <buildteam@openeuler.org> - 9.27-3
|
||||
- fix CVE-2019-10216 and modify requires
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user