id summary reporter owner description type status priority milestone component version severity resolution keywords cc 11240 Second set of ghostscript vulnerabilities. ken@… ken@… "After #11230, there are apparently more potential vulnerabilities, from posts to oss-security by Tavis Ormandy: {{{ A small update, one of these commits was to mark all procedures that use dangerous operators as operators themselves. The idea is that error handlers will only see the top-level operator and not any sub-operators (I know, this is getting complicated). I noticed a procedure upstream missed, .loadfontloop. Upstream have double checked if there were any others, and I did too - we think that is all of them. So this commit is necessary as well: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a5a9bf8c6a63 }}} and {{{ Hello, this is another (different from CVE-2018-17961) -dSAFER sandbox escape. [...] Once you have a reference to forceput, you can do anything you like, see the exploit for CVE-2018-18073 as an example of abusing forceput to get arbitrary filesystem access. The fix is public now, this is the commit to fix it: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=34cc326eb2c5695833361887fe0b32e8d987741c }}} I will note that for the previous set of fixes I had to add an intermediate commit to be able to apply the second fix, so this might be similar (obviously, on top of the first set of fixes). " enhancement closed high 8.4 BOOK SVN medium fixed