Security Bulletin: Vulnerabilities in Ghostscript affect PowerKVM

Summary

PowerKVM is affected by vulnerabilities in Artifex Ghostscript. IBM has now addressed these vulnerabilities.

Vulnerability Details

CVEID: CVE-2018-16539 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to obtain sensitive information, caused by improper access checking in temp file handling.By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to obtain contents of files on the system.
CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149465&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

CVEID: CVE-2018-16511 DESCRIPTION: Artifex Ghostscript is vulnerable to a denial of service, caused by a type confusion flaw in ztype. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to crash the interpreter.
CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149463&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

CVEID: CVE-2018-15909 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to execute arbitrary code on the system, caused by a type confusion using the .shfill operator. An attacker could exploit this vulnerability using a PostScript file to crash the interpreter or possibly execute arbitrary code on the system.
CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/148959&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2018-15908 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability using specially crafted PostScript files to bypass .tempfile restrictions and write files.
CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/148960&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

CVEID: CVE-2018-15911 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to execute arbitrary code on the system, caused by an uninitialized memory access error in the aesdecode operator. An attacker could exploit this vulnerability to crash the interpreter or possibly execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/148957&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2019-6116 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to execute arbitrary commands on the system, caused by the failure to mark subroutines as executeonly and make them pseudo-operators. An attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 9.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/156003&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2018-19477 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to bypass security restrictions, caused by a JBIG2Decode type confusion in psi/zfjbig2.c. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass access restrictions.
CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/153246&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2018-19476 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to bypass security restrictions, caused by a setcolorspace type confusion in psi/zicc.c. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass access restrictions.
CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/153245&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2018-19475 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to bypass security restrictions, caused by improper validation of stack space in psi/zdevice2.c. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass access restrictions.
CVSS Base Score: 5.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/153244&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2018-16540 DESCRIPTION: Artifex Ghostscript is vulnerable to a denial of service, caused by a use-after-free in copydevice handling in PDF14 converter. By persuading a victim to open a specially-crafted file, a remote attacker could exploit this vulnerability to crash the interpreter.
CVSS Base Score: 5.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/149466&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Affected Products and Versions

PowerKVM 3.1

Remediation/Fixes

Customers can update PowerKVM systems by using “yum update”.

Fix images are made available via Fix Central. For version 3.1, see https://ibm.biz/BdHggw. This issue is addressed starting with v3.1.0.2 update 17.

Workarounds and Mitigations

none