A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
A vulnerability was found in the Linux kernel's Marvell WiFi chip driver. Where, while parsing vendor-specific informational attributes, an attacker on the same WiFi physical network segment could cause a system crash, resulting in a denial of service, or potentially execute arbitrary code. This flaw affects the network interface at the most basic level meaning the attacker only needs to affiliate with the same network device as the vulnerable system to create an attack path.
A vulnerability was found in Artifex Ghostscript before 9.26. The restorepagedevice function in psi/zdevice2.c allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.
References: https://bugs.ghostscript.com/showbug.cgi?id=700153 https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patch: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3005fcb9bb160af199e761e03bc70a9f249a987e
A vulnerability was found in Artifex Ghostscript before 9.26. A type confusion in setcolorspace in psi/zicc.c allows remote attackers to bypass intended access restrictions.
References: https://bugs.ghostscript.com/showbug.cgi?id=700169 https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=67d760ab775dae4efe803b5944b0439aa3c0b04a http://git.ghostscript.com/?p=ghostpdl.git;h=548bb434e81dadcc9f71adf891a3ef5bea8e2b4e
A vulnerability was found in Artifex Ghostscript before 9.26. A JBIG2Decode type confusion in psi/zfjbig2.c allows remote attackers to bypass intended access restrictions.
References: https://bugs.ghostscript.com/showbug.cgi?id=700168 https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=ef252e7dc214bcbd9a2539216aab9202848602bb http://git.ghostscript.com/?p=ghostpdl.git;h=606a22e77e7f081781e99e44644cd0119f559e03
A security flaw was found in the Linux kernel in the adjustscalarminmaxvals() function in kernel/bpf/verifier.c. A faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because this function mishandles 32-bit right shifts. A local unprivileged user cannot leverage this flaw, but as a privileged user ("root") this can lead to a system panic and a denial of service or other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1686
https://seclists.org/oss-sec/2018/q4/69
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b799207e1e1816b09e7a5920fbb2d5fcf6edd681
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified other impact.