Security update for ghostscript

Announcement ID:	SUSE-SU-2024:3942-1
Release Date:	2024-11-07T10:11:51Z
Rating:	important
References:	bsc#1232265 bsc#1232267 bsc#1232269 bsc#1232270
Cross-References:	CVE-2024-46951 CVE-2024-46953 CVE-2024-46955 CVE-2024-46956
CVSS scores:	CVE-2024-46951 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-46953 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-46955 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2024-46956 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 12 SP5 LTSS 12-SP5 SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security 12-SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves four vulnerabilities can now be installed.

Description:

This update for ghostscript fixes the following issues:

• CVE-2024-46951: Fixed arbitrary code execution via unchecked "Implementation" pointer in "Pattern" color space (bsc#1232265).
• CVE-2024-46953: Fixed integer overflow when parsing the page format results in path truncation, path traversal, code execution (bsc#1232267).
• CVE-2024-46956: Fixed arbitrary code execution via out of bounds data access in filenameforall (bsc#1232270).
• CVE-2024-46955: Fixed out of bounds read when reading color in "Indexed" color space (bsc#1232269).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Server 12 SP5 LTSS 12-SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2024-3942=1
• SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security 12-SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2024-3942=1

Package List:

• SUSE Linux Enterprise Server 12 SP5 LTSS 12-SP5 (aarch64 ppc64le s390x x86_64)
  • ghostscript-debugsource-9.52-23.86.1
  • ghostscript-x11-9.52-23.86.1
  • ghostscript-x11-debuginfo-9.52-23.86.1
  • ghostscript-9.52-23.86.1
  • ghostscript-debuginfo-9.52-23.86.1
  • ghostscript-devel-9.52-23.86.1
• SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security 12-SP5 (x86_64)
  • ghostscript-debugsource-9.52-23.86.1
  • ghostscript-x11-9.52-23.86.1
  • ghostscript-x11-debuginfo-9.52-23.86.1
  • ghostscript-9.52-23.86.1
  • ghostscript-debuginfo-9.52-23.86.1
  • ghostscript-devel-9.52-23.86.1

References:

• https://www.suse.com/security/cve/CVE-2024-46951.html
• https://www.suse.com/security/cve/CVE-2024-46953.html
• https://www.suse.com/security/cve/CVE-2024-46955.html
• https://www.suse.com/security/cve/CVE-2024-46956.html
• https://bugzilla.suse.com/show_bug.cgi?id=1232265
• https://bugzilla.suse.com/show_bug.cgi?id=1232267
• https://bugzilla.suse.com/show_bug.cgi?id=1232269
• https://bugzilla.suse.com/show_bug.cgi?id=1232270