Security update for ghostscript
Announcement ID: | SUSE-SU-2017:1138-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves five vulnerabilities can now be installed.
Description:
This update for ghostscript fixes the following security vulnerabilities:
CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. (bsc#1036453)
CVE-2016-9601: An integer overflow in the bundled jbig2dec library could have been misused to cause a Denial-of-Service. (bsc#1018128)
CVE-2016-10220: A NULL pointer dereference in the PDF Transparency module allowed remote attackers to cause a Denial-of-Service. (bsc#1032120)
CVE-2017-5951: A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document. (bsc#1032114)
CVE-2017-7207: A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document. (bsc#1030263)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Software Bootstrap Kit 12 12-SP1
zypper in -t patch SUSE-SLE-BSK-12-SP1-2017-659=1
-
SUSE Linux Enterprise Software Bootstrap Kit 12 12-SP2
zypper in -t patch SUSE-SLE-BSK-12-SP2-2017-659=1
-
SUSE Linux Enterprise Desktop 12 SP1
zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-659=1
-
SUSE Linux Enterprise Desktop 12 SP2
zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-659=1
-
SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2
zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-659=1
-
SUSE Linux Enterprise Software Development Kit 12 SP1
zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-659=1
-
SUSE Linux Enterprise Software Development Kit 12 12-SP2
zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-659=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP1
zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-659=1
-
SUSE Linux Enterprise Server 12 SP1
zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-659=1
-
SUSE Linux Enterprise High Performance Computing 12 SP2
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-659=1
-
SUSE Linux Enterprise Server 12 SP2
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-659=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP2
zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-659=1
Package List:
-
SUSE Linux Enterprise Software Bootstrap Kit 12 12-SP1 (ppc64le s390x x86_64)
- ghostscript-mini-debuginfo-9.15-20.1
- ghostscript-mini-devel-9.15-20.1
- ghostscript-mini-debugsource-9.15-20.1
- ghostscript-mini-9.15-20.1
-
SUSE Linux Enterprise Software Bootstrap Kit 12 12-SP2 (ppc64le s390x x86_64)
- ghostscript-mini-debuginfo-9.15-20.1
- ghostscript-mini-devel-9.15-20.1
- ghostscript-mini-debugsource-9.15-20.1
- ghostscript-mini-9.15-20.1
-
SUSE Linux Enterprise Desktop 12 SP1 (x86_64)
- ghostscript-debugsource-9.15-20.1
- ghostscript-x11-9.15-20.1
- ghostscript-x11-debuginfo-9.15-20.1
- ghostscript-debuginfo-9.15-20.1
- ghostscript-9.15-20.1
-
SUSE Linux Enterprise Desktop 12 SP2 (x86_64)
- ghostscript-debugsource-9.15-20.1
- ghostscript-x11-9.15-20.1
- ghostscript-x11-debuginfo-9.15-20.1
- ghostscript-debuginfo-9.15-20.1
- ghostscript-9.15-20.1
-
SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2 (aarch64)
- ghostscript-debugsource-9.15-20.1
- ghostscript-x11-9.15-20.1
- ghostscript-x11-debuginfo-9.15-20.1
- ghostscript-debuginfo-9.15-20.1
- ghostscript-9.15-20.1
-
SUSE Linux Enterprise Software Development Kit 12 SP1 (ppc64le s390x x86_64)
- ghostscript-debuginfo-9.15-20.1
- ghostscript-debugsource-9.15-20.1
- ghostscript-devel-9.15-20.1
-
SUSE Linux Enterprise Software Development Kit 12 12-SP2 (aarch64 ppc64le s390x x86_64)
- ghostscript-debuginfo-9.15-20.1
- ghostscript-debugsource-9.15-20.1
- ghostscript-devel-9.15-20.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP1 (ppc64le x86_64)
- ghostscript-debugsource-9.15-20.1
- ghostscript-x11-9.15-20.1
- ghostscript-x11-debuginfo-9.15-20.1
- ghostscript-debuginfo-9.15-20.1
- ghostscript-9.15-20.1
-
SUSE Linux Enterprise Server 12 SP1 (ppc64le s390x x86_64)
- ghostscript-debugsource-9.15-20.1
- ghostscript-x11-9.15-20.1
- ghostscript-x11-debuginfo-9.15-20.1
- ghostscript-debuginfo-9.15-20.1
- ghostscript-9.15-20.1
-
SUSE Linux Enterprise High Performance Computing 12 SP2 (aarch64 x86_64)
- ghostscript-debugsource-9.15-20.1
- ghostscript-x11-9.15-20.1
- ghostscript-x11-debuginfo-9.15-20.1
- ghostscript-debuginfo-9.15-20.1
- ghostscript-9.15-20.1
-
SUSE Linux Enterprise Server 12 SP2 (aarch64 ppc64le s390x x86_64)
- ghostscript-debugsource-9.15-20.1
- ghostscript-x11-9.15-20.1
- ghostscript-x11-debuginfo-9.15-20.1
- ghostscript-debuginfo-9.15-20.1
- ghostscript-9.15-20.1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP2 (ppc64le x86_64)
- ghostscript-debugsource-9.15-20.1
- ghostscript-x11-9.15-20.1
- ghostscript-x11-debuginfo-9.15-20.1
- ghostscript-debuginfo-9.15-20.1
- ghostscript-9.15-20.1
References:
- https://www.suse.com/security/cve/CVE-2016-10220.html
- https://www.suse.com/security/cve/CVE-2016-9601.html
- https://www.suse.com/security/cve/CVE-2017-5951.html
- https://www.suse.com/security/cve/CVE-2017-7207.html
- https://www.suse.com/security/cve/CVE-2017-8291.html
- https://bugzilla.suse.com/show_bug.cgi?id=1018128
- https://bugzilla.suse.com/show_bug.cgi?id=1030263
- https://bugzilla.suse.com/show_bug.cgi?id=1032114
- https://bugzilla.suse.com/show_bug.cgi?id=1032120
- https://bugzilla.suse.com/show_bug.cgi?id=1036453