Security update for ghostscript
Announcement ID: | SUSE-SU-2018:4090-2 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves eight vulnerabilities and has one security fix can now be installed.
Description:
This update for ghostscript to version 9.26 fixes the following issues:
Security issues fixed:
- CVE-2018-19475: Fixed bypass of an intended access restriction in psi/zdevice2.c (bsc#1117327)
- CVE-2018-19476: Fixed bypass of an intended access restriction in psi/zicc.c (bsc#1117313)
- CVE-2018-19477: Fixed bypass of an intended access restriction in psi/zfjbig2.c (bsc#1117274)
- CVE-2018-19409: Check if another device is used correctly in LockSafetyParams (bsc#1117022)
- CVE-2018-18284: Fixed potential sandbox escape through 1Policy operator (bsc#1112229)
- CVE-2018-18073: Fixed leaks through operator in saved execution stacks (bsc#1111480)
- CVE-2018-17961: Fixed a -dSAFER sandbox escape by bypassing executeonly (bsc#1111479)
- CVE-2018-17183: Fixed a potential code injection by specially crafted PostScript files (bsc#1109105)
Version update to 9.26 (bsc#1117331):
- Security issues have been the primary focus
- Minor bug fixes and improvements
- For release summary see: http://www.ghostscript.com/doc/9.26/News.htm
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server for SAP Applications 12 SP1
zypper in -t patch SUSE-SLE-SAP-12-SP1-2019-1076=1
Package List:
-
SUSE Linux Enterprise Server for SAP Applications 12 SP1 (x86_64)
- libspectre1-0.2.7-12.4.1
- ghostscript-9.26-23.16.1
- ghostscript-debuginfo-9.26-23.16.1
- ghostscript-x11-9.26-23.16.1
- libspectre1-debuginfo-0.2.7-12.4.1
- libspectre-debugsource-0.2.7-12.4.1
- ghostscript-debugsource-9.26-23.16.1
- ghostscript-x11-debuginfo-9.26-23.16.1
References:
- https://www.suse.com/security/cve/CVE-2018-17183.html
- https://www.suse.com/security/cve/CVE-2018-17961.html
- https://www.suse.com/security/cve/CVE-2018-18073.html
- https://www.suse.com/security/cve/CVE-2018-18284.html
- https://www.suse.com/security/cve/CVE-2018-19409.html
- https://www.suse.com/security/cve/CVE-2018-19475.html
- https://www.suse.com/security/cve/CVE-2018-19476.html
- https://www.suse.com/security/cve/CVE-2018-19477.html
- https://bugzilla.suse.com/show_bug.cgi?id=1109105
- https://bugzilla.suse.com/show_bug.cgi?id=1111479
- https://bugzilla.suse.com/show_bug.cgi?id=1111480
- https://bugzilla.suse.com/show_bug.cgi?id=1112229
- https://bugzilla.suse.com/show_bug.cgi?id=1117022
- https://bugzilla.suse.com/show_bug.cgi?id=1117274
- https://bugzilla.suse.com/show_bug.cgi?id=1117313
- https://bugzilla.suse.com/show_bug.cgi?id=1117327
- https://bugzilla.suse.com/show_bug.cgi?id=1117331