Red Hat Security AdvisoryRHSA-2018:3650
ghostscript security update
Released 2018-11-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) ghostscript-9.07-31.el7_6.1, ghostscript-cups-9.07-31.el7_6.1
- Red Hat Enterprise Linux Client Optional (v. 7) ghostscript-devel-9.07-31.el7_6.1, ghostscript-doc-9.07-31.el7_6.1, ghostscript-gtk-9.07-31.el7_6.1
- Red Hat Enterprise Linux ComputeNode (v. 7) ghostscript-9.07-31.el7_6.1, ghostscript-cups-9.07-31.el7_6.1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ghostscript-devel-9.07-31.el7_6.1, ghostscript-doc-9.07-31.el7_6.1, ghostscript-gtk-9.07-31.el7_6.1
- Red Hat Enterprise Linux Server (v. 7) ghostscript-9.07-31.el7_6.1, ghostscript-9.07-31.el7_6.1.ppc, ghostscript-cups-9.07-31.el7_6.1
- Red Hat Enterprise Linux Server Optional (v. 7) ghostscript-devel-9.07-31.el7_6.1, ghostscript-devel-9.07-31.el7_6.1.ppc, ghostscript-doc-9.07-31.el7_6.1 +1
- Red Hat Enterprise Linux Workstation (v. 7) ghostscript-9.07-31.el7_6.1, ghostscript-cups-9.07-31.el7_6.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) ghostscript-devel-9.07-31.el7_6.1, ghostscript-doc-9.07-31.el7_6.1, ghostscript-gtk-9.07-31.el7_6.1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) ghostscript-9.07-31.el7_6.1, ghostscript-cups-9.07-31.el7_6.1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) ghostscript-devel-9.07-31.el7_6.1, ghostscript-doc-9.07-31.el7_6.1, ghostscript-gtk-9.07-31.el7_6.1
Fixes 4 records
Priority LOW 39
In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.02981 · Published 2018-08-27 · Partial fix CWE-704
Priority LOW 38
An issue was discovered in Artifex Ghostscript before 9.24.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.01938 · Published 2018-09-05 · Partial fix CWE-704
Priority LOW 38
In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.01916 · Published 2018-08-27 · Partial fix
Priority LOW 28
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable.
CVSS 3.0MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01445 · Published 2018-09-05 · Partial fix CWE-200
THREATIST.IORead the docs