Red Hat Security AdvisoryRHSA-2019:0229
ghostscript security and bug fix update
Released 2019-01-31 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) ghostscript-9.07-31.el7_6.9, ghostscript-cups-9.07-31.el7_6.9
- Red Hat Enterprise Linux Client Optional (v. 7) ghostscript-devel-9.07-31.el7_6.9, ghostscript-doc-9.07-31.el7_6.9, ghostscript-gtk-9.07-31.el7_6.9
- Red Hat Enterprise Linux ComputeNode (v. 7) ghostscript-9.07-31.el7_6.9, ghostscript-cups-9.07-31.el7_6.9
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ghostscript-devel-9.07-31.el7_6.9, ghostscript-doc-9.07-31.el7_6.9, ghostscript-gtk-9.07-31.el7_6.9
- Red Hat Enterprise Linux Server (v. 7) ghostscript-9.07-31.el7_6.9, ghostscript-9.07-31.el7_6.9.ppc, ghostscript-cups-9.07-31.el7_6.9
- Red Hat Enterprise Linux Server Optional (v. 7) ghostscript-devel-9.07-31.el7_6.9, ghostscript-devel-9.07-31.el7_6.9.ppc, ghostscript-doc-9.07-31.el7_6.9 +1
- Red Hat Enterprise Linux Workstation (v. 7) ghostscript-9.07-31.el7_6.9, ghostscript-cups-9.07-31.el7_6.9
- Red Hat Enterprise Linux Workstation Optional (v. 7) ghostscript-devel-9.07-31.el7_6.9, ghostscript-doc-9.07-31.el7_6.9, ghostscript-gtk-9.07-31.el7_6.9
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) ghostscript-9.07-31.el7_6.9, ghostscript-cups-9.07-31.el7_6.9
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) ghostscript-devel-9.07-31.el7_6.9, ghostscript-doc-9.07-31.el7_6.9, ghostscript-gtk-9.07-31.el7_6.9
Fixes 5 records
Priority MEDIUM 62
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.41592 · Published 2019-03-19 · Partial fix
Priority MEDIUM 46
psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.09548 · Published 2018-11-23 · Partial fix
Priority MEDIUM 40
psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.0304 · Published 2018-11-23 · Partial fix CWE-704
Priority MEDIUM 40
psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.0304 · Published 2018-11-23 · Partial fix CWE-704
Priority LOW 37
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified…
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.01561 · Published 2018-09-05 · Partial fix CWE-416
THREATIST.IORead the docs