Security update for ghostscript-library SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1153-1 Final 1 1 2017-05-03T08:59:28Z current 2017-05-03T08:59:28Z 2017-05-03T08:59:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ghostscript-library This update for ghostscript fixes the following security vulnerability: CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. (bsc#1036453) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ghostscript-library-13086,slessp4-ghostscript-library-13086 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171153-1/ Link for SUSE-SU-2017:1153-1 https://lists.opensuse.org/opensuse-security-announce/2017-05/msg00009.html E-Mail link for SUSE-SU-2017:1153-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1036453 SUSE Bug 1036453 https://www.suse.com/security/cve/CVE-2017-8291/ SUSE CVE CVE-2017-8291 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 ghostscript-devel-8.62-32.44.1 ghostscript-ijs-devel-8.62-32.44.1 libgimpprint-devel-4.2.7-32.44.1 ghostscript-fonts-other-8.62-32.44.1 ghostscript-fonts-rus-8.62-32.44.1 ghostscript-fonts-std-8.62-32.44.1 ghostscript-library-8.62-32.44.1 ghostscript-omni-8.62-32.44.1 ghostscript-x11-8.62-32.44.1 libgimpprint-4.2.7-32.44.1 ghostscript-fonts-other-8.62-32.44.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-fonts-rus-8.62-32.44.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-fonts-std-8.62-32.44.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-library-8.62-32.44.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-omni-8.62-32.44.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-x11-8.62-32.44.1 as a component of SUSE Linux Enterprise Server 11 SP4 libgimpprint-4.2.7-32.44.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-fonts-other-8.62-32.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-fonts-rus-8.62-32.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-fonts-std-8.62-32.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-library-8.62-32.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-omni-8.62-32.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-x11-8.62-32.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libgimpprint-4.2.7-32.44.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-devel-8.62-32.44.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ghostscript-ijs-devel-8.62-32.44.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libgimpprint-devel-4.2.7-32.44.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. CVE-2017-8291 SUSE Linux Enterprise Server 11 SP4:ghostscript-fonts-other-8.62-32.44.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-fonts-rus-8.62-32.44.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-fonts-std-8.62-32.44.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-library-8.62-32.44.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-omni-8.62-32.44.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-x11-8.62-32.44.1 SUSE Linux Enterprise Server 11 SP4:libgimpprint-4.2.7-32.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-fonts-other-8.62-32.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-fonts-rus-8.62-32.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-fonts-std-8.62-32.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-library-8.62-32.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-omni-8.62-32.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-x11-8.62-32.44.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgimpprint-4.2.7-32.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ghostscript-devel-8.62-32.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ghostscript-ijs-devel-8.62-32.44.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgimpprint-devel-4.2.7-32.44.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171153-1/ https://www.suse.com/security/cve/CVE-2017-8291.html CVE-2017-8291 https://bugzilla.suse.com/1036453 SUSE Bug 1036453