Security update for ghostscript-library SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1369-1 Final 1 1 2018-05-22T13:14:37Z current 2018-05-22T13:14:37Z 2018-05-22T13:14:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ghostscript-library This update for ghostscript-library fixes the following issues: - CVE-2018-10194: Fixed a stack-based buffer overflow in gdevpdts.c (bsc#1090099) - Fixed a crash in the fix for CVE-2016-9601. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ghostscript-library-13617,slessp4-ghostscript-library-13617 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181369-1/ Link for SUSE-SU-2018:1369-1 https://lists.suse.com/pipermail/sle-security-updates/2018-May/004073.html E-Mail link for SUSE-SU-2018:1369-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1090099 SUSE Bug 1090099 https://www.suse.com/security/cve/CVE-2016-9601/ SUSE CVE CVE-2016-9601 page https://www.suse.com/security/cve/CVE-2018-10194/ SUSE CVE CVE-2018-10194 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 ghostscript-devel-8.62-32.47.10.1 ghostscript-ijs-devel-8.62-32.47.10.1 libgimpprint-devel-4.2.7-32.47.10.1 ghostscript-fonts-other-8.62-32.47.10.1 ghostscript-fonts-rus-8.62-32.47.10.1 ghostscript-fonts-std-8.62-32.47.10.1 ghostscript-library-8.62-32.47.10.1 ghostscript-omni-8.62-32.47.10.1 ghostscript-x11-8.62-32.47.10.1 libgimpprint-4.2.7-32.47.10.1 ghostscript-fonts-other-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-fonts-rus-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-fonts-std-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-library-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-omni-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-x11-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server 11 SP4 libgimpprint-4.2.7-32.47.10.1 as a component of SUSE Linux Enterprise Server 11 SP4 ghostscript-fonts-other-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-fonts-rus-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-fonts-std-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-library-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-omni-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-x11-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libgimpprint-4.2.7-32.47.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ghostscript-devel-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ghostscript-ijs-devel-8.62-32.47.10.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libgimpprint-devel-4.2.7-32.47.10.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_image function which is used to decode halftone segments in a JBIG2 image. A document (PostScript or PDF) with an embedded, specially crafted, jbig2 image could trigger a segmentation fault in ghostscript. CVE-2016-9601 SUSE Linux Enterprise Server 11 SP4:ghostscript-fonts-other-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-fonts-rus-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-fonts-std-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-library-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-omni-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-x11-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:libgimpprint-4.2.7-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-fonts-other-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-fonts-rus-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-fonts-std-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-library-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-omni-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-x11-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgimpprint-4.2.7-32.47.10.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ghostscript-devel-8.62-32.47.10.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ghostscript-ijs-devel-8.62-32.47.10.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgimpprint-devel-4.2.7-32.47.10.1 low 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181369-1/ https://www.suse.com/security/cve/CVE-2016-9601.html CVE-2016-9601 https://bugzilla.suse.com/1018128 SUSE Bug 1018128 https://bugzilla.suse.com/1036453 SUSE Bug 1036453 The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. CVE-2018-10194 SUSE Linux Enterprise Server 11 SP4:ghostscript-fonts-other-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-fonts-rus-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-fonts-std-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-library-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-omni-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:ghostscript-x11-8.62-32.47.10.1 SUSE Linux Enterprise Server 11 SP4:libgimpprint-4.2.7-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-fonts-other-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-fonts-rus-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-fonts-std-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-library-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-omni-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ghostscript-x11-8.62-32.47.10.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libgimpprint-4.2.7-32.47.10.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ghostscript-devel-8.62-32.47.10.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ghostscript-ijs-devel-8.62-32.47.10.1 SUSE Linux Enterprise Software Development Kit 11 SP4:libgimpprint-devel-4.2.7-32.47.10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181369-1/ https://www.suse.com/security/cve/CVE-2018-10194.html CVE-2018-10194 https://bugzilla.suse.com/1090099 SUSE Bug 1090099