Recommended update for ghostscript-library SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:14155-1 Final 1 1 2019-08-28T05:59:52Z current 2019-08-28T05:59:52Z 2019-08-28T05:59:52Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Recommended update for ghostscript-library This update for ghostscript-library fixes the following issues: Security issue fixed: - CVE-2019-3838: Fixed various bugs which allows to reenable and misuse system Postscript operators to read files from within Postscript files and send them with the help of e.g. the %pipe% to the attacker (bsc#1129186). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-ghostscript-library-14155,slessp4-ghostscript-library-14155 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-201914155-1/ Link for SUSE-SU-2019:14155-1 https://lists.suse.com/pipermail/sle-security-updates/2019-August/005853.html E-Mail link for SUSE-SU-2019:14155-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1129186 SUSE Bug 1129186 https://www.suse.com/security/cve/CVE-2019-3838/ SUSE CVE CVE-2019-3838 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4-LTSS ghostscript-fonts-other-8.62-47.16.1 ghostscript-fonts-rus-8.62-47.16.1 ghostscript-fonts-std-8.62-47.16.1 ghostscript-library-8.62-47.16.1 ghostscript-omni-8.62-47.16.1 ghostscript-x11-8.62-47.16.1 libgimpprint-4.2.7-47.16.1 ghostscript-fonts-other-8.62-47.16.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 ghostscript-fonts-rus-8.62-47.16.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 ghostscript-fonts-std-8.62-47.16.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 ghostscript-library-8.62-47.16.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 ghostscript-omni-8.62-47.16.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 ghostscript-x11-8.62-47.16.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 libgimpprint-4.2.7-47.16.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 ghostscript-fonts-other-8.62-47.16.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS ghostscript-fonts-rus-8.62-47.16.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS ghostscript-fonts-std-8.62-47.16.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS ghostscript-library-8.62-47.16.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS ghostscript-omni-8.62-47.16.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS ghostscript-x11-8.62-47.16.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libgimpprint-4.2.7-47.16.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. CVE-2019-3838 SUSE Linux Enterprise Point of Sale 11 SP3:ghostscript-fonts-other-8.62-47.16.1 SUSE Linux Enterprise Point of Sale 11 SP3:ghostscript-fonts-rus-8.62-47.16.1 SUSE Linux Enterprise Point of Sale 11 SP3:ghostscript-fonts-std-8.62-47.16.1 SUSE Linux Enterprise Point of Sale 11 SP3:ghostscript-library-8.62-47.16.1 SUSE Linux Enterprise Point of Sale 11 SP3:ghostscript-omni-8.62-47.16.1 SUSE Linux Enterprise Point of Sale 11 SP3:ghostscript-x11-8.62-47.16.1 SUSE Linux Enterprise Point of Sale 11 SP3:libgimpprint-4.2.7-47.16.1 SUSE Linux Enterprise Server 11 SP4-LTSS:ghostscript-fonts-other-8.62-47.16.1 SUSE Linux Enterprise Server 11 SP4-LTSS:ghostscript-fonts-rus-8.62-47.16.1 SUSE Linux Enterprise Server 11 SP4-LTSS:ghostscript-fonts-std-8.62-47.16.1 SUSE Linux Enterprise Server 11 SP4-LTSS:ghostscript-library-8.62-47.16.1 SUSE Linux Enterprise Server 11 SP4-LTSS:ghostscript-omni-8.62-47.16.1 SUSE Linux Enterprise Server 11 SP4-LTSS:ghostscript-x11-8.62-47.16.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libgimpprint-4.2.7-47.16.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914155-1/ https://www.suse.com/security/cve/CVE-2019-3838.html CVE-2019-3838 https://bugzilla.suse.com/1018128 SUSE Bug 1018128 https://bugzilla.suse.com/1030263 SUSE Bug 1030263 https://bugzilla.suse.com/1032135 SUSE Bug 1032135 https://bugzilla.suse.com/1038835 SUSE Bug 1038835 https://bugzilla.suse.com/1050888 SUSE Bug 1050888 https://bugzilla.suse.com/1050889 SUSE Bug 1050889 https://bugzilla.suse.com/1106171 SUSE Bug 1106171 https://bugzilla.suse.com/1106172 SUSE Bug 1106172 https://bugzilla.suse.com/1106173 SUSE Bug 1106173 https://bugzilla.suse.com/1107422 SUSE Bug 1107422 https://bugzilla.suse.com/1107423 SUSE Bug 1107423 https://bugzilla.suse.com/1107581 SUSE Bug 1107581 https://bugzilla.suse.com/1111479 SUSE Bug 1111479 https://bugzilla.suse.com/1112229 SUSE Bug 1112229 https://bugzilla.suse.com/1114495 SUSE Bug 1114495 https://bugzilla.suse.com/1117022 SUSE Bug 1117022 https://bugzilla.suse.com/1117327 SUSE Bug 1117327 https://bugzilla.suse.com/1118318 SUSE Bug 1118318 https://bugzilla.suse.com/1129180 SUSE Bug 1129180 https://bugzilla.suse.com/1129186 SUSE Bug 1129186 https://bugzilla.suse.com/1136756 SUSE Bug 1136756