Security update for ghostscript SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1220-1 Final 1 1 2020-12-21T11:28:31Z current 2020-12-21T11:28:31Z 2020-12-21T11:28:31Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ghostscript This update for ghostscript to version 9.52 fixes the following issues: - CVE-2020-12268: Fixed a heap-based buffer overflow in jbig2_image_compose (bsc#1170603). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1220,SUSE-SLE-Module-Basesystem-15-SP1-2020-1220,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-1220,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-1220,SUSE-SLE-Product-HPC-15-2020-1220,SUSE-SLE-Product-SLES-15-2020-1220,SUSE-SLE-Product-SLES_SAP-15-2020-1220 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201220-1/ Link for SUSE-SU-2020:1220-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006802.html E-Mail link for SUSE-SU-2020:1220-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1170603 SUSE Bug 1170603 https://www.suse.com/security/cve/CVE-2020-12268/ SUSE CVE CVE-2020-12268 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 ghostscript-9.52-3.27.2 ghostscript-devel-9.52-3.27.2 ghostscript-mini-9.52-3.27.1 ghostscript-mini-devel-9.52-3.27.1 ghostscript-x11-9.52-3.27.2 libspectre-devel-0.2.8-3.10.1 libspectre1-0.2.8-3.10.1 ghostscript-9.52-3.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS ghostscript-devel-9.52-3.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS ghostscript-x11-9.52-3.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libspectre1-0.2.8-3.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS ghostscript-9.52-3.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS ghostscript-devel-9.52-3.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS ghostscript-x11-9.52-3.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libspectre1-0.2.8-3.10.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS ghostscript-9.52-3.27.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 ghostscript-devel-9.52-3.27.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 ghostscript-x11-9.52-3.27.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 libspectre-devel-0.2.8-3.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libspectre1-0.2.8-3.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 ghostscript-9.52-3.27.2 as a component of SUSE Linux Enterprise Server 15-LTSS ghostscript-devel-9.52-3.27.2 as a component of SUSE Linux Enterprise Server 15-LTSS ghostscript-x11-9.52-3.27.2 as a component of SUSE Linux Enterprise Server 15-LTSS libspectre1-0.2.8-3.10.1 as a component of SUSE Linux Enterprise Server 15-LTSS ghostscript-9.52-3.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 ghostscript-devel-9.52-3.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 ghostscript-x11-9.52-3.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libspectre1-0.2.8-3.10.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow. CVE-2020-12268 SUSE Linux Enterprise High Performance Computing 15-ESPOS:ghostscript-9.52-3.27.2 SUSE Linux Enterprise High Performance Computing 15-ESPOS:ghostscript-devel-9.52-3.27.2 SUSE Linux Enterprise High Performance Computing 15-ESPOS:ghostscript-x11-9.52-3.27.2 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libspectre1-0.2.8-3.10.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:ghostscript-9.52-3.27.2 SUSE Linux Enterprise High Performance Computing 15-LTSS:ghostscript-devel-9.52-3.27.2 SUSE Linux Enterprise High Performance Computing 15-LTSS:ghostscript-x11-9.52-3.27.2 SUSE Linux Enterprise High Performance Computing 15-LTSS:libspectre1-0.2.8-3.10.1 SUSE Linux Enterprise Module for Basesystem 15 SP1:ghostscript-9.52-3.27.2 SUSE Linux Enterprise Module for Basesystem 15 SP1:ghostscript-devel-9.52-3.27.2 SUSE Linux Enterprise Module for Basesystem 15 SP1:ghostscript-x11-9.52-3.27.2 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libspectre-devel-0.2.8-3.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libspectre1-0.2.8-3.10.1 SUSE Linux Enterprise Server 15-LTSS:ghostscript-9.52-3.27.2 SUSE Linux Enterprise Server 15-LTSS:ghostscript-devel-9.52-3.27.2 SUSE Linux Enterprise Server 15-LTSS:ghostscript-x11-9.52-3.27.2 SUSE Linux Enterprise Server 15-LTSS:libspectre1-0.2.8-3.10.1 SUSE Linux Enterprise Server for SAP Applications 15:ghostscript-9.52-3.27.2 SUSE Linux Enterprise Server for SAP Applications 15:ghostscript-devel-9.52-3.27.2 SUSE Linux Enterprise Server for SAP Applications 15:ghostscript-x11-9.52-3.27.2 SUSE Linux Enterprise Server for SAP Applications 15:libspectre1-0.2.8-3.10.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201220-1/ https://www.suse.com/security/cve/CVE-2020-12268.html CVE-2020-12268 https://bugzilla.suse.com/1170603 SUSE Bug 1170603