Security update for ghostscript SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3938-1 Final 1 1 2023-10-03T10:24:51Z current 2023-10-03T10:24:51Z 2023-10-03T10:24:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ghostscript This update for ghostscript fixes the following issues: - CVE-2023-43115: Fixed remote code execution via crafted PostScript documents in gdevijs.c (b sc#1215466). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3938,SUSE-SLE-SDK-12-SP5-2023-3938,SUSE-SLE-SERVER-12-SP5-2023-3938 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233938-1/ Link for SUSE-SU-2023:3938-1 https://lists.suse.com/pipermail/sle-security-updates/2023-October/016482.html E-Mail link for SUSE-SU-2023:3938-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1215466 SUSE Bug 1215466 https://www.suse.com/security/cve/CVE-2023-43115/ SUSE CVE CVE-2023-43115 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 ghostscript-9.52-23.60.1 ghostscript-devel-9.52-23.60.1 ghostscript-mini-9.52-23.60.1 ghostscript-mini-devel-9.52-23.60.1 ghostscript-x11-9.52-23.60.1 ghostscript-9.52-23.60.1 as a component of SUSE Linux Enterprise Server 12 SP5 ghostscript-devel-9.52-23.60.1 as a component of SUSE Linux Enterprise Server 12 SP5 ghostscript-x11-9.52-23.60.1 as a component of SUSE Linux Enterprise Server 12 SP5 ghostscript-9.52-23.60.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 ghostscript-devel-9.52-23.60.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 ghostscript-x11-9.52-23.60.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 ghostscript-devel-9.52-23.60.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server). CVE-2023-43115 SUSE Linux Enterprise Server 12 SP5:ghostscript-9.52-23.60.1 SUSE Linux Enterprise Server 12 SP5:ghostscript-devel-9.52-23.60.1 SUSE Linux Enterprise Server 12 SP5:ghostscript-x11-9.52-23.60.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ghostscript-9.52-23.60.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ghostscript-devel-9.52-23.60.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:ghostscript-x11-9.52-23.60.1 SUSE Linux Enterprise Software Development Kit 12 SP5:ghostscript-devel-9.52-23.60.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233938-1/ https://www.suse.com/security/cve/CVE-2023-43115.html CVE-2023-43115 https://bugzilla.suse.com/1215466 SUSE Bug 1215466