Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20181217)
high Nessus Plugin ID 119883
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 8.1
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
Security Fix(es) :- ghostscript: Incorrect free logic in pagedevice replacement (699664) (CVE-2018-16541)
- ghostscript: Incorrect 'restoration of privilege' checking when running out of stack during exception handling (CVE-2018-16802)
- ghostscript: User-writable error exception table (CVE-2018-17183)
- ghostscript: Saved execution stacks can leak operator arrays (incomplete fix for CVE-2018-17183) (CVE-2018-17961)
- ghostscript: Saved execution stacks can leak operator arrays (CVE-2018-18073)
- ghostscript: 1Policy operator allows a sandbox protection bypass (CVE-2018-18284)
- ghostscript: Type confusion in setpattern (700141) (CVE-2018-19134)
- ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c (CVE-2018-19409)
- ghostscript: Uninitialized memory access in the aesdecode operator (699665) (CVE-2018-15911)
Bug Fix(es) :
- It has been found that ghostscript-9.07-31.el7_6.1 introduced regression during the handling of shading objects, causing a 'Dropping incorrect smooth shading object' warning. With this update, the regression has been fixed and the described problem no longer occurs.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 119883
File Name: sl_20181217_ghostscript_on_SL7_x.nasl
Version: 1.8
Type: local
Agent: unix
Published: 12/27/2018
Updated: 8/21/2020
Dependencies: ssh_get_info.nasl
Risk Information
Risk Factor: High
VPR Score: 8.1
CVSS v2.0
Base Score: 7.5
Temporal Score: 5.9
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Temporal Vector: E:POC/RL:OF/RC:C
CVSS v3.0
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:fermilab:scientific_linux:ghostscript, p-cpe:/a:fermilab:scientific_linux:ghostscript-cups, p-cpe:/a:fermilab:scientific_linux:ghostscript-debuginfo, p-cpe:/a:fermilab:scientific_linux:ghostscript-devel, p-cpe:/a:fermilab:scientific_linux:ghostscript-doc, p-cpe:/a:fermilab:scientific_linux:ghostscript-gtk, x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/17/2018
Vulnerability Publication Date: 8/28/2018
Reference Information
CVE: CVE-2018-15911, CVE-2018-16541, CVE-2018-16802, CVE-2018-17183, CVE-2018-17961, CVE-2018-18073, CVE-2018-18284, CVE-2018-19134, CVE-2018-19409
IAVB: 2019-B-0081-S