Synopsis
The remote Debian host is missing a security update.
Description
Some vulnerabilities were discovered in ghostscript, an interpreter for the PostScript language and for PDF.
CVE-2018-19134
The setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.
CVE-2018-19478
Attempting to open a carefully crafted PDF file results in long-running computation. A sufficiently bad page tree can lead to us taking significant amounts of time when checking the tree for recursion.
For Debian 8 'Jessie', these problems have been fixed in version 9.06~dfsg-2+deb8u13.
We recommend that you upgrade your ghostscript packages.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected packages.