openSUSE Security Update : ghostscript (openSUSE-2019-1007)
High Nessus Plugin ID 123151
Synopsis
The remote openSUSE host is missing a security update.
Description
This update for ghostscript to version 9.26 fixes the following issues :
Security issues fixed :
- CVE-2018-19475: Fixed bypass of an intended access restriction in psi/zdevice2.c (bsc#1117327)
- CVE-2018-19476: Fixed bypass of an intended access restriction in psi/zicc.c (bsc#1117313)
- CVE-2018-19477: Fixed bypass of an intended access restriction in psi/zfjbig2.c (bsc#1117274)
- CVE-2018-19409: Check if another device is used correctly in LockSafetyParams (bsc#1117022)
- CVE-2018-18284: Fixed potential sandbox escape through 1Policy operator (bsc#1112229)
- CVE-2018-18073: Fixed leaks through operator in saved execution stacks (bsc#1111480)
- CVE-2018-17961: Fixed a -dSAFER sandbox escape by bypassing executeonly (bsc#1111479)
- CVE-2018-17183: Fixed a potential code injection by specially crafted PostScript files (bsc#1109105)
Version update to 9.26 (bsc#1117331) :
- Security issues have been the primary focus
- Minor bug fixes and improvements
- For release summary see:
http://www.ghostscript.com/doc/9.26/News.htm
This update was imported from the SUSE:SLE-15:Update update project.
Solution
Update the affected ghostscript packages.