SuSE 11 / 11.1 Security Update : ghostscript (SAT Patch Numbers 2708 / 2709)

high Nessus Plugin ID 50909

Language:

Synopsis

The remote SuSE 11 host is missing one or more security updates.

Description

This update for ghostscript fixes the following security issues :

- Specially crafted postscript (.ps) files can cause buffer overflows in ghostscript that could potentially be exploited to execute arbitrary code. (CVE-2010-1869 / CVE-2010-1628 / CVE-2009-4270)

- By default, ghostscript reads certain initialization files from the current working directory. Local attackers could potentially exploit this to have other users execute arbitrary commands by placing such files, e.g. in /tmp. (CVE-2010-2055)

Solution

Apply SAT patch number 2708 / 2709 as appropriate.

Plugin Details

Severity: High

ID: 50909

File Name: suse_11_ghostscript-devel-100712.nasl

Version: 1.9

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 12/2/2010

Updated: 1/14/2021

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:ghostscript-fonts-other, p-cpe:/a:novell:suse_linux:11:ghostscript-fonts-rus, p-cpe:/a:novell:suse_linux:11:ghostscript-fonts-std, p-cpe:/a:novell:suse_linux:11:ghostscript-library, p-cpe:/a:novell:suse_linux:11:ghostscript-omni, p-cpe:/a:novell:suse_linux:11:ghostscript-x11, p-cpe:/a:novell:suse_linux:11:libgimpprint, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 7/12/2010

Reference Information

CVE: CVE-2009-4270, CVE-2009-4897, CVE-2010-1628, CVE-2010-1869, CVE-2010-2055

CWE: 119

Detections

Analytics