SUSE-SU-2018:1140-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2018/suse-su-20181140-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:1140-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2018:1140-1
Related
Published
2018-05-03T09:18:19Z
Modified
2018-05-03T09:18:19Z
Summary
Security update for ghostscript-library
Details

This update for ghostscript-library fixes several issues.

These security issues were fixed:

  • CVE-2017-7207: The memgetbits_rectangle function allowed remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document (bsc#1030263).
  • CVE-2016-9601: Prevent heap-buffer overflow by checking for an integer overflow in jbig2imagenew function (bsc#1018128).
  • CVE-2017-9612: The Ins_IP function in base/ttinterp.c allowed remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document (bsc#1050891)
  • CVE-2017-9726: The Ins_MDRP function in base/ttinterp.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document (bsc#1050889)
  • CVE-2017-9727: The gxttfReader_Read function in base/gxttfb.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document (bsc#1050888)
  • CVE-2017-9739: The Ins_JMPR function in base/ttinterp.c allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document (bsc#1050887)
  • CVE-2017-11714: psi/ztoken.c mishandled references to the scanner state structure, which allowed remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igcrelocstruct_ptr function in psi/igc.c (bsc#1051184)
  • CVE-2017-9835: The gsallocref_array function allowed remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document (bsc#1050879)
  • CVE-2016-10219: The intersect function in base/gxfill.c allowed remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file (bsc#1032138)
  • CVE-2017-9216: Prevent NULL pointer dereference in the jbig2huffmanget function in jbig2_huffman.c which allowed for DoS (bsc#1040643)
References

Affected packages

SUSE:Linux Enterprise Software Development Kit 11 SP4 / ghostscript-library

Package

Name
ghostscript-library
Purl
pkg:rpm/suse/ghostscript-library&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.62-32.47.7.1

Ecosystem specific 

{
    "binaries": [
        {
            "ghostscript-ijs-devel": "8.62-32.47.7.1",
            "libgimpprint-devel": "4.2.7-32.47.7.1",
            "ghostscript-devel": "8.62-32.47.7.1"
        }
    ]
}

SUSE:Linux Enterprise Server 11 SP4 / ghostscript-library

Package

Name
ghostscript-library
Purl
pkg:rpm/suse/ghostscript-library&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.62-32.47.7.1

Ecosystem specific 

{
    "binaries": [
        {
            "ghostscript-fonts-other": "8.62-32.47.7.1",
            "ghostscript-fonts-std": "8.62-32.47.7.1",
            "libgimpprint": "4.2.7-32.47.7.1",
            "ghostscript-x11": "8.62-32.47.7.1",
            "ghostscript-fonts-rus": "8.62-32.47.7.1",
            "ghostscript-library": "8.62-32.47.7.1",
            "ghostscript-omni": "8.62-32.47.7.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 11 SP4 / ghostscript-library

Package

Name
ghostscript-library
Purl
pkg:rpm/suse/ghostscript-library&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.62-32.47.7.1

Ecosystem specific 

{
    "binaries": [
        {
            "ghostscript-fonts-other": "8.62-32.47.7.1",
            "ghostscript-fonts-std": "8.62-32.47.7.1",
            "libgimpprint": "4.2.7-32.47.7.1",
            "ghostscript-x11": "8.62-32.47.7.1",
            "ghostscript-fonts-rus": "8.62-32.47.7.1",
            "ghostscript-library": "8.62-32.47.7.1",
            "ghostscript-omni": "8.62-32.47.7.1"
        }
    ]
}