[gentoo-announce] [ GLSA 202004-03 ] GPL Ghostscript: Multiple vulnerabilities - gentoo-announce

From:	Thomas Deutschmann <whissi@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202004-03 ] GPL Ghostscript: Multiple vulnerabilities
Date:	Wed, 01 Apr 2020 19:53:32
Message-Id:	`88f1c137-842b-f8a0-4e9a-b3549c3c8e12@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202004-03

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: GPL Ghostscript: Multiple vulnerabilities

9

     Date: April 01, 2020

10

     Bugs: #676264, #692106, #693002

11

       ID: 202004-03

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in GPL Ghostscript, the worst

19

of which could result in the execution of arbitrary code.

20

21

Background

22

==========

23

24

Ghostscript is an interpreter for the PostScript language and for PDF.

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  app-text/ghostscript-gpl

33

                                 < 9.28_rc4               >= 9.28_rc4

34

35

Description

36

===========

37

38

Multiple vulnerabilities have been discovered in GPL Ghostscript.

39

Please review the CVE identifiers referenced below for details.

40

41

Impact

42

======

43

44

A remote attacker could entice a user to process a specially crafted

45

file using GPL Ghostscript, possibly resulting in execution of

46

arbitrary code with the privileges of the process or a Denial of

47

Service condition.

48

49

Workaround

50

==========

51

52

There is no known workaround at this time.

53

54

Resolution

55

==========

56

57

All GPL Ghostscript users should upgrade to the latest version:

58

59

  # emerge --sync

60

  # emerge --ask --oneshot -v ">=app-text/ghostscript-gpl-9.28_rc4"

61

62

References

63

==========

64

65

[ 1 ] CVE-2019-10216

66

      https://nvd.nist.gov/vuln/detail/CVE-2019-10216

67

[ 2 ] CVE-2019-14811

68

      https://nvd.nist.gov/vuln/detail/CVE-2019-14811

69

[ 3 ] CVE-2019-14812

70

      https://nvd.nist.gov/vuln/detail/CVE-2019-14812

71

[ 4 ] CVE-2019-14813

72

      https://nvd.nist.gov/vuln/detail/CVE-2019-14813

73

[ 5 ] CVE-2019-14817

74

      https://nvd.nist.gov/vuln/detail/CVE-2019-14817

75

[ 6 ] CVE-2019-3835

76

      https://nvd.nist.gov/vuln/detail/CVE-2019-3835

77

[ 7 ] CVE-2019-3838

78

      https://nvd.nist.gov/vuln/detail/CVE-2019-3838

79

[ 8 ] CVE-2019-6116

80

      https://nvd.nist.gov/vuln/detail/CVE-2019-6116

81

82

Availability

83

============

84

85

This GLSA and any updates to it are available for viewing at

86

the Gentoo Security Website:

87

88

 https://security.gentoo.org/glsa/202004-03

89

90

Concerns?

91

=========

92

93

Security is a primary focus of Gentoo Linux and ensuring the

94

confidentiality and security of our users' machines is of utmost

95

importance to us. Any security concerns should be addressed to

96

security@g.o or alternatively, you may file a bug at

97

https://bugs.gentoo.org.

98

99

License

100

=======

101

102

Copyright 2020 Gentoo Foundation, Inc; referenced text

103

belongs to its owner(s).

104

105

The contents of this document are licensed under the

106

Creative Commons - Attribution / Share Alike license.

107

108

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202004-03
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: GPL Ghostscript: Multiple vulnerabilities
9	Date: April 01, 2020
10	Bugs: #676264, #692106, #693002
11	ID: 202004-03
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in GPL Ghostscript, the worst
19	of which could result in the execution of arbitrary code.
20
21	Background
22	==========
23
24	Ghostscript is an interpreter for the PostScript language and for PDF.
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 app-text/ghostscript-gpl
33	< 9.28_rc4 >= 9.28_rc4
34
35	Description
36	===========
37
38	Multiple vulnerabilities have been discovered in GPL Ghostscript.
39	Please review the CVE identifiers referenced below for details.
40
41	Impact
42	======
43
44	A remote attacker could entice a user to process a specially crafted
45	file using GPL Ghostscript, possibly resulting in execution of
46	arbitrary code with the privileges of the process or a Denial of
47	Service condition.
48
49	Workaround
50	==========
51
52	There is no known workaround at this time.
53
54	Resolution
55	==========
56
57	All GPL Ghostscript users should upgrade to the latest version:
58
59	# emerge --sync
60	# emerge --ask --oneshot -v ">=app-text/ghostscript-gpl-9.28_rc4"
61
62	References
63	==========
64
65	[ 1 ] CVE-2019-10216
66	https://nvd.nist.gov/vuln/detail/CVE-2019-10216
67	[ 2 ] CVE-2019-14811
68	https://nvd.nist.gov/vuln/detail/CVE-2019-14811
69	[ 3 ] CVE-2019-14812
70	https://nvd.nist.gov/vuln/detail/CVE-2019-14812
71	[ 4 ] CVE-2019-14813
72	https://nvd.nist.gov/vuln/detail/CVE-2019-14813
73	[ 5 ] CVE-2019-14817
74	https://nvd.nist.gov/vuln/detail/CVE-2019-14817
75	[ 6 ] CVE-2019-3835
76	https://nvd.nist.gov/vuln/detail/CVE-2019-3835
77	[ 7 ] CVE-2019-3838
78	https://nvd.nist.gov/vuln/detail/CVE-2019-3838
79	[ 8 ] CVE-2019-6116
80	https://nvd.nist.gov/vuln/detail/CVE-2019-6116
81
82	Availability
83	============
84
85	This GLSA and any updates to it are available for viewing at
86	the Gentoo Security Website:
87
88	https://security.gentoo.org/glsa/202004-03
89
90	Concerns?
91	=========
92
93	Security is a primary focus of Gentoo Linux and ensuring the
94	confidentiality and security of our users' machines is of utmost
95	importance to us. Any security concerns should be addressed to
96	security@g.o or alternatively, you may file a bug at
97	https://bugs.gentoo.org.
98
99	License
100	=======
101
102	Copyright 2020 Gentoo Foundation, Inc; referenced text
103	belongs to its owner(s).
104
105	The contents of this document are licensed under the
106	Creative Commons - Attribution / Share Alike license.
107
108	https://creativecommons.org/licenses/by-sa/2.5