Moderate: ghostscript security and bug fix update
Summary
ALSA-2023:7053: Moderate: ghostscript security and bug fix update. Affects ghostscript versions < 9.27-11.el8. Fixed in 9.27-11.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats for display or printing purposes. The vulnerability affects the Ghostscript package in AlmaLinux 8.
Vulnerability Detail
The vulnerability includes three security issues:
- Buffer overflow in base/sbcp.c leading to data corruption (CVE-2023-28879)
- Out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle resulting in DoS (CVE-2023-38559)
- Incomplete fix for CVE-2020-16305 (CVE-2023-4042)
These vulnerabilities can lead to data corruption, denial of service, and potential exploitation of the system. For more details, including the impact and CVSS scores, refer to the CVE pages listed in the References section.
How To Fix
Minimum fixed version
9.27-11.el8
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Updating the Ghostscript package to version 9.27-11.el8 or later is crucial to address the identified security vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats for display or printing purposes.
The update addresses three security issues:
- Buffer overflow in base/sbcp.c leading to data corruption (CVE-2023-28879)
- Out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle resulting in DoS (CVE-2023-38559)
- Incomplete fix for CVE-2020-16305 (CVE-2023-4042)
These vulnerabilities can lead to data corruption, denial of service, and potential exploitation of the system.
To fix the vulnerability, it is recommended to update the Ghostscript package to version 9.27-11.el8 or later.
For more details about the security issues, including the impact, CVSS scores, and acknowledgments, refer to the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
