Moderate: ghostscript security and bug fix update
Summary
ALSA-2023:6544: Moderate: ghostscript security and bug fix update. Affects ghostscript versions < 9.54.0-13.el9. Fixed in 9.54.0-13.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It is responsible for translating PostScript code into common bitmap formats for display or printing purposes.
Vulnerability Detail
The vulnerability in Ghostscript includes a buffer overflow in base/sbcp.c, which can lead to data corruption (CVE-2023-28879). Additionally, there is an out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle that could result in a denial-of-service (DoS) attack (CVE-2023-38559). These vulnerabilities can have various impacts on the system, including potential data corruption and DoS attacks.
How To Fix
Minimum fixed version
9.54.0-13.el9
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, it is important to update Ghostscript to the recommended version to address the identified vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats for display or printing.
The vulnerabilities can lead to data corruption and denial-of-service attacks.
To fix these vulnerabilities, update Ghostscript to version 9.54.0-13.el9 or later.
No specific workarounds have been mentioned for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
