Security update for ghostscript
This update for ghostscript to version 9.26 fixes the following issues: Security issues fixed: - CVE-2018-19475: Fixed bypass of an intended access restriction in psi/zdevice2.c (bsc#1117327) - CVE-2018-19476: Fixed bypass of an intended access restriction in psi/zicc.c (bsc#1117313) - CVE-2018-19477: Fixed bypass of an intended access restriction in psi/zfjbig2.c (bsc#1117274) - CVE-2018-19409: Check if another device is used correctly in LockSafetyParams (bsc#1117022) - CVE-2018-18284: Fixed potential sandbox escape through 1Policy operator (bsc#1112229) - CVE-2018-18073: Fixed leaks through operator in saved execution stacks (bsc#1111480) - CVE-2018-17961: Fixed a -dSAFER sandbox escape by bypassing executeonly (bsc#1111479) - CVE-2018-17183: Fixed a potential code injection by specially crafted PostScript files (bsc#1109105) Version update to 9.26 (bsc#1117331): - Security issues have been the primary focus - Minor bug fixes and improvements - For release summary see: http://www.ghostscript.com/doc/9.26/News.htm
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for ghostscript to version 9.26 fixes the following issues: Security issues fixed: - CVE-2018-19475: Fixed bypass of an intended access restriction in psi/zdevice2.c (bsc#1117327) - CVE-2018-19476: Fixed bypass of an intended access restriction in psi/zicc.c (bsc#1117313) - CVE-2018-19477: Fixed bypass of an intended access restriction in psi/zfjbig2.c (bsc#1117274) - CVE-2018-19409: Check if another device is used correctly in LockSafetyParams (bsc#1117022) - CVE-2018-18284: Fixed potential sandbox escape through 1Policy operator (bsc#1112229) - CVE-2018-18073: Fixed leaks through operator in saved execution stacks (bsc#1111480) - CVE-2018-17961: Fixed a -dSAFER sandbox escape by bypassing executeonly (bsc#1111479) - CVE-2018-17183: Fixed a potential code injection by specially crafted PostScript files (bsc#1109105) Version update to 9.26 (bsc#1117331): - Security issues have been the primary focus - Minor bug fixes and improvements - For release summary see: http://www.ghostscript.com/doc/9.26/News.htm
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1109105
- https://bugzilla.suse.com/1111479
- https://bugzilla.suse.com/1111480
- https://bugzilla.suse.com/1112229
- https://bugzilla.suse.com/1117022
- https://bugzilla.suse.com/1117274
- https://bugzilla.suse.com/1117313
- https://bugzilla.suse.com/1117327
- https://bugzilla.suse.com/1117331
- https://www.suse.com/security/cve/CVE-2018-17183
- https://www.suse.com/security/cve/CVE-2018-17961
- https://www.suse.com/security/cve/CVE-2018-18073
- https://www.suse.com/security/cve/CVE-2018-18284
- https://www.suse.com/security/cve/CVE-2018-19409
- https://www.suse.com/security/cve/CVE-2018-19475
- https://www.suse.com/security/cve/CVE-2018-19476
- https://www.suse.com/security/cve/CVE-2018-19477
- https://www.suse.com/support/update/announcement/2018/suse-su-20184090-1/