Описание
Security update for ghostscript-library
This update for ghostscript-library fixes the following issues:
- CVE-2018-10194: Fixed a stack-based buffer overflow in gdevpdts.c (bsc#1090099)
- Fixed a crash in the fix for CVE-2016-9601.
Список пакетов
SUSE Linux Enterprise Server 11 SP4
SUSE Linux Enterprise Server for SAP Applications 11 SP4
SUSE Linux Enterprise Software Development Kit 11 SP4
Ссылки
- Link for SUSE-SU-2018:1369-1
- E-Mail link for SUSE-SU-2018:1369-1
- SUSE Security Ratings
- SUSE Bug 1090099
- SUSE CVE CVE-2016-9601 page
- SUSE CVE CVE-2018-10194 page
Описание
ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_image function which is used to decode halftone segments in a JBIG2 image. A document (PostScript or PDF) with an embedded, specially crafted, jbig2 image could trigger a segmentation fault in ghostscript.
Затронутые продукты
Ссылки
- CVE-2016-9601
- SUSE Bug 1018128
- SUSE Bug 1036453
Описание
The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document.
Затронутые продукты
Ссылки
- CVE-2018-10194
- SUSE Bug 1090099