Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:2347-1

Опубликовано: 10 сент. 2019
Источник: suse-cvrf

Описание

Security update for ghostscript

This update for ghostscript fixes the following issues:

Security issue fixed:

  • CVE-2019-10216: Fix privilege escalation via specially crafted PostScript file (bsc#1144621).

Список пакетов

SUSE Linux Enterprise Desktop 12 SP4
ghostscript-9.26a-23.25.1
ghostscript-x11-9.26a-23.25.1
SUSE Linux Enterprise Server 12 SP4
ghostscript-9.26a-23.25.1
ghostscript-x11-9.26a-23.25.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4
ghostscript-9.26a-23.25.1
ghostscript-x11-9.26a-23.25.1
SUSE Linux Enterprise Software Development Kit 12 SP4
ghostscript-devel-9.26a-23.25.1

Ссылки

Описание

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP4:ghostscript-9.26a-23.25.1
SUSE Linux Enterprise Desktop 12 SP4:ghostscript-x11-9.26a-23.25.1
SUSE Linux Enterprise Server 12 SP4:ghostscript-9.26a-23.25.1
SUSE Linux Enterprise Server 12 SP4:ghostscript-x11-9.26a-23.25.1
Ссылки