Описание
Security update for ghostscript
This update for ghostscript fixes the following issues:
Security issue fixed:
- CVE-2019-10216: Fix privilege escalation via specially crafted PostScript file (bsc#1144621).
This update was imported from the SUSE:SLE-15:Update update project.
Список пакетов
openSUSE Leap 15.1
ghostscript-9.26a-lp151.3.3.1
ghostscript-devel-9.26a-lp151.3.3.1
ghostscript-mini-9.26a-lp151.3.3.1
ghostscript-mini-devel-9.26a-lp151.3.3.1
ghostscript-x11-9.26a-lp151.3.3.1
Ссылки
- E-Mail link for openSUSE-SU-2019:2139-1
- SUSE Security Ratings
- SUSE Bug 1144621
- SUSE CVE CVE-2019-10216 page
Описание
In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.
Затронутые продукты
openSUSE Leap 15.1:ghostscript-9.26a-lp151.3.3.1
openSUSE Leap 15.1:ghostscript-devel-9.26a-lp151.3.3.1
openSUSE Leap 15.1:ghostscript-mini-9.26a-lp151.3.3.1
openSUSE Leap 15.1:ghostscript-mini-devel-9.26a-lp151.3.3.1
Ссылки
- CVE-2019-10216
- SUSE Bug 1144621
- SUSE Bug 1146882
- SUSE Bug 1146884