Tavis Ormandy 在 PostScript 語言解譯程式 Ghostscript 中發現數個弱點，如果處理格式錯誤的 Postscript 檔案，可導致拒絕服務、建立檔案或任意程式碼執行 (儘管已啟用 dSAFER 沙箱)。針對 Debian 8「Jessie」，這些問題已在 9.06~dfsg-2+deb8u8 版本中修正。建議您升級 ghostscript 套件。注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

據發現，ghostscript .shfill 運算子未正確驗證某些類型。攻擊者可能會惡意利用此問題繞過 -dSAFER 保護並損毀 ghostscript，或可能在 ghostscript 內容中，透過特製的 PostScript 文件執行任意程式碼。(CVE-2018-15909) 在 Artifex Ghostscript 9.24 之前的版本中發現一個問題。能夠提供特製 PostScript 的遠端攻擊者可利用「ztype」中的類型混淆損毀解譯器，或者可能有其他不明的影響。(CVE-2018-16511) 在 Artifex Ghostscript 9.24 之前的版本中發現一個問題。即使 .setdistillerkeys PostScript 命令在文件處理期間 (例如，啟動階段之後) 不使用，也會接受該命令。這會導致記憶體損毀，進而允許能夠提供特製 PostScript 的遠端攻擊者損毀解譯器，或者可能有其他不明的影響。(CVE-2018-16585) 據發現，ghostscript PDF14 撰寫器未正確處理裝置的複製。攻擊者可能會惡意利用此問題繞過 -dSAFER 保護並損毀 ghostscript，或可能在 ghostscript 內容中，透過特製的 PostScript 文件執行任意程式碼。(CVE-2018-16540) 據發現，ghostscript 裝置清理未正確處理以 null 裝置取代的裝置。攻擊者可能會惡意利用此問題繞過 -dSAFER 保護並損毀 ghostscript，或可能在 ghostscript 內容中，透過特製的 PostScript 文件執行任意程式碼。(CVE-2018-16541) 據發現，ghostscript 未正確限制在啟用 -dSAFER 模式之前開啟之檔案的存取。攻擊者可能會惡意利用此問題繞過 -dSAFER 保護並透過特製的 PostScript 文件，洩漏受影響檔案的內容。(CVE-2018-16539) 在 Artifex Ghostscript 9.25 之前的版本中發現一個問題。能夠提供特製 PostScript 的攻擊者可利用例外處理期間用盡堆疊時，不正確的「權限還原」檢查使用「pipe」指示執行程式碼。這是因為 CVE-2018-16509 的修正不完整之故。(CVE-2018-16802) 據發現，ghostscript 未正確處理某些堆疊溢位錯誤情況。攻擊者可能會惡意利用此問題繞過 -dSAFER 保護並損毀 ghostscript，或可能在 ghostscript 內容中，透過特製的 PostScript 文件執行任意程式碼。(CVE-2018-16542) 執行「status」指示時，Ghostscript 未接受 -dSAFER 選項，這可以用來擷取檔案是否存在及其大小等資訊。特製的 postscript 文件可利用此流程取得目標系統檔案系統內容的相關資訊。(CVE-2018-11645) 據發現，ghostscript 未正確驗證傳遞至 setcolor 函式的運算元。攻擊者可能會惡意利用此問題繞過 -dSAFER 保護並損毀 ghostscript，或可能在 ghostscript 內容中，透過特製的 PostScript 文件執行任意程式碼。(CVE-2018-16513) 據發現，LockDistillerParams 參數的類型未經過正確驗證。攻擊者可能會惡意利用此問題繞過 -dSAFER 保護並損毀 ghostscript，或可能在 ghostscript 內容中，透過特製的 PostScript 文件執行任意程式碼。(CVE-2018-15910) 據發現，在某些情況下，ghostscript /invalidaccess 檢查會失敗。攻擊者可能會惡意利用此問題繞過 -dSAFER 保護，例如，透過特製的 PostScript 文件，執行任意殼層命令。(CVE-2018-16509) 據發現，ghostscript 未正確驗證 aesdecode 中使用的金鑰。攻擊者可能會惡意利用此問題繞過 -dSAFER 保護並損毀 ghostscript，或可能在 ghostscript 內容中，透過特製的 PostScript 文件執行任意程式碼。(CVE-2018-15911) 據發現，ghostscript .tempfile 函式未正確處理檔案權限。攻擊者可能會惡意利用此弱點繞過 -dSAFER 保護，並透過特製的 PostScript 文件，刪除檔案或洩漏其內容。(CVE-2018-15908)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in Artifex Ghostscript before     9.26. LockSafetyParams is not checked correctly if     another device is used. (CVE-2018-19409)

  - It was discovered that the ghostscript .tempfile     function did not properly handle file permissions. An     attacker could possibly exploit this to exploit this to     bypass the -dSAFER protection and delete files or     disclose their content via a specially crafted     PostScript document. (CVE-2018-15908)

  - An issue was discovered in Artifex Ghostscript before     9.25. Incorrect restoration of privilege checking when     running out of stack during exception handling could be     used by attackers able to supply crafted PostScript to     execute code using the pipe instruction. This is due     to an incomplete fix for CVE-2018-16509.
    (CVE-2018-16802)

  - It was discovered that the ghostscript device cleanup     did not properly handle devices replaced with a null     device. An attacker could possibly exploit this to     bypass the -dSAFER protection and crash ghostscript or,     possibly, execute arbitrary code in the ghostscript     context via a specially crafted PostScript document.
    (CVE-2018-16541)

  - It was discovered that ghostscript did not properly     verify the key used in aesdecode. An attacker could     possibly exploit this to bypass the -dSAFER protection     and crash ghostscript or, possibly, execute arbitrary     code in the ghostscript context via a specially crafted     PostScript document. (CVE-2018-15911)

  - It was discovered that the ghostscript did not properly     restrict access to files open prior to enabling the
    -dSAFER mode. An attacker could possibly exploit this to     bypass the -dSAFER protection and disclose the content     of affected files via a specially crafted PostScript     document. (CVE-2018-16539)

  - Artifex Ghostscript before 9.25 allowed a user-writable     error exception table, which could be used by remote     attackers able to supply crafted PostScript to     potentially overwrite or replace error handlers to     inject code. (CVE-2018-17183)

  - Artifex Ghostscript 9.25 and earlier allows attackers to     bypass a sandbox protection mechanism via vectors     involving errorhandler setup. NOTE: this issue exists     because of an incomplete fix for CVE-2018-17183.
    (CVE-2018-17961)

  - Artifex Ghostscript allows attackers to bypass a sandbox     protection mechanism by leveraging exposure of system     operators in the saved execution stack in an error     object. (CVE-2018-18073)

  - Artifex Ghostscript 9.25 and earlier allows attackers to     bypass a sandbox protection mechanism via vectors     involving the 1Policy operator. (CVE-2018-18284)

  - It was found that RHSA-2018:2918 did not fully fix     CVE-2018-16509. An attacker could possibly exploit     another variant of the flaw and bypass the -dSAFER     protection to, for example, execute arbitrary shell     commands via a specially crafted PostScript document.
    (CVE-2018-16863)

  - In Artifex Ghostscript through 9.25, the setpattern     operator did not properly validate certain types. A     specially crafted PostScript document could exploit this     to crash Ghostscript or, possibly, execute arbitrary     code in the context of the Ghostscript process. This is     a type confusion issue because of failure to check     whether the Implementation of a pattern dictionary was a     structure type. (CVE-2018-19134)

  - It was discovered that the ghostscript .shfill operator     did not properly validate certain types. An attacker     could possibly exploit this to bypass the -dSAFER     protection and crash ghostscript or, possibly, execute     arbitrary code in the ghostscript context via a     specially crafted PostScript document. (CVE-2018-15909)

  - It was discovered that the ghostscript .type operator     did not properly validate its operands. A specially     crafted PostScript document could exploit this to crash     ghostscript or, possibly, execute arbitrary code in the     context of the ghostscript process. (CVE-2018-16511)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Artifex Ghostscript installed on the remote Windows host is prior to 9.24. It is, therefore, affected by multiple vulnerabilities due to improperly handling PostScript data. A context-dependent attacker could cause a buffer overflow, potentially crashing the service.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3768-1 advisory.

    Tavis Ormandy discovered multiple security issues in Ghostscript. If a user or automated system were     tricked into processing a specially crafted file, a remote attacker could possibly use these issues to     access arbitrary files, execute arbitrary code, or cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ghostscript to version 9.25 fixes the following issues :

These security issues were fixed :

  - CVE-2018-17183: Remote attackers were be able to supply     crafted PostScript to potentially overwrite or replace     error handlers to inject code (bsc#1109105)

  - CVE-2018-15909: Prevent type confusion using the .shfill     operator that could have been used by attackers able to     supply crafted PostScript files to crash the interpreter     or potentially execute code (bsc#1106172).

  - CVE-2018-15908: Prevent attackers that are able to     supply malicious PostScript files to bypass .tempfile     restrictions and write files (bsc#1106171).

  - CVE-2018-15910: Prevent a type confusion in the     LockDistillerParams parameter that could have been used     to crash the interpreter or execute code (bsc#1106173).

  - CVE-2018-15911: Prevent use uninitialized memory access     in the aesdecode operator that could have been used to     crash the interpreter or potentially execute code     (bsc#1106195).

  - CVE-2018-16513: Prevent a type confusion in the setcolor     function that could have been used to crash the     interpreter or possibly have unspecified other impact     (bsc#1107412).

  - CVE-2018-16509: Incorrect 'restoration of privilege'     checking during handling of /invalidaccess exceptions     could be have been used by attackers able to supply     crafted PostScript to execute code using the 'pipe'     instruction (bsc#1107410).

  - CVE-2018-16510: Incorrect exec stack handling in the     'CS' and 'SC' PDF primitives could have been used by     remote attackers able to supply crafted PDFs to crash     the interpreter or possibly have unspecified other     impact (bsc#1107411).

  - CVE-2018-16542: Prevent attackers able to supply crafted     PostScript files from using insufficient interpreter     stack-size checking during error handling to crash the     interpreter (bsc#1107413).

  - CVE-2018-16541: Prevent attackers able to supply crafted     PostScript files from using incorrect free logic in     pagedevice replacement to crash the interpreter     (bsc#1107421).

  - CVE-2018-16540: Prevent use-after-free in copydevice     handling that could have been used to crash the     interpreter or possibly have unspecified other impact     (bsc#1107420).

  - CVE-2018-16539: Prevent attackers able to supply crafted     PostScript files from using incorrect access checking in     temp file handling to disclose contents of files on the     system otherwise not readable (bsc#1107422).

  - CVE-2018-16543: gssetresolution and gsgetresolution     allowed attackers to have an unspecified impact     (bsc#1107423).

  - CVE-2018-16511: A type confusion in 'ztype' could have     been used by remote attackers able to supply crafted     PostScript to crash the interpreter or possibly have     unspecified other impact (bsc#1107426).

  - CVE-2018-16585: The .setdistillerkeys PostScript command     was accepted even though it is not intended for use     during document processing (e.g., after the startup     phase). This lead to memory corruption, allowing remote     attackers able to supply crafted PostScript to crash the     interpreter or possibly have unspecified other impact     (bsc#1107581).

  - CVE-2018-16802: Incorrect 'restoration of privilege'     checking when running out of stack during exception     handling could have been used by attackers able to     supply crafted PostScript to execute code using the     'pipe' instruction. This is due to an incomplete fix for     CVE-2018-16509 (bsc#1108027).

These non-security issues were fixed :

  - Fixes problems with argument handling, some unintended     results of the security fixes to the SAFER file access     restrictions (specifically accessing ICC profile files).

  - Avoid that ps2epsi fails with 'Error: /undefined in
    --setpagedevice--'

For additional changes please check http://www.ghostscript.com/doc/9.25/News.htm

This update was imported from the SUSE:SLE-15:Update update project.

This update for ghostscript to version 9.25 fixes the following issues :

These security issues were fixed :

CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code (bsc#1109105)

CVE-2018-15909: Prevent type confusion using the .shfill operator that could have been used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code (bsc#1106172).

CVE-2018-15908: Prevent attackers that are able to supply malicious PostScript files to bypass .tempfile restrictions and write files (bsc#1106171).

CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter that could have been used to crash the interpreter or execute code (bsc#1106173).

CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode operator that could have been used to crash the interpreter or potentially execute code (bsc#1106195).

CVE-2018-16513: Prevent a type confusion in the setcolor function that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107412).

CVE-2018-16509: Incorrect 'restoration of privilege' checking during handling of /invalidaccess exceptions could be have been used by attackers able to supply crafted PostScript to execute code using the 'pipe' instruction (bsc#1107410).

CVE-2018-16510: Incorrect exec stack handling in the 'CS' and 'SC' PDF primitives could have been used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact (bsc#1107411).

CVE-2018-16542: Prevent attackers able to supply crafted PostScript files from using insufficient interpreter stack-size checking during error handling to crash the interpreter (bsc#1107413).

CVE-2018-16541: Prevent attackers able to supply crafted PostScript files from using incorrect free logic in pagedevice replacement to crash the interpreter (bsc#1107421).

CVE-2018-16540: Prevent use-after-free in copydevice handling that could have been used to crash the interpreter or possibly have unspecified other impact (bsc#1107420).

CVE-2018-16539: Prevent attackers able to supply crafted PostScript files from using incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable (bsc#1107422).

CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have an unspecified impact (bsc#1107423).

CVE-2018-16511: A type confusion in 'ztype' could have been used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107426).

CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even though it is not intended for use during document processing (e.g., after the startup phase). This lead to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact (bsc#1107581).

CVE-2018-16802: Incorrect 'restoration of privilege' checking when running out of stack during exception handling could have been used by attackers able to supply crafted PostScript to execute code using the 'pipe' instruction. This is due to an incomplete fix for CVE-2018-16509 (bsc#1108027).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the ghostscript .tempfile     function did not properly handle file permissions. An     attacker could possibly exploit this to exploit this to     bypass the -dSAFER protection and delete files or     disclose their content via a specially crafted     PostScript document.i1/4^CVE-2018-15908i1/4%0

  - It was discovered that the ghostscript .shfill operator     did not properly validate certain types. An attacker     could possibly exploit this to bypass the -dSAFER     protection and crash ghostscript or, possibly, execute     arbitrary code in the ghostscript context via a     specially crafted PostScript     document.i1/4^CVE-2018-15909i1/4%0

  - It was discovered that ghostscript did not properly     verify the key used in aesdecode. An attacker could     possibly exploit this to bypass the -dSAFER protection     and crash ghostscript or, possibly, execute arbitrary     code in the ghostscript context via a specially crafted     PostScript document.i1/4^CVE-2018-15911i1/4%0

  - It was discovered that the ghostscript .type operator     did not properly validate its operands. A specially     crafted PostScript document could exploit this to crash     ghostscript or, possibly, execute arbitrary code in the     context of the ghostscript process.i1/4^CVE-2018-16511i1/4%0

  - It was discovered that the ghostscript did not properly     restrict access to files open prior to enabling the
    -dSAFER mode. An attacker could possibly exploit this     to bypass the -dSAFER protection and disclose the     content of affected files via a specially crafted     PostScript document.i1/4^CVE-2018-16539i1/4%0

  - It was discovered that the ghostscript device cleanup     did not properly handle devices replaced with a null     device. An attacker could possibly exploit this to     bypass the -dSAFER protection and crash ghostscript or,     possibly, execute arbitrary code in the ghostscript     context via a specially crafted PostScript     document.i1/4^CVE-2018-16541i1/4%0

  - An issue was discovered in Artifex Ghostscript before     9.25. Incorrect 'restoration of privilege' checking     when running out of stack during exception handling     could be used by attackers able to supply crafted     PostScript to execute code using the 'pipe'     instruction. This is due to an incomplete fix for     CVE-2018-16509.i1/4^CVE-2018-16802i1/4%0

  - It was found that RHSA-2018:2918 did not fully fix     CVE-2018-16509. An attacker could possibly exploit     another variant of the flaw and bypass the -dSAFER     protection to, for example, execute arbitrary shell     commands via a specially crafted PostScript     document.i1/4^CVE-2018-16863i1/4%0

  - Artifex Ghostscript before 9.25 allowed a user-writable     error exception table, which could be used by remote     attackers able to supply crafted PostScript to     potentially overwrite or replace error handlers to     inject code.i1/4^CVE-2018-17183i1/4%0

  - Artifex Ghostscript 9.25 and earlier allows attackers     to bypass a sandbox protection mechanism via vectors     involving errorhandler setup. NOTE: this issue exists     because of an incomplete fix for     CVE-2018-17183.i1/4^CVE-2018-17961i1/4%0

  - Artifex Ghostscript allows attackers to bypass a     sandbox protection mechanism by leveraging exposure of     system operators in the saved execution stack in an     error object.i1/4^CVE-2018-18073i1/4%0

  - Artifex Ghostscript 9.25 and earlier allows attackers     to bypass a sandbox protection mechanism via vectors     involving the 1Policy operator.i1/4^CVE-2018-18284i1/4%0

  - In Artifex Ghostscript through 9.25, the setpattern     operator did not properly validate certain types. A     specially crafted PostScript document could exploit     this to crash Ghostscript or, possibly, execute     arbitrary code in the context of the Ghostscript     process. This is a type confusion issue because of     failure to check whether the Implementation of a     pattern dictionary was a structure     type.i1/4^CVE-2018-19134i1/4%0

  - An issue was discovered in Artifex Ghostscript before     9.26. LockSafetyParams is not checked correctly if     another device is used.i1/4^CVE-2018-19409i1/4%0

  - It was discovered that ghostscript did not properly     handle certain stack overflow error conditions. An     attacker could possibly exploit this to bypass the
    -dSAFER protection and crash ghostscript or, possibly,     execute arbitrary code in the ghostscript context via a     specially crafted PostScript     document.i1/4^CVE-2018-16542i1/4%0

  - It was discovered that the type of the     LockDistillerParams parameter is not properly verified.
    An attacker could possibly exploit this to bypass the
    -dSAFER protection and crash ghostscript or, possibly,     execute arbitrary code in the ghostscript context via a     specially crafted PostScript     document.i1/4^CVE-2018-15910i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the ghostscript .tempfile     function did not properly handle file permissions. An     attacker could possibly exploit this to exploit this to     bypass the -dSAFER protection and delete files or     disclose their content via a specially crafted     PostScript document.i1/4^CVE-2018-15908i1/4%0

  - It was discovered that the ghostscript .shfill operator     did not properly validate certain types. An attacker     could possibly exploit this to bypass the -dSAFER     protection and crash ghostscript or, possibly, execute     arbitrary code in the ghostscript context via a     specially crafted PostScript     document.i1/4^CVE-2018-15909i1/4%0

  - It was discovered that ghostscript did not properly     verify the key used in aesdecode. An attacker could     possibly exploit this to bypass the -dSAFER protection     and crash ghostscript or, possibly, execute arbitrary     code in the ghostscript context via a specially crafted     PostScript document.i1/4^CVE-2018-15911i1/4%0

  - It was discovered that the ghostscript .type operator     did not properly validate its operands. A specially     crafted PostScript document could exploit this to crash     ghostscript or, possibly, execute arbitrary code in the     context of the ghostscript process.i1/4^CVE-2018-16511i1/4%0

  - It was discovered that the ghostscript did not properly     restrict access to files open prior to enabling the
    -dSAFER mode. An attacker could possibly exploit this     to bypass the -dSAFER protection and disclose the     content of affected files via a specially crafted     PostScript document.i1/4^CVE-2018-16539i1/4%0

  - It was discovered that the ghostscript device cleanup     did not properly handle devices replaced with a null     device. An attacker could possibly exploit this to     bypass the -dSAFER protection and crash ghostscript or,     possibly, execute arbitrary code in the ghostscript     context via a specially crafted PostScript     document.i1/4^CVE-2018-16541i1/4%0

  - An issue was discovered in Artifex Ghostscript before     9.25. Incorrect 'restoration of privilege' checking     when running out of stack during exception handling     could be used by attackers able to supply crafted     PostScript to execute code using the 'pipe'     instruction. This is due to an incomplete fix for     CVE-2018-16509.i1/4^CVE-2018-16802i1/4%0

  - It was found that RHSA-2018:2918 did not fully fix     CVE-2018-16509. An attacker could possibly exploit     another variant of the flaw and bypass the -dSAFER     protection to, for example, execute arbitrary shell     commands via a specially crafted PostScript     document.i1/4^CVE-2018-16863i1/4%0

  - Artifex Ghostscript before 9.25 allowed a user-writable     error exception table, which could be used by remote     attackers able to supply crafted PostScript to     potentially overwrite or replace error handlers to     inject code.i1/4^CVE-2018-17183i1/4%0

  - Artifex Ghostscript 9.25 and earlier allows attackers     to bypass a sandbox protection mechanism via vectors     involving errorhandler setup. NOTE: this issue exists     because of an incomplete fix for     CVE-2018-17183.i1/4^CVE-2018-17961i1/4%0

  - Artifex Ghostscript allows attackers to bypass a     sandbox protection mechanism by leveraging exposure of     system operators in the saved execution stack in an     error object.i1/4^CVE-2018-18073i1/4%0

  - Artifex Ghostscript 9.25 and earlier allows attackers     to bypass a sandbox protection mechanism via vectors     involving the 1Policy operator.i1/4^CVE-2018-18284i1/4%0

  - In Artifex Ghostscript through 9.25, the setpattern     operator did not properly validate certain types. A     specially crafted PostScript document could exploit     this to crash Ghostscript or, possibly, execute     arbitrary code in the context of the Ghostscript     process. This is a type confusion issue because of     failure to check whether the Implementation of a     pattern dictionary was a structure     type.i1/4^CVE-2018-19134i1/4%0

  - An issue was discovered in Artifex Ghostscript before     9.26. LockSafetyParams is not checked correctly if     another device is used.i1/4^CVE-2018-19409i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Tavis Ormandy discovered multiple vulnerabilites in Ghostscript, an interpreter for the PostScript language, which could result in denial of service, the creation of files or the execution of arbitrary code if a malformed Postscript file is processed (despite the dSAFER sandbox being enabled).

This update for ghostscript to version 9.25 fixes the following issues :

These security issues were fixed :

  - CVE-2018-17183: Remote attackers were be able to supply     crafted PostScript to potentially overwrite or replace     error handlers to inject code (bsc#1109105)

  - CVE-2018-15909: Prevent type confusion using the .shfill     operator that could have been used by attackers able to     supply crafted PostScript files to crash the interpreter     or potentially execute code (bsc#1106172).

  - CVE-2018-15908: Prevent attackers that are able to     supply malicious PostScript files to bypass .tempfile     restrictions and write files (bsc#1106171).

  - CVE-2018-15910: Prevent a type confusion in the     LockDistillerParams parameter that could have been used     to crash the interpreter or execute code (bsc#1106173).

  - CVE-2018-15911: Prevent use uninitialized memory access     in the aesdecode operator that could have been used to     crash the interpreter or potentially execute code     (bsc#1106195).

  - CVE-2018-16513: Prevent a type confusion in the setcolor     function that could have been used to crash the     interpreter or possibly have unspecified other impact     (bsc#1107412).

  - CVE-2018-16509: Incorrect 'restoration of privilege'     checking during handling of /invalidaccess exceptions     could be have been used by attackers able to supply     crafted PostScript to execute code using the 'pipe'     instruction (bsc#1107410).

  - CVE-2018-16510: Incorrect exec stack handling in the     'CS' and 'SC' PDF primitives could have been used by     remote attackers able to supply crafted PDFs to crash     the interpreter or possibly have unspecified other     impact (bsc#1107411).

  - CVE-2018-16542: Prevent attackers able to supply crafted     PostScript files from using insufficient interpreter     stack-size checking during error handling to crash the     interpreter (bsc#1107413).

  - CVE-2018-16541: Prevent attackers able to supply crafted     PostScript files from using incorrect free logic in     pagedevice replacement to crash the interpreter     (bsc#1107421).

  - CVE-2018-16540: Prevent use-after-free in copydevice     handling that could have been used to crash the     interpreter or possibly have unspecified other impact     (bsc#1107420).

  - CVE-2018-16539: Prevent attackers able to supply crafted     PostScript files from using incorrect access checking in     temp file handling to disclose contents of files on the     system otherwise not readable (bsc#1107422).

  - CVE-2018-16543: gssetresolution and gsgetresolution     allowed attackers to have an unspecified impact     (bsc#1107423).

  - CVE-2018-16511: A type confusion in 'ztype' could have     been used by remote attackers able to supply crafted     PostScript to crash the interpreter or possibly have     unspecified other impact (bsc#1107426).

  - CVE-2018-16585: The .setdistillerkeys PostScript command     was accepted even though it is not intended for use     during document processing (e.g., after the startup     phase). This lead to memory corruption, allowing remote     attackers able to supply crafted PostScript to crash the     interpreter or possibly have unspecified other impact     (bsc#1107581).

  - CVE-2018-16802: Incorrect 'restoration of privilege'     checking when running out of stack during exception     handling could have been used by attackers able to     supply crafted PostScript to execute code using the     'pipe' instruction. This is due to an incomplete fix for     CVE-2018-16509 (bsc#1108027).

These non-security issues were fixed :

  - Fixes problems with argument handling, some unintended     results of the security fixes to the SAFER file access     restrictions (specifically accessing ICC profile files).

  - Avoid that ps2epsi fails with 'Error: /undefined in
    --setpagedevice--'

For additional changes please check http://www.ghostscript.com/doc/9.25/News.htm and the changes file of the package. This update was imported from the SUSE:SLE-12:Update update project.

ID	名稱	產品	系列	已發布	已更新	嚴重性
117487	Debian DLA-1504-1：ghostscript 安全性更新	Nessus	Debian Local Security Checks	2018/9/14	2024/8/8	high
118043	Amazon Linux 2 : ghostscript (ALAS-2018-1088)	Nessus	Amazon Linux Local Security Checks	2018/10/11	2024/7/31	high
127227	NewStart CGSL CORE 5.04 / MAIN 5.04 : ghostscript Multiple Vulnerabilities (NS-SA-2019-0046)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	critical
117459	Artifex Ghostscript Multiple Vulnerabilities	Nessus	Windows	2018/9/12	2020/4/27	high
117595	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Ghostscript vulnerabilities (USN-3768-1)	Nessus	Ubuntu Local Security Checks	2018/9/19	2024/8/27	high
117980	openSUSE Security Update : ghostscript (openSUSE-2018-1123)	Nessus	SuSE Local Security Checks	2018/10/9	2024/7/31	high
120116	SUSE SLED15 / SLES15 Security Update : ghostscript (SUSE-SU-2018:2976-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	high
121276	EulerOS Virtualization 2.5.1 : ghostscript (EulerOS-SA-2019-1016)	Nessus	Huawei Local Security Checks	2019/1/22	2022/5/24	critical
123891	EulerOS Virtualization 2.5.3 : ghostscript (EulerOS-SA-2019-1205)	Nessus	Huawei Local Security Checks	2019/4/9	2022/5/20	critical
117369	Debian DSA-4288-1 : ghostscript - security update	Nessus	Debian Local Security Checks	2018/9/10	2024/8/8	high
117901	SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2018:2975-1)	Nessus	SuSE Local Security Checks	2018/10/3	2024/8/1	high
117979	openSUSE Security Update : ghostscript (openSUSE-2018-1122)	Nessus	SuSE Local Security Checks	2018/10/9	2024/7/31	high
123326	openSUSE Security Update : ghostscript (openSUSE-2019-759)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/10	high

偵測

搜尋 Plugin

high

high

critical

high

high

high

high

critical

critical

high

high

high

high