Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10194: The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. 1569108: CVE-2018-10194 ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ghostscript | 0:9.06-2.amzn2.0.2 |
| Amazon Linux · 2 | ghostscript-cups | 0:9.06-2.amzn2.0.2 |
| Amazon Linux · 2 | ghostscript-debuginfo | 0:9.06-2.amzn2.0.2 |
| Amazon Linux · 2 | ghostscript-devel | 0:9.06-2.amzn2.0.2 |
| Amazon Linux · 2 | ghostscript-doc | 0:9.06-2.amzn2.0.2 |
| Amazon Linux · 2 | ghostscript-gtk | 0:9.06-2.amzn2.0.2 |
Vulnerabilities 1
-
Unscored —
The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-10194.html