Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-27792: A heap-based buffer over write vulnerability was found in GhostScript's lp8000_print_page() function in gdevlp8k.c file. An attacker could trick a user to open a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ghostscript | 0:9.25-5.amzn2.0.1 |
| Amazon Linux · 2 | ghostscript-cups | 0:9.25-5.amzn2.0.1 |
| Amazon Linux · 2 | ghostscript-debuginfo | 0:9.25-5.amzn2.0.1 |
| Amazon Linux · 2 | ghostscript-doc | 0:9.25-5.amzn2.0.1 |
| Amazon Linux · 2 | ghostscript-gtk | 0:9.25-5.amzn2.0.1 |
| Amazon Linux · 2 | libgs | 0:9.25-5.amzn2.0.1 |
| Amazon Linux · 2 | libgs-devel | 0:9.25-5.amzn2.0.1 |
Vulnerabilities 1
-
High 7.1
Ghostscript: heap buffer over write vulnerability in ghostscript's lp8000_print_page() in gdevlp8k.c
A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to me…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-27792.html