Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-36773: Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single character code in a PDF document can map to more than one Unicode code point (e.g., for a ligature).
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ghostscript | 0:9.25-5.amzn2.0.9 |
| Amazon Linux · 2 | ghostscript-cups | 0:9.25-5.amzn2.0.9 |
| Amazon Linux · 2 | ghostscript-debuginfo | 0:9.25-5.amzn2.0.9 |
| Amazon Linux · 2 | ghostscript-doc | 0:9.25-5.amzn2.0.9 |
| Amazon Linux · 2 | ghostscript-gtk | 0:9.25-5.amzn2.0.9 |
| Amazon Linux · 2 | libgs | 0:9.25-5.amzn2.0.9 |
| Amazon Linux · 2 | libgs-devel | 0:9.25-5.amzn2.0.9 |
Vulnerabilities 1
-
Critical 9.8
Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwr…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-36773.html