High ALAS2-2024-2708 3 CVEs

Important: ghostscript security update (Amazon Linux 2)

Published Dec 5, 2024 · Updated Dec 19, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-46956: PostScript interpreter - fix buffer length check NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707895 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f4151f12db32cd3ed26c24327de714bf2c3ed6ca NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ea69a1388245ad959d31c272b5ba66d40cebba2c (ghostpdl-10.04.0) CVE-2024-46953: Check for overflow validating format string NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707793 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=294a3755e33f453dd92e2a7c4cfceb087ac09d6a (ghostpdl-10.04.0) CVE-2024-46951: PS interpreter - check the type of the Pattern Implementation NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707991 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f49812186baa7d1362880673408a6fbe8719b4f8 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ada21374f0c90cc3acf7ce0e96302394560c7aee (ghostpdl-10.04.0)

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2	ghostscript	0:9.54.0-9.amzn2.0.7
Amazon Linux · 2	ghostscript-cups	0:9.54.0-9.amzn2.0.7
Amazon Linux · 2	ghostscript-debuginfo	0:9.54.0-9.amzn2.0.7
Amazon Linux · 2	ghostscript-doc	0:9.54.0-9.amzn2.0.7
Amazon Linux · 2	ghostscript-gtk	0:9.54.0-9.amzn2.0.7
Amazon Linux · 2	libgs	0:9.54.0-9.amzn2.0.7
Amazon Linux · 2	libgs-devel	0:9.54.0-9.amzn2.0.7

Vulnerabilities 3

High 7.8

CVE-2024-46951

An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in P…

ghostscript ghostscript ghostscript Debian Ubuntu Alpine

Nov 10, 2024
High 7.8

CVE-2024-46953

An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the …

ghostscript ghostscript ghostscript Debian Ubuntu Alpine

Nov 10, 2024
High 7.8

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenamefora…

ghostscript ghostscript ghostscript Debian Ubuntu Alpine

Nov 10, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-46951.html
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46953.html
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46956.html