ALAS2-2025-2820 — Important: ghostscript security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-27837: Patch to error check UTF-8 conversions. Fixed in ghostpdl-10.05.0 by adding a check on the value returned by the gp_utf8_to_uint16 function. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708238 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=dbb9f2b11f820697e77863523a8d835ab040e5d1 (ghostpdl-10.05.0) CVE-2025-27836: Potential print buffer overflow. Fixed in ghostpdl-10.05.0 by implementing stricter buffer length validation. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708192 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=8b6d19b2b4079da6863ef25f2370f25d4b054919 (ghostpdl-10.05.0) CVE-2025-27835: Fix confusion between bytes and shorts. Data is being copied from a string in multiple of shorts, rather than multiple of bytes, leading to both a read (probably benign, given the memory manager) and write buffer overflow. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708131 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=de900010a6f2310d1fd54e99eeba466693da0e13 (ghostpdl-10.05.0)