Skip to content
OpenAdvisories
High ALAS2023-2023-362 1 CVE

Important: ghostscript security update (Amazon Linux 2023)

Published Sep 27, 2023 · Updated Oct 3, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-43115: In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2023 ghostscript 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-debuginfo 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-debugsource 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-doc 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-gtk 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-gtk-debuginfo 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-tools-dvipdf 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-tools-fonts 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-tools-printing 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-x11 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 ghostscript-x11-debuginfo 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 libgs 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 libgs-debuginfo 0:9.56.1-7.amzn2023.0.4
Amazon Linux · 2023 libgs-devel 0:9.56.1-7.amzn2023.0.4

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-43115.html