High ALAS2023-2024-774 4 CVEs

Important: ghostscript security update (Amazon Linux 2023)

Published Dec 5, 2024 · Updated Dec 16, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-46956: PostScript interpreter - fix buffer length check NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707895 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f4151f12db32cd3ed26c24327de714bf2c3ed6ca NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ea69a1388245ad959d31c272b5ba66d40cebba2c (ghostpdl-10.04.0) CVE-2024-46953: Check for overflow validating format string NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707793 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=294a3755e33f453dd92e2a7c4cfceb087ac09d6a (ghostpdl-10.04.0) CVE-2024-46952: PDF interpreter - sanitise W array values in Xref streams NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=708001 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=b1f0827c30f59a2dcbc8a39e42cace7a1de35f7f NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1fb76aaddac34530242dfbb9579d9997dae41264 (ghostpdl-10.04.0) CVE-2024-46951: PS interpreter - check the type of the Pattern Implementation NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707991 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f49812186baa7d1362880673408a6fbe8719b4f8 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ada21374f0c90cc3acf7ce0e96302394560c7aee (ghostpdl-10.04.0)

Fixed packages 14

Release	Package	Fixed in
Amazon Linux · 2023	ghostscript	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-debuginfo	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-debugsource	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-doc	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-gtk	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-gtk-debuginfo	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-tools-dvipdf	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-tools-fonts	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-tools-printing	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-x11	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	ghostscript-x11-debuginfo	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	libgs	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	libgs-debuginfo	0:9.56.1-7.amzn2023.0.11
Amazon Linux · 2023	libgs-devel	0:9.56.1-7.amzn2023.0.11

Vulnerabilities 4

High 8.4

CVE-2024-46952

An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during hand…

ghostscript ghostscript ghostscript Debian Ubuntu Alpine

Nov 10, 2024
High 7.8

CVE-2024-46951

An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in P…

ghostscript ghostscript ghostscript Debian Ubuntu Alpine

Nov 10, 2024
High 7.8

CVE-2024-46953

An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the …

ghostscript ghostscript ghostscript Debian Ubuntu Alpine

Nov 10, 2024
High 7.8

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenamefora…

ghostscript ghostscript ghostscript Debian Ubuntu Alpine

Nov 10, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-46951.html
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46952.html
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46953.html
web
https://alas.aws.amazon.com/cve/html/CVE-2024-46956.html