Skip to content
OpenAdvisories
High ALAS2023-2025-907 1 CVE

Important: ghostscript security update (Amazon Linux 2023)

Published Mar 26, 2025 · Updated Apr 1, 2025

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-27832: The calculation of the buffer size was being done with int values, and overflowing that data type. The bug has existed since the creation of the file contrib/japanese/gdevnpdl.c The calculation of the buffer size was being done with int values, and overflowing that data type. By leaving the total size calculation to the memory manager, the calculation ends up being done in size_t values, and avoiding the overflow in this case, but also meaning the memory manager overflow protection will be effective. Fixed in ghostpdl-10.05.0 Info: https://bugs.ghostscript.com/show_bug.cgi?id=708133 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=57291c846334f1585552010faa42d7cb2cbd5c41

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2023 ghostscript 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-debuginfo 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-debugsource 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-doc 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-gtk 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-gtk-debuginfo 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-tools-dvipdf 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-tools-fonts 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-tools-printing 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-x11 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 ghostscript-x11-debuginfo 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 libgs 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 libgs-debuginfo 0:9.56.1-7.amzn2023.0.14
Amazon Linux · 2023 libgs-devel 0:9.56.1-7.amzn2023.0.14

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27832.html