Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-27832: The calculation of the buffer size was being done with int values, and overflowing that data type. The bug has existed since the creation of the file contrib/japanese/gdevnpdl.c The calculation of the buffer size was being done with int values, and overflowing that data type. By leaving the total size calculation to the memory manager, the calculation ends up being done in size_t values, and avoiding the overflow in this case, but also meaning the memory manager overflow protection will be effective. Fixed in ghostpdl-10.05.0 Info: https://bugs.ghostscript.com/show_bug.cgi?id=708133 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=57291c846334f1585552010faa42d7cb2cbd5c41
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | ghostscript | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-debuginfo | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-debugsource | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-doc | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-gtk | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-gtk-debuginfo | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-tools-dvipdf | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-tools-fonts | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-tools-printing | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-x11 | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | ghostscript-x11-debuginfo | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | libgs | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | libgs-debuginfo | 0:9.56.1-7.amzn2023.0.14 |
| Amazon Linux · 2023 | libgs-devel | 0:9.56.1-7.amzn2023.0.14 |
Vulnerabilities 1
-
Critical 9.8
An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for co…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-27832.html