Skip to content
OpenAdvisories
High ALAS2023-2025-908 2 CVEs

Important: ghostscript security update (Amazon Linux 2023)

Published Mar 26, 2025 · Updated Apr 1, 2025

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-27831: Text buffer overflow with long characters; the txt_get_unicode function was copying too few bytes from the fixed glyph name to unicode mapping tables. This was probably causing incorrect Unicode code points in relatively rare cases but not otherwise a problem. However, a badly formed GlyphNames2Unicode array attached to a font could cause the decoding to spill over the assigned buffer. Patched in ghostpdl-10.05.0 CVE-2025-27830: Potential integer and buffer overflow with DollarBlend during serializing a multiple master font for passing to Freetype. Fixed by changing a variable type from short to unsigned short and checking if a length variable exceeds permitted limit. Fixed in ghostpdl-10.05.0

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2023 ghostscript 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-debuginfo 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-debugsource 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-doc 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-gtk 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-gtk-debuginfo 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-tools-dvipdf 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-tools-fonts 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-tools-printing 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-x11 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 ghostscript-x11-debuginfo 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 libgs 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 libgs-debuginfo 0:9.56.1-7.amzn2023.0.15
Amazon Linux · 2023 libgs-devel 0:9.56.1-7.amzn2023.0.15

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27830.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27831.html