Skip to content
OpenAdvisories
High ALAS2023-2025-927 4 CVEs

Important: ghostscript security update (Amazon Linux 2023)

Published Apr 9, 2025 · Updated Apr 14, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-27837: Patch to error check UTF-8 conversions. Fixed in ghostpdl-10.05.0 by adding a check on the value returned by the gp_utf8_to_uint16 function. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708238 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=dbb9f2b11f820697e77863523a8d835ab040e5d1 (ghostpdl-10.05.0) CVE-2025-27836: Potential print buffer overflow. Fixed in ghostpdl-10.05.0 by implementing stricter buffer length validation. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708192 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=8b6d19b2b4079da6863ef25f2370f25d4b054919 (ghostpdl-10.05.0) CVE-2025-27835: Fix confusion between bytes and shorts. Data is being copied from a string in multiple of shorts, rather than multiple of bytes, leading to both a read (probably benign, given the memory manager) and write buffer overflow. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708131 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=de900010a6f2310d1fd54e99eeba466693da0e13 (ghostpdl-10.05.0) CVE-2025-27834: PDF interpreter - Guard against unsigned int overflow. A large Type 4 function definition can overflow the uint counter, causing the allocated buffer to be smaller than required. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708253 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ef42ff180a04926e187d40faea40d4a43e304e3b (ghostpdl-10.05.0)

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2023 ghostscript 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-debuginfo 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-debugsource 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-doc 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-gtk 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-gtk-debuginfo 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-tools-dvipdf 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-tools-fonts 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-tools-printing 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-x11 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 ghostscript-x11-debuginfo 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 libgs 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 libgs-debuginfo 0:9.56.1-7.amzn2023.0.16
Amazon Linux · 2023 libgs-devel 0:9.56.1-7.amzn2023.0.16

Vulnerabilities 4

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27834.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27835.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27836.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-27837.html