Summary
[9.07-31.el7_6.1]
- Remove as many non-standard operators as possible to make the codebase
closer to upstream for later CVEs
- Resolves: #1621383 - CVE-2018-16511 ghostscript: missing type check in type
checker (699659)
- Resolves: #1621159 - CVE-2018-15908 ghostscript: .tempfile file permission
issues (699657)
- Resolves: #1621381 - CVE-2018-15909 ghostscript: shading_param incomplete
type checking (699660)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ghostscript | 0:9.07-31.el7_6.1 |
| Oracle Linux · 7 | ghostscript-cups | 0:9.07-31.el7_6.1 |
| Oracle Linux · 7 | ghostscript-devel | 0:9.07-31.el7_6.1 |
| Oracle Linux · 7 | ghostscript-doc | 0:9.07-31.el7_6.1 |
| Oracle Linux · 7 | ghostscript-gtk | 0:9.07-31.el7_6.1 |
Vulnerabilities 4
-
Unscored —
In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempf…
-
Unscored —
In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers a…
-
Unscored —
An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attacke…
-
Unscored —
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checki…