Red Hat Security Advisory: ghostscript security and bug fix update

Fixed packages 21

Vulnerabilities 2

• Critical 9.8
  CVE-2023-28879

  In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to …

  ghostscript ghostscript ghostscript Debian Ubuntu Alpine
  Mar 31, 2023
• Medium 5.5
  CVE-2023-38559

  Ghostscript: out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in dos

  A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Wolfi
  Aug 1, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2184585
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224367
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6544.json
• report
  https://access.redhat.com/security/cve/CVE-2023-28879
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-28879
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-28879
• article
  https://artifex.com/news/critical-security-vulnerability-fixed-in-ghostscript
• article
  https://offsec.almond.consulting/ghostscript-cve-2023-28879.html
• article
  https://www.openwall.com/lists/oss-security/2023/04/12/4
• report
  https://access.redhat.com/security/cve/CVE-2023-38559
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-38559
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-38559
• article
  https://bugs.ghostscript.com/show_bug.cgi?id=706897
• article
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1