Important CentOS ghostscript Security Update

Metadata

high
unknown
ghostscript-8.70-23.el6_9.2.i686.rpm, ghostscript-8.70-23.el6_9.2.src.rpm, ghostscript-8.70-23.el6_9.2.x86_64.rpm, ghostscript-9.07-20.el7_3.5.i686.rpm, ghostscript-9.07-20.el7_3.5.src.rpm, ghostscript-9.07-20.el7_3.5.x86_64.rpm, ghostscript-cups-9.07-20.el7_3.5.x86_64.rpm, ghostscript-devel-8.70-23.el6_9.2.i686.rpm, ghostscript-devel-8.70-23.el6_9.2.x86_64.rpm, ghostscript-devel-9.07-20.el7_3.5.i686.rpm, ghostscript-devel-9.07-20.el7_3.5.x86_64.rpm, ghostscript-doc-8.70-23.el6_9.2.i686.rpm, ghostscript-doc-8.70-23.el6_9.2.x86_64.rpm, ghostscript-doc-9.07-20.el7_3.5.noarch.rpm, ghostscript-gtk-8.70-23.el6_9.2.i686.rpm, ghostscript-gtk-8.70-23.el6_9.2.x86_64.rpm, ghostscript-gtk-9.07-20.el7_3.5.x86_64.rpm
rhn.redhat.com, lists.centos.org, lists.centos.org
2017-05-15
2017-07-27 19:13
2017-07-27 18:03
2017-07-27 00:03
2017-07-26 23:03
2017-07-26 22:04
2017-05-16 09:03

Description


An update for ghostscript is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

* It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a specially crafted PostScript document could execute code in the context of the ghostscript process, bypassing the -dSAFER protection. (CVE-2017-8291)
Please see https://www.redhat.com/footer/terms-of-use.html

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Release Package Patched in
6 ghostscript ghostscript-8.70-23.el6_9.2.x86_64.rpm
ghostscript ghostscript-8.70-23.el6_9.2.i686.rpm
ghostscript ghostscript-8.70-23.el6_9.2.src.rpm
ghostscript-devel ghostscript-devel-8.70-23.el6_9.2.x86_64.rpm
ghostscript-devel ghostscript-devel-8.70-23.el6_9.2.i686.rpm
ghostscript-doc ghostscript-doc-8.70-23.el6_9.2.i686.rpm
ghostscript-doc ghostscript-doc-8.70-23.el6_9.2.x86_64.rpm
ghostscript-gtk ghostscript-gtk-8.70-23.el6_9.2.i686.rpm
ghostscript-gtk ghostscript-gtk-8.70-23.el6_9.2.x86_64.rpm
7 ghostscript ghostscript-9.07-20.el7_3.5.i686.rpm
ghostscript ghostscript-9.07-20.el7_3.5.x86_64.rpm
ghostscript ghostscript-9.07-20.el7_3.5.src.rpm
ghostscript-cups ghostscript-cups-9.07-20.el7_3.5.x86_64.rpm
ghostscript-devel ghostscript-devel-9.07-20.el7_3.5.x86_64.rpm
ghostscript-devel ghostscript-devel-9.07-20.el7_3.5.i686.rpm
ghostscript-doc ghostscript-doc-9.07-20.el7_3.5.noarch.rpm
ghostscript-gtk ghostscript-gtk-9.07-20.el7_3.5.x86_64.rpm