Package "libgs9"
| Name: |
libgs9
|
Description: |
interpreter for the PostScript language and for PDF - Library
|
| Latest version: |
9.55.0~dfsg1-0ubuntu5.13 |
| Release: |
jammy (22.04) |
| Level: |
updates |
| Repository: |
main |
| Head package: |
ghostscript |
| Homepage: |
https://www.ghostscript.com/ |
Links
Download "libgs9"
Other versions of "libgs9" in Jammy
Changelog
|
ghostscript (9.55.0~dfsg1-0ubuntu5.7) jammy-security; urgency=medium
* SECURITY UPDATE: Policy bypass via improperly checked eexec seed
- debian/patches/CVE-2023-52722.patch: Prevent eexec seeds other than
Type 1 standard when SAFER mode is used in zmisc1.c.
- CVE-2023-52722
* SECURITY UPDATE: Arbitrary code execution via uniprint device
- debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device
argument strings after SAFER is activated in gdevupd.c.
- CVE-2024-29510
* SECURITY UPDATE: Path traversal and arbitrary code execution via improperly
checked path arguments
- debian/patches/CVE-2024-33869-part1.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- debian/patches/CVE-2024-33869-part2.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- CVE-2024-33869
* SECURITY UPDATE: Path traversal via improperly checked path arguments
- debian/patches/CVE-2024-33870.patch: Add a check for parent directory
prefixes when handling relative paths in gpmisc.c.
- CVE-2024-33870
* SECURITY UPDATE: Arbitrary code execution via custom driver library
- debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that
specifies the names of dynamic libraries to be loaded by the opvp/oprp
device in gdevopvp.c
- CVE-2024-33871
-- Chris Kim <email address hidden> Mon, 03 Jun 2024 21:54:57 -0700
|
| Source diff to previous version |
| CVE-2023-52722 |
An issue was discovered in Artifex Ghostscript through 10.01.0. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 stand |
|
|
ghostscript (9.55.0~dfsg1-0ubuntu5.6) jammy-security; urgency=medium
* SECURITY UPDATE: DoS via dangling pointer
- debian/patches/CVE-2023-46751.patch: fix tiffsep(1) requirement for
seekable output files in base/gdevprn.c, devices/gdevtsep.c.
- CVE-2023-46751
-- Marc Deslauriers <email address hidden> Mon, 11 Dec 2023 14:25:45 -0500
|
| Source diff to previous version |
| CVE-2023-46751 |
An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the |
|
|
ghostscript (9.55.0~dfsg1-0ubuntu5.5) jammy-security; urgency=medium
* SECURITY UPDATE: code execution via PS documents and IJS device
- debian/patches/CVE-2023-43115.patch: prevent PostScript programs
switching to the IJS device after SAFER has been activated in
devices/gdevijs.c.
- CVE-2023-43115
-- Marc Deslauriers <email address hidden> Thu, 12 Oct 2023 09:02:58 -0400
|
| Source diff to previous version |
| CVE-2023-43115 |
In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can swi |
|
|
ghostscript (9.55.0~dfsg1-0ubuntu5.4) jammy-security; urgency=medium
* SECURITY UPDATE: buffer overflow
- debian/patches/CVE-2023-38559.patch: bounds check the buffer prior to
deferencing the pointer in devn_pcx_write_rle() in base/gdevdevn.c.
- CVE-2023-38559
-- Allen Huang <email address hidden> Tue, 15 Aug 2023 11:40:49 +0100
|
| Source diff to previous version |
| CVE-2023-38559 |
A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a den |
|
|
ghostscript (9.55.0~dfsg1-0ubuntu5.3) jammy-security; urgency=medium
* SECURITY UPDATE: incorrect permission validation for pipe devices
- debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names
for permission validation in base/gpmisc.c, base/gslibctx.c.
- debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test
in base/gpmisc.c, base/gslibctx.c.
- CVE-2023-36664
-- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:49:52 -0400
|
| CVE-2023-36664 |
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). |
|
About
-
Send Feedback to @ubuntu_updates
