[SECURITY] [DLA 1363-1] ghostscript security update

2018-04-2518:26:30

lists.debian.org

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.015 Low

EPSS

Percentile

87.0%

JSON

Package : ghostscript
Version : 9.05~dfsg-6.3+deb7u8
CVE ID : CVE-2018-10194
Debian Bug : 896069

It was discovered that the set_text_distance function in
base/gdevpdts.c in the pdfwrite component in Ghostscript does not
prevent overflows in text-positioning calculation, which allows remote
attackers to cause a denial of service (application crash) or possibly
have unspecified other impact via a crafted PDF document.

For Debian 7 "Wheezy", these problems have been fixed in version
9.05~dfsg-6.3+deb7u8.

We recommend that you upgrade your ghostscript packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9armhflibgs-dev< 9.20~dfsg-3.2+deb9u2libgs-dev_9.20~dfsg-3.2+deb9u2_armhf.deb
Debian8mipsellibgs9< 9.06~dfsg-2+deb8u7libgs9_9.06~dfsg-2+deb8u7_mipsel.deb
Debian8i386ghostscript-dbg< 9.06~dfsg-2+deb8u7ghostscript-dbg_9.06~dfsg-2+deb8u7_i386.deb
Debian8alllibgs9-common< 9.06~dfsg-2+deb8u7libgs9-common_9.06~dfsg-2+deb8u7_all.deb
Debian9ppc64elghostscript-dbg< 9.20~dfsg-3.2+deb9u2ghostscript-dbg_9.20~dfsg-3.2+deb9u2_ppc64el.deb
Debian8mipselghostscript< 9.06~dfsg-2+deb8u7ghostscript_9.06~dfsg-2+deb8u7_mipsel.deb
Debian7i386libgs9< 9.05~dfsg-6.3+deb7u8libgs9_9.05~dfsg-6.3+deb7u8_i386.deb
Debian7i386ghostscript-x< 9.05~dfsg-6.3+deb7u8ghostscript-x_9.05~dfsg-6.3+deb7u8_i386.deb
Debian8mipslibgs-dev< 9.06~dfsg-2+deb8u7libgs-dev_9.06~dfsg-2+deb8u7_mips.deb
Debian9mipselghostscript-x< 9.20~dfsg-3.2+deb9u2ghostscript-x_9.20~dfsg-3.2+deb9u2_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	armhf	libgs-dev	< 9.20~dfsg-3.2+deb9u2	libgs-dev_9.20~dfsg-3.2+deb9u2_armhf.deb
Debian	8	mipsel	libgs9	< 9.06~dfsg-2+deb8u7	libgs9_9.06~dfsg-2+deb8u7_mipsel.deb
Debian	8	i386	ghostscript-dbg	< 9.06~dfsg-2+deb8u7	ghostscript-dbg_9.06~dfsg-2+deb8u7_i386.deb
Debian	8	all	libgs9-common	< 9.06~dfsg-2+deb8u7	libgs9-common_9.06~dfsg-2+deb8u7_all.deb
Debian	9	ppc64el	ghostscript-dbg	< 9.20~dfsg-3.2+deb9u2	ghostscript-dbg_9.20~dfsg-3.2+deb9u2_ppc64el.deb
Debian	8	mipsel	ghostscript	< 9.06~dfsg-2+deb8u7	ghostscript_9.06~dfsg-2+deb8u7_mipsel.deb
Debian	7	i386	libgs9	< 9.05~dfsg-6.3+deb7u8	libgs9_9.05~dfsg-6.3+deb7u8_i386.deb
Debian	7	i386	ghostscript-x	< 9.05~dfsg-6.3+deb7u8	ghostscript-x_9.05~dfsg-6.3+deb7u8_i386.deb
Debian	8	mips	libgs-dev	< 9.06~dfsg-2+deb8u7	libgs-dev_9.06~dfsg-2+deb8u7_mips.deb
Debian	9	mipsel	ghostscript-x	< 9.20~dfsg-3.2+deb9u2	ghostscript-x_9.20~dfsg-3.2+deb9u2_mipsel.deb