![](https://seccdn.libravatar.org/avatar/d40edd58668b3f559b219116afb5dfe0.jpg?s=120&d=mm&r=g)
On Mon, Oct 14, 2002 at 04:14:27PM +0200, Bonemach wrote:
Some of these packages I have never heard of (like cmap-adobe or CID-keyed-fonts). What are these packages and what is wrong with it? The descriptions on the site are not very detailled. Why should I update this stuff ?
You need to update the ghostscript interpreter itself, i.e. the package ghostscript-library. All the other packages are rebuilt along with the base package, and released along with it.
I know of two vulnerabilities that are related to malicious pdf or ps documents. One is in ghostscript (CAN-2002-0363). http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0363 and another is in ghostview (CAN-2001-0832). http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0832
How do I know what packages fix one of these vulnerabilities (if they indeed do so)?
Read our security advisories:-) Quoting from the most recent one, section "Pending": - ghostscript (CVE CAN-2002-0363) In ghostscript 6.50, setting the interpreter to SAFE mode was reversible. This could be exploited to subvert the accounts of users viewing malicious PostScript[tm], as well as the lp acount if the print system was enabled. SuSE has released updated RPMs for SuSE Linux 7.3 and SuSE Linux Enterprise Server 7 for PowerPC. No other SuSE platform is affected. - gv/ggv/kghostview (CVE CAN-2002-0832) The ghostview (gv) code had several buffer overflows when handling PostScript[tm] structural comments. These were also present in the GNOME and KDE PostScript viewers derived from it. SuSE has released fixed packages for these vulnerabilities. Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir@suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann