openSUSE Security Update: Security update for ghostscript ______________________________________________________________________________
Announcement ID: openSUSE-SU-2019:2223-1 Rating: important References: #1129180 #1129186 #1134156 #1140359 #1146882 #1146884 Cross-References: CVE-2019-12973 CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 CVE-2019-3835 CVE-2019-3839 Affected Products: openSUSE Leap 15.1 ______________________________________________________________________________
An update that fixes 7 vulnerabilities is now available.
Description:
This update for ghostscript fixes the following issues:
Security issues fixed:
- CVE-2019-3835: Fixed an unauthorized file system access caused by an available superexec operator. (bsc#1129180) - CVE-2019-3839: Fixed an unauthorized file system access caused by available privileged operators. (bsc#1134156) - CVE-2019-12973: Fixed a denial-of-service vulnerability in the OpenJPEG function opj_t1_encode_cblks. (bsc#1140359) - CVE-2019-14811: Fixed a safer mode bypass by .forceput exposure in .pdf_hook_DSC_Creator. (bsc#1146882) - CVE-2019-14812: Fixed a safer mode bypass by .forceput exposure in setuserparams. (bsc#1146882) - CVE-2019-14813: Fixed a safer mode bypass by .forceput exposure in setsystemparams. (bsc#1146882) - CVE-2019-14817: Fixed a safer mode bypass by .forceput exposure in .pdfexectoken and other procedures. (bsc#1146884)
This update was imported from the SUSE:SLE-15:Update update project.
Patch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.1:
zypper in -t patch openSUSE-2019-2223=1
Package List:
- openSUSE Leap 15.1 (i586 x86_64):
ghostscript-9.27-lp151.3.6.1 ghostscript-debuginfo-9.27-lp151.3.6.1 ghostscript-debugsource-9.27-lp151.3.6.1 ghostscript-devel-9.27-lp151.3.6.1 ghostscript-mini-9.27-lp151.3.6.1 ghostscript-mini-debuginfo-9.27-lp151.3.6.1 ghostscript-mini-debugsource-9.27-lp151.3.6.1 ghostscript-mini-devel-9.27-lp151.3.6.1 ghostscript-x11-9.27-lp151.3.6.1 ghostscript-x11-debuginfo-9.27-lp151.3.6.1
References:
https://www.suse.com/security/cve/CVE-2019-12973.html https://www.suse.com/security/cve/CVE-2019-14811.html https://www.suse.com/security/cve/CVE-2019-14812.html https://www.suse.com/security/cve/CVE-2019-14813.html https://www.suse.com/security/cve/CVE-2019-14817.html https://www.suse.com/security/cve/CVE-2019-3835.html https://www.suse.com/security/cve/CVE-2019-3839.html https://bugzilla.suse.com/1129180 https://bugzilla.suse.com/1129186 https://bugzilla.suse.com/1134156 https://bugzilla.suse.com/1140359 https://bugzilla.suse.com/1146882 https://bugzilla.suse.com/1146884