USN-3272-1: Ghostscript vulnerabilities<\/p>\n
28th April, 2017<\/em><\/p>\n A security issue affects these releases of Ubuntu and its Several security issues were fixed in Ghostscript.\n<\/p>\n It was discovered that Ghostscript improperly handled parameters to Kamil Frankowicz discovered a use-after-free vulnerability in the Kamil Frankowicz discovered a divide-by-zero error in the scan Kamil Frankowicz discovered multiple NULL pointer dereference errors in The problem can be corrected by updating your system to the following To update your system, please follow these instructions: In general, a standard system update will make all the necessary changes.<\/p>\n CVE-2016-10217<\/a>, <\/p>\n CVE-2016-10219<\/a>, <\/p>\n CVE-2016-10220<\/a>, <\/p>\n CVE-2017-5951<\/a>, <\/p>\n CVE-2017-7207<\/a>, <\/p>\n CVE-2017-8291<\/a><\/p>\n Source: USN-3272-1: Ghostscript vulnerabilities<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" USN-3272-1: Ghostscript vulnerabilities Ubuntu Security Notice USN-3272-1 28th April, 2017 ghostscript vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary Several security issues were fixed in Ghostscript. Software description ghostscript – PostScript and PDF interpreter Details It was discovered that Ghostscript improperly handled parameters tothe rsdparams and eqproc commands. An attacker could use these tocraft a malicious document that could disable -dSAFER protections,thereby allowing the execution of arbitrary code, or cause a denialof service (application crash). (CVE-2017-8291) Kamil Frankowicz discovered a use-after-free vulnerability in thecolor management module of Ghostscript. An attacker could use thisto cause a denial of service (application crash). (CVE-2016-10217) Kamil Frankowicz discovered a divide-by-zero error in the scanconversion code in Ghostscript. An attacker could use this to causea denial of [ more… ]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[586],"tags":[587],"class_list":["post-15849","post","type-post","status-publish","format-standard","hentry","category-ubuntu-usn","tag-ubuntu-usn"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/15849","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/comments?post=15849"}],"version-history":[{"count":1,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/15849\/revisions"}],"predecessor-version":[{"id":15850,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/15849\/revisions\/15850"}],"wp:attachment":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/media?parent=15849"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/categories?post=15849"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/tags?post=15849"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}ghostscript vulnerabilities<\/h3>\n
\n derivatives:<\/p>\n\n
Summary<\/h3>\n
Software description<\/h3>\n
\n
\n – PostScript and PDF interpreter<\/p>\n<\/li>\n<\/ul>\nDetails<\/h3>\n
the rsdparams and eqproc commands. An attacker could use these to
craft a malicious document that could disable -dSAFER protections,
thereby allowing the execution of arbitrary code, or cause a denial
of service (application crash). (CVE-2017-8291<\/a>)<\/p>\n
color management module of Ghostscript. An attacker could use this
to cause a denial of service (application crash). (CVE-2016-10217<\/a>)<\/p>\n
conversion code in Ghostscript. An attacker could use this to cause
a denial of service (application crash). (CVE-2016-10219<\/a>)<\/p>\n
Ghostscript. An attacker could use these to cause a denial of service
(application crash). (CVE-2016-10220<\/a>, CVE-2017-5951<\/a>, CVE-2017-7207<\/a>)<\/p>\nUpdate instructions<\/h3>\n
\npackage version:<\/p>\n\n
\n
\n 9.19~dfsg+1-0ubuntu7.2<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu7.2<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu7.2<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu7.2<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu6.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu6.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu6.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu6.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.18~dfsg~0-0ubuntu2.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.18~dfsg~0-0ubuntu2.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.18~dfsg~0-0ubuntu2.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.18~dfsg~0-0ubuntu2.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.10~dfsg-0ubuntu10.7<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.10~dfsg-0ubuntu10.7<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.10~dfsg-0ubuntu10.7<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.10~dfsg-0ubuntu10.7<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.05~dfsg-0ubuntu4.5<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.05~dfsg-0ubuntu4.5<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.05~dfsg-0ubuntu4.5<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.05~dfsg-0ubuntu4.5<\/a>
\n <\/span>\n <\/dd>\n<\/dl>\n
\nhttps:\/\/wiki.ubuntu.com\/Security\/Upgrades<\/a>.\n<\/p>\nReferences<\/h3>\n