USN-3272-2: Ghostscript regression<\/p>\n
16th May, 2017<\/em><\/p>\n A security issue affects these releases of Ubuntu and its USN-3272-1 introduced a regression in Ghostscript.\n<\/p>\n USN-3272-1 fixed vulnerabilities in Ghostscript. This change introduced We apologize for the inconvenience.<\/p>\n Original advisory details:<\/p>\n It was discovered that Ghostscript improperly handled parameters to Kamil Frankowicz discovered a use-after-free vulnerability in the Kamil Frankowicz discovered a divide-by-zero error in the scan Kamil Frankowicz discovered multiple NULL pointer dereference errors in The problem can be corrected by updating your system to the following To update your system, please follow these instructions: In general, a standard system update will make all the necessary changes.<\/p>\n LP: 1687614<\/a><\/p>\n Source: USN-3272-2: Ghostscript regression<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" USN-3272-2: Ghostscript regression Ubuntu Security Notice USN-3272-2 16th May, 2017 ghostscript regression A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary USN-3272-1 introduced a regression in Ghostscript. Software description ghostscript – PostScript and PDF interpreter Details USN-3272-1 fixed vulnerabilities in Ghostscript. This change introduceda regression when the DELAYBIND feature is used with the eqproccommand. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby allowing the execution of arbitrary code, or cause a denial of service (application crash). (CVE-2017-8291) Kamil Frankowicz discovered a use-after-free vulnerability in the color management module of Ghostscript. An attacker [ more… ]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[586],"tags":[587],"class_list":["post-16152","post","type-post","status-publish","format-standard","hentry","category-ubuntu-usn","tag-ubuntu-usn"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/16152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/comments?post=16152"}],"version-history":[{"count":1,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/16152\/revisions"}],"predecessor-version":[{"id":16153,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/16152\/revisions\/16153"}],"wp:attachment":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/media?parent=16152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/categories?post=16152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/tags?post=16152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}ghostscript regression<\/h3>\n
\n derivatives:<\/p>\n\n
Summary<\/h3>\n
Software description<\/h3>\n
\n
\n – PostScript and PDF interpreter<\/p>\n<\/li>\n<\/ul>\nDetails<\/h3>\n
a regression when the DELAYBIND feature is used with the eqproc
command. This update fixes the problem.<\/p>\n
the rsdparams and eqproc commands. An attacker could use these to
craft a malicious document that could disable -dSAFER protections,
thereby allowing the execution of arbitrary code, or cause a denial
of service (application crash). (CVE-2017-8291<\/a>)<\/p>\n
color management module of Ghostscript. An attacker could use this
to cause a denial of service (application crash). (CVE-2016-10217<\/a>)<\/p>\n
conversion code in Ghostscript. An attacker could use this to cause
a denial of service (application crash). (CVE-2016-10219<\/a>)<\/p>\n
Ghostscript. An attacker could use these to cause a denial of service
(application crash). (CVE-2016-10220<\/a>, CVE-2017-5951<\/a>, CVE-2017-7207<\/a>)<\/p>\nUpdate instructions<\/h3>\n
\npackage version:<\/p>\n\n
\n
\n 9.19~dfsg+1-0ubuntu7.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu7.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu7.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu7.4<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu6.6<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu6.6<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu6.6<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.19~dfsg+1-0ubuntu6.6<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.18~dfsg~0-0ubuntu2.6<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.18~dfsg~0-0ubuntu2.6<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.18~dfsg~0-0ubuntu2.6<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.18~dfsg~0-0ubuntu2.6<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.10~dfsg-0ubuntu10.9<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.10~dfsg-0ubuntu10.9<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.10~dfsg-0ubuntu10.9<\/a>
\n <\/span>\n <\/dd>\n
\n
\n 9.10~dfsg-0ubuntu10.9<\/a>
\n <\/span>\n <\/dd>\n<\/dl>\n
\nhttps:\/\/wiki.ubuntu.com\/Security\/Upgrades<\/a>.\n<\/p>\nReferences<\/h3>\n