SUSE-SU-2018:4090-2

Dashboard / Vulnerabilities / SUSE-SU-2018:4090-2

SUSE-SU-2018:4090-2

Summary: Security update for ghostscript

Details: This update for ghostscript to version 9.26 fixes the following issues: Security issues fixed: - CVE-2018-19475: Fixed bypass of an intended access restriction in psi/zdevice2.c (bsc#1117327) - CVE-2018-19476: Fixed bypass of an intended access restriction in psi/zicc.c (bsc#1117313) - CVE-2018-19477: Fixed bypass of an intended access restriction in psi/zfjbig2.c (bsc#1117274) - CVE-2018-19409: Check if another device is used correctly in LockSafetyParams (bsc#1117022) - CVE-2018-18284: Fixed potential sandbox escape through 1Policy operator (bsc#1112229) - CVE-2018-18073: Fixed leaks through operator in saved execution stacks (bsc#1111480) - CVE-2018-17961: Fixed a -dSAFER sandbox escape by bypassing executeonly (bsc#1111479) - CVE-2018-17183: Fixed a potential code injection by specially crafted PostScript files (bsc#1109105) Version update to 9.26 (bsc#1117331): - Security issues have been the primary focus - Minor bug fixes and improvements - For release summary see: http://www.ghostscript.com/doc/9.26/News.htm

References: https://www.suse.com/support/update/announcement/2018/suse-su-20184090-2/, https://bugzilla.suse.com/1109105, https://bugzilla.suse.com/1111479, https://bugzilla.suse.com/1111480, https://bugzilla.suse.com/1112229, https://bugzilla.suse.com/1117022, https://bugzilla.suse.com/1117274, https://bugzilla.suse.com/1117313, https://bugzilla.suse.com/1117327, https://bugzilla.suse.com/1117331, https://www.suse.com/security/cve/CVE-2018-17183, https://www.suse.com/security/cve/CVE-2018-17961, https://www.suse.com/security/cve/CVE-2018-18073, https://www.suse.com/security/cve/CVE-2018-18284, https://www.suse.com/security/cve/CVE-2018-19409, https://www.suse.com/security/cve/CVE-2018-19475, https://www.suse.com/security/cve/CVE-2018-19476, https://www.suse.com/security/cve/CVE-2018-19477