Debian Security Advisory: Ghostscript Symlink Attack - Resolved

Package : gs
Problem type : symlink attack
Debian-specific: no

ghostscript uses temporary files to do some of its work. Unfortunately
the method used to create those files wasn't secure: mktemp was used
to create a name for a temporary file, but the file was not opened
safely. A second problem is that during build the LD_RUN_PATH environment
variable was set to the empty string, which causes the dynamic linker
to look in the current directory for shared libraries.

Bot of these problems have been fixed in version 5.10-10.1.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.


Debian GNU/Linux 2.2 alias potato

Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

Source archives:


MD5 checksum: d503b3f8f9c58407286a5c078480f435


MD5 checksum: aeb2e42819a6a0db648c9549062db87a


MD5 checksum: b8dbc2595c06305f452a9c38bd0effef

Alpha architecture:


MD5 checksum: 72b77c03a2718fe983e177719242446f

...