Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 514
Alerts This Week
Warning Icon 1 514

Ubuntu 10.10 LTS: USN-1317-1 Moderate Ghostscript DoS Threat

ubuntu
Calendar Grey January 4, 2012
Scroller Ubuntu
Elevate your Ubuntu setup with recent upgrades to address Ghostscript weaknesses that could pave the way for possible security breaches.
Ghostscript could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

Ghostscript could be made to crash or run programs as your login if it

opened a specially crafted file.

Software Description:

- ghostscript: The GPL Ghostscript PostScript/PDF interpreter

Details:

It was discovered that Ghostscript did not correctly handle memory

allocation when parsing certain malformed JPEG-2000 images. If a user or

automated system were tricked into opening a specially crafted image, an

attacker could cause a denial of service and possibly execute arbitrary

code with user privileges. (CVE-2008-3520)

It was discovered that Ghostscript did not correctly handle certain

formatting operations when parsing JPEG-2000 images. If a user or automated

system were tricked into opening a specially crafted image, an attacker

could cause a denial of service and possibly execute arbitrary code with

user privileges. (CVE-2008-3522)

It was discovered that Ghostscript incorrectly handled certain malformed

TrueType fonts. If a user or automated system wer...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory moderate denial of service ghostscript ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.10:
  libgs8                          8.71.dfsg.2-0ubuntu7.1

Ubuntu 10.04 LTS:
  libgs8                          8.71.dfsg.1-0ubuntu5.4

Ubuntu 8.04 LTS:
  libgs8                          8.61.dfsg.1-1ubuntu3.4

In general, a standard system update will make all the necessary changes.

References

CVE-2008-3520, CVE-2008-3522, CVE-2009-3743, CVE-2010-4054,

CVE-2011-4516, CVE-2011-4517

Severity
important
Lowest
Low
Medium
High
Critical

January 04, 2012

Topics%20covered

Topics Covered

security advisory moderate denial of service ghostscript ubuntu

Package Information

https://launchpad.net/ubuntu/+source/ghostscript/8.71.dfsg.2-0ubuntu7.1
https://launchpad.net/ubuntu/+source/ghostscript/8.71.dfsg.1-0ubuntu5.4
https://launchpad.net/ubuntu/+source/ghostscript/8.61.dfsg.1-1ubuntu3.4

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.