Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 533
Alerts This Week
Warning Icon 1 533

Ubuntu 10.04 LTS: USN-2434-2 Critical Ghostscript Crash Exploit

ubuntu
Calendar Grey December 8, 2014
Dist Ubuntu Esm H88
Ghostscript may lead to system instability or execute unintended commands while processing specially designed files. Critical patch for Ubuntu 10.04 LTS.
Ghostscript could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

Ghostscript could be made to crash or run programs as your login if it

opened a specially crafted file.

Software Description:

- ghostscript: PostScript and PDF interpreter

Details:

USN-2434-1 fixed a vulnerability in JasPer. This update provides the

corresponding fix for the JasPer library embedded in the Ghostscript

package.

Original advisory details:

Jose Duart discovered that JasPer incorrectly handled certain malformed

JPEG-2000 image files. If a user were tricked into opening a specially

crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash

or possibly execute arbitrary code with user privileges.

Topics%20covered

Topics Covered

security advisory critical remote code execution ghostscript Ubuntu system update crash issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.04 LTS:
  libgs8                          8.71.dfsg.1-0ubuntu5.6

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2434-2

https://ubuntu.com/security/notices/USN-2434-1

CVE-2014-9029

Severity
critical
Lowest
Low
Medium
High
Critical

December 08, 2014

Topics%20covered

Topics Covered

security advisory critical remote code execution ghostscript Ubuntu system update crash issue

Package Information

https://launchpad.net/ubuntu/+source/ghostscript/8.71.dfsg.1-0ubuntu5.6

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.