Ubuntu 17.04 USN-3272-2 Moderate Ghostscript Regression Fix

ubuntu

May 16, 2017

USN-3272-1 introduced a regression in Ghostscript.

Summary

USN-3272-1 introduced a regression in Ghostscript.

Software Description:

- ghostscript: PostScript and PDF interpreter

Details:

USN-3272-1 fixed vulnerabilities in Ghostscript. This change introduced

a regression when the DELAYBIND feature is used with the eqproc

command. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that Ghostscript improperly handled parameters to

the rsdparams and eqproc commands. An attacker could use these to

craft a malicious document that could disable -dSAFER protections,

thereby allowing the execution of arbitrary code, or cause a denial

of service (application crash). (CVE-2017-8291)

Kamil Frankowicz discovered a use-after-free vulnerability in the

color management module of Ghostscript. An attacker could use this

to cause a denial of service (application crash). (CVE-2016-10217)

Kamil Frankowicz discovered a divide-by-zero error in the scan

conversion code in Ghostscript....

Read the Full Advisory

Topics Covered

security advisory moderate code execution ghostscript application crash ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  ghostscript                     9.19~dfsg+1-0ubuntu7.4
  ghostscript-x                   9.19~dfsg+1-0ubuntu7.4
  libgs9                          9.19~dfsg+1-0ubuntu7.4
  libgs9-common                   9.19~dfsg+1-0ubuntu7.4

Ubuntu 16.10:
  ghostscript                     9.19~dfsg+1-0ubuntu6.6
  ghostscript-x                   9.19~dfsg+1-0ubuntu6.6
  libgs9                          9.19~dfsg+1-0ubuntu6.6
  libgs9-common                   9.19~dfsg+1-0ubuntu6.6

Ubuntu 16.04 LTS:
  ghostscript                     9.18~dfsg~0-0ubuntu2.6
  ghostscript-x                   9.18~dfsg~0-0ubuntu2.6
  libgs9                          9.18~dfsg~0-0ubuntu2.6
  libgs9-common                   9.18~dfsg~0-0ubuntu2.6

Ubuntu 14.04 LTS:
  ghostscript                     9.10~dfsg-0ubuntu10.9
  ghostscript-x                   9.10~dfsg-0ubuntu10.9
  libgs9                          9.10~dfsg-0ubuntu10.9
  libgs9-common                   9.10~dfsg-0ubuntu10.9

In general, a standard system update will make all the necessary changes.