Mageia alert MGASA-2023-0290 (ghostscript)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2023-0290: Updated ghostscript packages fix security vulnerability
Date:
             
 
Thu, 19 Oct 2023 18:14:03 +0200
Message-ID:
             
 
<20231019161404.022149FE78@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2023-0290 - Updated ghostscript packages fix security vulnerability

Publication date: 19 Oct 2023
URL: https://advisories.mageia.org/MGASA-2023-0290.html
Type: security
Affected Mageia releases: 8, 9
CVE: CVE-2023-43115

Description:
The updated packages fix a security vulnerability:

In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead
to remote code execution via crafted PostScript documents because they
can switch to the IJS device, or change the IjsServer parameter, after
SAFER has been activated. (CVE-2023-43115)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32400
-
https://lists.fedoraproject.org/archives/list/package-ann...
- https://ubuntu.com/security/notices/USN-6433-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4...

SRPMS:
- 8/core/ghostscript-9.53.3-2.7.mga8
- 9/core/ghostscript-10.00.0-6.3.mga9