Ubuntu alert USN-6897-1 (ghostscript)

From:
             
 
Marc Deslauriers <marc.deslauriers@canonical.com>
To:
             
 
"ubuntu-security-announce@lists.ubuntu.com" <ubuntu-security-announce@lists.ubuntu.com>
Subject:
             
 
[USN-6897-1] Ghostscript vulnerabilities
Date:
             
 
Mon, 15 Jul 2024 10:18:52 -0400
Message-ID:
             
 
<50a0d0a8-7c04-455f-9315-87655ea6b61e@canonical.com>
==========================================================================
Ubuntu Security Notice USN-6897-1
July 15, 2024

ghostscript vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Ghostscript.

Software Description:
- ghostscript: PostScript and PDF interpreter

Details:

It was discovered that Ghostscript incorrectly handled certain long PDF
filter names. An attacker could possibly use this issue to cause
Ghostscript to crash, resulting in a denial of service. This issue only
affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-29506)

It was discovered that Ghostscript incorrectly handled certain API
parameters. An attacker could possibly use this issue to cause Ghostscript
to crash, resulting in a denial of service. This issue only affected Ubuntu
24.04 LTS. (CVE-2024-29507)

It was discovered that Ghostscript incorrectly handled certain BaseFont
names. An attacker could use this issue to cause Ghostscript to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2024-29508)

It was discovered that Ghostscript incorrectly handled certain PDF
passwords that contained NULL bytes. An attacker could use this issue to
cause Ghostscript to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and
Ubuntu 24.04 LTS. (CVE-2024-29509)

It was discovered that Ghostscript incorrectly handled certain certain file
paths when doing OCR. An attacker could use this issue to read arbitrary
files and write error messages to arbitrary files. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-29511)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   ghostscript                     10.02.1~dfsg1-0ubuntu7.3
   libgs10                         10.02.1~dfsg1-0ubuntu7.3

Ubuntu 22.04 LTS
   ghostscript                     9.55.0~dfsg1-0ubuntu5.9
   libgs9                          9.55.0~dfsg1-0ubuntu5.9

Ubuntu 20.04 LTS
   ghostscript                     9.50~dfsg-5ubuntu4.13
   libgs9                          9.50~dfsg-5ubuntu4.13

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6897-1
   CVE-2024-29506, CVE-2024-29507, CVE-2024-29508, CVE-2024-29509,
   CVE-2024-29511

Package Information:
   https://launchpad.net/ubuntu/+source/ghostscript/10.02.1~...
   https://launchpad.net/ubuntu/+source/ghostscript/9.55.0~d...
   https://launchpad.net/ubuntu/+source/ghostscript/9.50~dfs...



Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmaVL80ACgkQZWnYVadE
vpPYuhAAu3lrm3KWolgV6NzB4BtAvVIXVHdEOjRetzRv+3TDdeJMIgjNRu5RtW83
AEyeUDDQFzEoBKKrQtx9xtY63B/A3V3g6TibBzbf8CQ0FMYwlf0NUGbs/+/G8NGB
wOfaxDGdcALLLGBxZZW30C0322gn3J28V/UPqKGtQv876uITR52umrFJ8vTASeqB
ZjUU49O8uvkPHcc7XddVA5rtd36kBqm1SU3C9bYiPQrUioC0PMWnyR23+i516BPE
ek56RhrGRPCXmav+6sTRt+Z5ACCLxjFL0ZHDgXZQX2t6woI8mpZvxyP4HcOfrz7h
C4pPFu7gJ3H+EV/nfUWvW9yQTYOz+Z9pDAk2+561qq3iCKvk7ztSkUNzMdB9SBXI
FZPFZsbdXsZfGzeV94mGrERPCXo6qBg72JrlmFLZA9p4GValsFdyxWi1a57xArmU
J7Ted0qk3YLr0qfxDwlOfc1HenZG7+kDHHe2Il8zMlESD0Rhm8vUkML/rrOBZ/GR
XnkqxBqtJVxteh272lV6R5NPGNzU58kILQE0X7sZRs8VechIH8dQvmJ90gAKVGO1
/74Qh0I7IHJ82jR3+l8gYKOEICawNZkxu3OeFal2DfSsLdfwv0T4uk+lpUuAFwbo
ndaYmXa0FQAjGM68oCpYS1BLLq30b5KLOX1cTFUXmWPkiN6g3DM=
=WY13
-----END PGP SIGNATURE-----


Attachment: None (type=text/plain)