Mehrere Probleme in Ghostscript
ID: | USN-3148-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 16.10 |
Datum: | Fr, 2. Dezember 2016, 07:24 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7979
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7977 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7978 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8602 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7976 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5653 |
Applikationen: | AFPL Ghostscript |
Originalnachricht |
|
--===============6027774618759293797== Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="=-vuYE5z4I8ypjcHO3Rnw4" --=-vuYE5z4I8ypjcHO3Rnw4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 ========================================================================== Ubuntu Security Notice USN-3148-1 December 02, 2016 ghostscript vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Ghostscript could be made to crash, run programs, or disclose sensitive information if it processed a specially crafted file. Software Description: - ghostscript: PostScript and PDF interpreter Details: Tavis Ormandy discovered multiple vulnerabilities in the way that Ghostscript processes certain Postscript files. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service or possibly execute arbitrary code. (CVE-2016-7976, CVE-2016-7978, CVE-2016-7979, CVE-2016-8602) Multiple vulnerabilities were discovered in Ghostscript related to information disclosure. If a user or automated system were tricked into opening a specially crafted file, an attacker could expose sensitive data. (CVE-2013-5653, CVE-2016-7977) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.10: ghostscript 9.19~dfsg+1-0ubuntu6.2 ghostscript-x 9.19~dfsg+1-0ubuntu6.2 libgs9 9.19~dfsg+1-0ubuntu6.2 libgs9-common 9.19~dfsg+1-0ubuntu6.2 Ubuntu 16.04 LTS: ghostscript 9.18~dfsg~0-0ubuntu2.2 ghostscript-x 9.18~dfsg~0-0ubuntu2.2 libgs9 9.18~dfsg~0-0ubuntu2.2 libgs9-common 9.18~dfsg~0-0ubuntu2.2 Ubuntu 14.04 LTS: ghostscript 9.10~dfsg-0ubuntu10.5 ghostscript-x 9.10~dfsg-0ubuntu10.5 libgs9 9.10~dfsg-0ubuntu10.5 libgs9-common 9.10~dfsg-0ubuntu10.5 Ubuntu 12.04 LTS: ghostscript 9.05~dfsg-0ubuntu4.4 ghostscript-x 9.05~dfsg-0ubuntu4.4 libgs9 9.05~dfsg-0ubuntu4.4 libgs9-common 9.05~dfsg-0ubuntu4.4 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-3148-1 CVE-2013-5653, CVE-2016-7976, CVE-2016-7977, CVE-2016-7978, CVE-2016-7979, CVE-2016-8602 Package Information: https://launchpad.net/ubuntu/+source/ghostscript/9.19~dfsg+1-0ubuntu6.2 https://launchpad.net/ubuntu/+source/ghostscript/9.18~dfsg~0-0ubuntu2.2 https://launchpad.net/ubuntu/+source/ghostscript/9.10~dfsg-0ubuntu10.5 https://launchpad.net/ubuntu/+source/ghostscript/9.05~dfsg-0ubuntu4.4 |