[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

RHSA-2012:0095-01 -- Redhat ghostscript

ID: oval:org.secpod.oval:def:500714Date: (C)2012-03-07   (M)2023-12-26
Class: PATCHFamily: unix




Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures and an interpreter for Portable Document Format files. An integer overflow flaw was found in Ghostscript"s TrueType bytecode interpreter. An attacker could create a specially-crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. It was found that Ghostscript always tried to read Ghostscript system initialization files from the current working directory before checking other directories, even if a search path that did not contain the current working directory was specified with the "-I" option, or the "-P-" option was used . If a user ran Ghostscript in an attacker-controlled directory containing a system initialization file, it could cause Ghostscript to execute arbitrary PostScript code. Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the "-P-" option in an attacker-controlled directory containing a specially-crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default. Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the "-P" option . A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially-crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. Users of Ghostscript are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Platform:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 5
Product:
ghostscript
Reference:
RHSA-2012:0095-01
CVE-2009-3743
CVE-2010-2055
CVE-2010-4054
CVE-2010-4820
CVE    4
CVE-2009-3743
CVE-2010-2055
CVE-2010-4820
CVE-2010-4054
...
CPE    3
cpe:/o:redhat:enterprise_linux:5
cpe:/o:redhat:enterprise_linux:6
cpe:/a:ghostscript:ghostscript

© SecPod Technologies