This update for ghostscript to version 9.25 fixes the following issues: These security issues were fixed: - CVE-2018-17183: Remote attackers were be able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code - CVE-2018-15909: Prevent type confusion using the .shfill operator that could have been used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code . - CVE-2018-15908: Prevent attackers that are able to supply malicious PostScript files to bypass .tempfile restrictions and write files . - CVE-2018-15910: Prevent a type confusion in the LockDistillerParams parameter that could have been used to crash the interpreter or execute code . - CVE-2018-15911: Prevent use uninitialized memory access in the aesdecode operator that could have been used to crash the interpreter or potentially execute code . - CVE-2018-16513: Prevent a type confusion in the setcolor function that could have been used to crash the interpreter or possibly have unspecified other impact . - CVE-2018-16509: Incorrect quot;restoration of privilegequot; checking during handling of /invalidaccess exceptions could be have been used by attackers able to supply crafted PostScript to execute code using the quot;pipequot; instruction . - CVE-2018-16510: Incorrect exec stack handling in the quot;CSquot; and quot;SCquot; PDF primitives could have been used by remote attackers able to supply crafted PDFs to crash the interpreter or possibly have unspecified other impact . - CVE-2018-16542: Prevent attackers able to supply crafted PostScript files from using insufficient interpreter stack-size checking during error handling to crash the interpreter . - CVE-2018-16541: Prevent attackers able to supply crafted PostScript files from using incorrect free logic in pagedevice replacement to crash the interpreter . - CVE-2018-16540: Prevent use-after-free in copydevice handling that could have been used to crash the interpreter or possibly have unspecified other impact . - CVE-2018-16539: Prevent attackers able to supply crafted PostScript files from using incorrect access checking in temp file handling to disclose contents of files on the system otherwise not readable . - CVE-2018-16543: gssetresolution and gsgetresolution allowed attackers to have an unspecified impact . - CVE-2018-16511: A type confusion in quot;ztypequot; could have been used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact . - CVE-2018-16585: The .setdistillerkeys PostScript command was accepted even though it is not intended for use during document processing . This lead to memory corruption, allowing remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact . - CVE-2018-16802: Incorrect quot;restoration of privilegequot; checking when running out of stack during exception handling could have been used by attackers able to supply crafted PostScript to execute code using the quot;pipequot; instruction. This is due to an incomplete fix for CVE-2018-16509 . These non-security issues were fixed: * Fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions