USN-6835-1

See a problem?
Source
https://ubuntu.com/security/notices/USN-6835-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6835-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-6835-1
Related
Published
2024-06-17T17:35:07.703578Z
Modified
2024-06-17T17:35:07.703578Z
Summary
ghostscript vulnerabilities
Details

It was discovered that Ghostscript did not properly restrict eexec seeds to those specified by the Type 1 Font Format standard when SAFER mode is used. An attacker could use this issue to bypass SAFER restrictions and cause unspecified impact. (CVE-2023-52722) This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10.

Thomas Rinsma discovered that Ghostscript did not prevent changes to uniprint device argument strings after SAFER is activated, resulting in a format-string vulnerability. An attacker could possibly use this to execute arbitrary code. (CVE-2024-29510)

Zdenek Hutyra discovered that Ghostscript did not properly perform path reduction when validating paths. An attacker could use this to access file locations outside of those allowed by SAFER policy and possibly execute arbitrary code. (CVE-2024-33869)

Zdenek Hutyra discovered that Ghostscript did not properly check arguments when reducing paths. An attacker could use this to access file locations outside of those allowed by SAFER policy. (CVE-2024-33870)

Zdenek Hutyra discovered that the "Driver" parameter for Ghostscript's "opvp"/"oprp" device allowed specifying the name of an arbitrary dynamic library to load. An attacker could use this to execute arbitrary code. (CVE-2024-33871)

References

Affected packages

Ubuntu:20.04:LTS / ghostscript

Package

Name
ghostscript
Purl
pkg:deb/ubuntu/ghostscript@9.50~dfsg-5ubuntu4.12?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.50~dfsg-5ubuntu4.12

Affected versions

9.*

9.27~dfsg+0-0ubuntu3
9.27~dfsg+0-0ubuntu4
9.50~dfsg-5ubuntu1
9.50~dfsg-5ubuntu2
9.50~dfsg-5ubuntu3
9.50~dfsg-5ubuntu4
9.50~dfsg-5ubuntu4.1
9.50~dfsg-5ubuntu4.2
9.50~dfsg-5ubuntu4.3
9.50~dfsg-5ubuntu4.4
9.50~dfsg-5ubuntu4.5
9.50~dfsg-5ubuntu4.6
9.50~dfsg-5ubuntu4.7
9.50~dfsg-5ubuntu4.8
9.50~dfsg-5ubuntu4.9
9.50~dfsg-5ubuntu4.10
9.50~dfsg-5ubuntu4.11

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "ghostscript-dbg": "9.50~dfsg-5ubuntu4.12",
            "ghostscript-doc": "9.50~dfsg-5ubuntu4.12",
            "ghostscript-x": "9.50~dfsg-5ubuntu4.12",
            "libgs9": "9.50~dfsg-5ubuntu4.12",
            "libgs-dev": "9.50~dfsg-5ubuntu4.12",
            "libgs9-common": "9.50~dfsg-5ubuntu4.12",
            "ghostscript": "9.50~dfsg-5ubuntu4.12"
        }
    ]
}

Ubuntu:22.04:LTS / ghostscript

Package

Name
ghostscript
Purl
pkg:deb/ubuntu/ghostscript@9.55.0~dfsg1-0ubuntu5.7?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.55.0~dfsg1-0ubuntu5.7

Affected versions

9.*

9.54.0~dfsg1-0ubuntu2
9.55.0~dfsg1-0ubuntu4
9.55.0~dfsg1-0ubuntu5
9.55.0~dfsg1-0ubuntu5.1
9.55.0~dfsg1-0ubuntu5.2
9.55.0~dfsg1-0ubuntu5.3
9.55.0~dfsg1-0ubuntu5.4
9.55.0~dfsg1-0ubuntu5.5
9.55.0~dfsg1-0ubuntu5.6

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "libgs9-dbgsym": "9.55.0~dfsg1-0ubuntu5.7",
            "ghostscript-dbgsym": "9.55.0~dfsg1-0ubuntu5.7",
            "ghostscript-doc": "9.55.0~dfsg1-0ubuntu5.7",
            "ghostscript-x": "9.55.0~dfsg1-0ubuntu5.7",
            "libgs9": "9.55.0~dfsg1-0ubuntu5.7",
            "ghostscript-x-dbgsym": "9.55.0~dfsg1-0ubuntu5.7",
            "libgs9-common": "9.55.0~dfsg1-0ubuntu5.7",
            "libgs-dev": "9.55.0~dfsg1-0ubuntu5.7",
            "ghostscript": "9.55.0~dfsg1-0ubuntu5.7"
        }
    ]
}

Ubuntu:23.10 / ghostscript

Package

Name
ghostscript
Purl
pkg:deb/ubuntu/ghostscript@10.01.2~dfsg1-0ubuntu2.3?arch=src?distro=mantic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.01.2~dfsg1-0ubuntu2.3

Affected versions

10.*

10.0.0~dfsg1-0ubuntu1
10.0.0~dfsg1-0ubuntu1.1
10.0.0~dfsg1-0ubuntu2
10.01.2~dfsg1-0ubuntu1
10.01.2~dfsg1-0ubuntu2
10.01.2~dfsg1-0ubuntu2.1
10.01.2~dfsg1-0ubuntu2.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "ghostscript-dbgsym": "10.01.2~dfsg1-0ubuntu2.3",
            "libgs-common": "10.01.2~dfsg1-0ubuntu2.3",
            "ghostscript-doc": "10.01.2~dfsg1-0ubuntu2.3",
            "ghostscript-x": "10.01.2~dfsg1-0ubuntu2.3",
            "libgs-dev": "10.01.2~dfsg1-0ubuntu2.3",
            "libgs9-common": "10.01.2~dfsg1-0ubuntu2.3",
            "ghostscript": "10.01.2~dfsg1-0ubuntu2.3",
            "libgs10-dbgsym": "10.01.2~dfsg1-0ubuntu2.3",
            "libgs10": "10.01.2~dfsg1-0ubuntu2.3",
            "libgs10-common": "10.01.2~dfsg1-0ubuntu2.3"
        }
    ]
}

Ubuntu:24.04:LTS / ghostscript

Package

Name
ghostscript
Purl
pkg:deb/ubuntu/ghostscript@10.02.1~dfsg1-0ubuntu7.1?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.02.1~dfsg1-0ubuntu7.1

Affected versions

10.*

10.01.2~dfsg1-0ubuntu2
10.01.2~dfsg1-0ubuntu2.1
10.02.1~dfsg1-0ubuntu1
10.02.1~dfsg1-0ubuntu2
10.02.1~dfsg1-0ubuntu5
10.02.1~dfsg1-0ubuntu6
10.02.1~dfsg1-0ubuntu7

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "ghostscript-dbgsym": "10.02.1~dfsg1-0ubuntu7.1",
            "libgs-common": "10.02.1~dfsg1-0ubuntu7.1",
            "ghostscript-doc": "10.02.1~dfsg1-0ubuntu7.1",
            "libgs-dev": "10.02.1~dfsg1-0ubuntu7.1",
            "ghostscript": "10.02.1~dfsg1-0ubuntu7.1",
            "libgs10-dbgsym": "10.02.1~dfsg1-0ubuntu7.1",
            "libgs10": "10.02.1~dfsg1-0ubuntu7.1",
            "libgs10-common": "10.02.1~dfsg1-0ubuntu7.1"
        }
    ]
}