USN-8791-1

It was discovered that Ghostscript incorrectly handled JPEG 2000 image components with mismatched subsampling factors. An attacker could possibly use this issue to cause Ghostscript to crash or execute arbitrary code if it opened a specially crafted file.

References

Affected packages

Ubuntu:22.04:LTS / ghostscript

Package

Name: ghostscript
Purl: pkg:deb/ubuntu/ghostscript?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.55.0~dfsg1-0ubuntu5.14

Affected versions

9.*

9.54.0~dfsg1-0ubuntu2

9.55.0~dfsg1-0ubuntu4

9.55.0~dfsg1-0ubuntu5

9.55.0~dfsg1-0ubuntu5.1

9.55.0~dfsg1-0ubuntu5.2

9.55.0~dfsg1-0ubuntu5.3

9.55.0~dfsg1-0ubuntu5.4

9.55.0~dfsg1-0ubuntu5.5

9.55.0~dfsg1-0ubuntu5.6

9.55.0~dfsg1-0ubuntu5.7

9.55.0~dfsg1-0ubuntu5.9

9.55.0~dfsg1-0ubuntu5.10

9.55.0~dfsg1-0ubuntu5.11

9.55.0~dfsg1-0ubuntu5.12

9.55.0~dfsg1-0ubuntu5.13

Ecosystem specific

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "ghostscript",
            "binary_version":  "9.55.0~dfsg1-0ubuntu5.14"
        },
        {
            "binary_name":  "ghostscript-x",
            "binary_version":  "9.55.0~dfsg1-0ubuntu5.14"
        },
        {
            "binary_name":  "libgs9",
            "binary_version":  "9.55.0~dfsg1-0ubuntu5.14"
        },
        {
            "binary_name":  "libgs9-common",
            "binary_version":  "9.55.0~dfsg1-0ubuntu5.14"
        }
    ]
}

Database specific

cves_map

{
    "cves":  [
        {
            "id":  "CVE-2026-39919",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:22.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8791-1.json"

Ubuntu:24.04:LTS / ghostscript

Package

Name: ghostscript
Purl: pkg:deb/ubuntu/ghostscript?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.02.1~dfsg1-0ubuntu7.9

Affected versions

10.*

10.01.2~dfsg1-0ubuntu2

10.01.2~dfsg1-0ubuntu2.1

10.02.1~dfsg1-0ubuntu1

10.02.1~dfsg1-0ubuntu2

10.02.1~dfsg1-0ubuntu5

10.02.1~dfsg1-0ubuntu6

10.02.1~dfsg1-0ubuntu7

10.02.1~dfsg1-0ubuntu7.1

10.02.1~dfsg1-0ubuntu7.3

10.02.1~dfsg1-0ubuntu7.4

10.02.1~dfsg1-0ubuntu7.5

10.02.1~dfsg1-0ubuntu7.6

10.02.1~dfsg1-0ubuntu7.7

10.02.1~dfsg1-0ubuntu7.8

Ecosystem specific

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "ghostscript",
            "binary_version":  "10.02.1~dfsg1-0ubuntu7.9"
        },
        {
            "binary_name":  "libgs-common",
            "binary_version":  "10.02.1~dfsg1-0ubuntu7.9"
        },
        {
            "binary_name":  "libgs10",
            "binary_version":  "10.02.1~dfsg1-0ubuntu7.9"
        },
        {
            "binary_name":  "libgs10-common",
            "binary_version":  "10.02.1~dfsg1-0ubuntu7.9"
        }
    ]
}

Database specific

cves_map

{
    "cves":  [
        {
            "id":  "CVE-2026-39919",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:24.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8791-1.json"

Ubuntu:26.04:LTS / ghostscript

Package

Name: ghostscript
Purl: pkg:deb/ubuntu/ghostscript?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.06.0~dfsg-3ubuntu1.1

Affected versions

10.*

10.05.0dfsg1-0ubuntu4

10.05.0dfsg1-0ubuntu5

10.06.0~dfsg-3ubuntu1

Ecosystem specific

{
    "availability":  "No subscription required",
    "binaries":  [
        {
            "binary_name":  "ghostscript",
            "binary_version":  "10.06.0~dfsg-3ubuntu1.1"
        },
        {
            "binary_name":  "libgs-common",
            "binary_version":  "10.06.0~dfsg-3ubuntu1.1"
        },
        {
            "binary_name":  "libgs10",
            "binary_version":  "10.06.0~dfsg-3ubuntu1.1"
        },
        {
            "binary_name":  "libgs10-common",
            "binary_version":  "10.06.0~dfsg-3ubuntu1.1"
        }
    ]
}

Database specific

cves_map

{
    "cves":  [
        {
            "id":  "CVE-2026-39919",
            "severity":  [
                {
                    "score":  "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                    "type":  "CVSS_V3"
                },
                {
                    "score":  "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                    "type":  "CVSS_V4"
                },
                {
                    "score":  "medium",
                    "type":  "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem":  "Ubuntu:26.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8791-1.json"