—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3789
ghostscript security update
4 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: ghostscript
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2023-36664
Original Bulletin:
https://lists.debian.org/debian-security-announce/2023/msg00138.html
Comment: CVSS (Max): 8.4 CVE-2023-36664 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
– ————————–BEGIN INCLUDED TEXT——————–
– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512
– – ————————————————————————-
Debian Security Advisory DSA-5446-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
July 03, 2023 https://www.debian.org/security/faq
– – ————————————————————————-
Package : ghostscript
CVE ID : CVE-2023-36664
It was discovered that Ghostscript, the GPL PostScript/PDF interpreter,
does not properly handle permission validation for pipe devices, which
could result in the execution of arbitrary commands if malformed
document files are processed.
For the oldstable distribution (bullseye), this problem has been fixed
in version 9.53.3~dfsg-7+deb11u5.
For the stable distribution (bookworm), this problem has been fixed in
version 10.0.0~dfsg-11+deb12u1.
We recommend that you upgrade your ghostscript packages.
For the detailed security status of ghostscript please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/ghostscript
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
– —–BEGIN PGP SIGNATURE—–
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmSjKvpfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0T5lBAAivkfCmcEfUUjFaT3xhCMNFX5bCHJalKiZ0YpLfLOq6zhveOUoemlI6Va
lXRmV3kOz7ZdgghXkQ+TxrdcK0GmKy/Mb5Osi4oWU9KcID8Qa/Gu0aEGuz0YCCik
yGcaUMlkaZZRtnse5lPOf27avgBDZEkw5vwSXlCEdgleOY/fpX13sKdOrUB5H4Ma
79T5RqcLIxMQn/L2YChfjz+3iuY5rfgY50d00g+1r+xomALzQBqYpMFB2iM52gwo
BTOQ9nVr2+fuQdfE71ZVHjqOn+xVhJhhKp7fG/uzPz021L1Jec0xvjxh3WGEPfc8
kF6sShnoze06l9LfyyVsH629+G0zxcvaK2chku5iJU1zzUh5NQiCMbo6Tdp1c8Ox
IuuPwdVIRJbMqCDPvz+UJ/KxbnAhN77f/3eb98wTdPWHdW6t5LPdngDxXimHg6RX
i2eANVjFOp6XZZ6iju9TvsxPq/MMiBlbD5KPnUK8n6sl8O1b7lHZgy7KU2qFIqWc
s482gsrf9ZIMMR4PgNJjp3YQDXjkME/AgUwWKpEx91MKSyc1ygfZYJr7WRnwg81d
gTX7hx/GW9fcwprTcGn2H3FmJsnuIYz9wsgLp5x6/WWB1tF7ZGzhYHNgK0QphejD
DGTDUTqRcYsiVTkfutBJw2OzDVoIQyrUn78y9Ux1aueF1NM1fMQ=
=bsYs
– —–END PGP SIGNATURE—–
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZKOR9ckNZI30y1K9AQhPKw/+Lx51he9shcwqJ2829Qa4ieApz+M38O71
vsbQdGy26gKkNkax7BrFEgnat8TlLAG2HyiUTpnX0/rRtFOPX/YIfkUN39vTNo//
kBcsYDVfkIdqj5LHCsSDColFfL/1C4qel1OoVTahUEPopLRU4fDNLh3+MxUvAB/b
5DkWSsowSCpL+DfHUYVvoMllwbKh/HSzNCBAUWnQ8uHJ7YgOQ3tvtZ5kbEpYsgBE
oC9Zw4ScKbE3bniCgdk3HytGEeYZ5Otl3W/f5cJ/9M/Z2nNCvyszQ4yUMiMn5G97
ZuCRbfhBTrhOqhpBcz5oDJkwRbK/kqqqQjh/YpTvLDn05Z+pxDA5kjyNF72RMHpl
AjiWCtD8qqm71tHxap8caBW1Lou6lJ7GlBu73vxOCWpow7AKFWdThUuX0hcTPCyE
4FvbljKr7IewHI4Rc5wAGHoJbxkXEyzVCTY1KoJCJao2+rrjiIjTc+ohMKQEiPn+
PtuXUkjrly8aZUXAaBb//AdLZeFTqbXvK4yHJnssldCHr82kNJsLTm3FYExGFvSR
QQkKm0ELbjBoTa1raXPe2tlBX8ZrHe97rWL4sVjro6/7MdHuHkNEAjd4tXXacNMo
uHmCmL40UsUbjxQEPwCFi0GDoO/6gqr/MswxynZbuMqOAKLlP5MSrUc8y/1f3Omh
BWQ6H3wf9j4=
=GBX/
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins