FEDORA-2016-2df27a2224 — security update for ghostscript

stable

ghostscript-9.20-2.fc25

FEDORA-2016-2df27a2224 created by dkaspar 9 years ago for Fedora 25

This is a rebase of ghostscript package, to address several security issues:

CVE-2016-7977 - .libfile does not honor -dSAFER
CVE-2013-5653 - getenv and filenameforall ignore -dSAFER
CVE-2016-7976 - various userparams allow %pipe% in paths, allowing remote shell
CVE-2016-7978 - reference leak in .setdevice allows use-after-free and remote code
CVE-2016-7979 - Type confusion in .initialize_dsc_parser allows remote code execution

INFORMATION FOR FEDORA PACKAGERS & MAINTAINERS:

ghostscript has been rebased to latest upstream version (9.20). Rebase notes:

no API/ABI changes between versions 9.16 -> 9.20 according to upstream
OpenJPEG support has been retained
ijs-config custom tool from upstream has been removed (by upstream) (pkg-config is used by default now instead, see commit 0c176a9)
some patches were updated to 'git format-patch' format & renamed
rest of the patches were deleted (irrelevant for current version), mostly because upstream has fixed those issues in some way

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2016-2df27a2224

This update has been submitted for testing by dkaspar.

9 years ago

This update has been pushed to testing.

9 years ago

besser82 commented & provided feedback 9 years ago

karma

Works fine! LGTM! =)

pwalter commented & provided feedback 9 years ago

karma

Works

lupinix commented & provided feedback 9 years ago

karma

works fine

akinsola commented & provided feedback 9 years ago

karma

worked

williamjmorenor commented & provided feedback 9 years ago

karma

Work for me

heikoada commented & provided feedback 9 years ago

karma

LGTM

cserpentis commented & provided feedback 9 years ago

karma

works for me

This update has reached 3 days in testing and can be pushed to stable now if the maintainer wishes

9 years ago

kuosmanen commented & provided feedback 9 years ago

karma

looks good

chr77 commented & provided feedback 9 years ago

karma

Works for me

kalev commented & provided feedback 9 years ago

karma

Works fine here

cairo provided feedback 9 years ago

karma

This update has been submitted for stable by bodhi.

9 years ago

smithp commented & provided feedback 9 years ago

karma

This update has been pushed to stable.

9 years ago

Please log in to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

None

Autopush Settings

Unstable by Karma

-4

Stable by Karma

Stable by Time

disabled

Dates

submitted

9 years ago

in testing

9 years ago

in stable

9 years ago

Builds

ghostscript-9.20-2.fc25

BZ#1380327 CVE-2013-5653 ghostscript: getenv and filenameforall ignore -dSAFER

BZ#1380415 CVE-2016-7977 ghostscript: .libfile does not honor -dSAFER

BZ#1382294 CVE-2016-7976 ghostscript: various userparams allow %pipe% in paths, allowing remote shell

BZ#1382300 CVE-2016-7978 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution

BZ#1382305 CVE-2016-7979 ghostscript: Type confusion in .initialize_dsc_parser allows remote code execution

ghostscript-9.20-2.fc25

Automated Test Results

None