Issued:
2009-03-19
Updated:
2009-03-19

RHSA-2009:0345 - Security Advisory

Synopsis

Moderate: ghostscript security update

Type/Severity

Security Advisory: Moderate

Topic

Updated ghostscript packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Ghostscript is a set of software that provides a PostScript(TM)
interpreter, a set of C procedures (the Ghostscript library, which
implements the graphics capabilities in the PostScript language) and
an interpreter for Portable Document Format (PDF) files.

Multiple integer overflow flaws which could lead to heap-based buffer
overflows, as well as multiple insufficient input validation flaws, were
found in Ghostscript's International Color Consortium Format library
(icclib). Using specially-crafted ICC profiles, an attacker could create a
malicious PostScript or PDF file with embedded images which could cause
Ghostscript to crash, or, potentially, execute arbitrary code when opened
by the victim. (CVE-2009-0583, CVE-2009-0584)

All users of ghostscript are advised to upgrade to these updated packages,
which contain a backported patch to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 4.7 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.7 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.7 i386
  • Red Hat Enterprise Linux Server - AUS 5.3 x86_64
  • Red Hat Enterprise Linux Server - AUS 5.3 ia64
  • Red Hat Enterprise Linux Server - AUS 5.3 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 487742 - CVE-2009-0583 ghostscript: Multiple integer overflows in the International Color Consortium Format Library
  • BZ - 487744 - CVE-2009-0584 ghostscript: Multiple insufficient upper-bounds checks on certain sizes in the International Color Consortium Format Library

CVEs

References

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
ghostscript-7.07-33.2.el4_7.5.s390.rpm SHA-256: ea633625017259e70cd48bae014aafe41dee97b11260459cf111ed5073aa4a97
s390
ghostscript-7.07-33.2.el4_7.5.s390.rpm SHA-256: ea633625017259e70cd48bae014aafe41dee97b11260459cf111ed5073aa4a97
ghostscript-devel-7.07-33.2.el4_7.5.s390.rpm SHA-256: ab105b84ae4e0883fd3b5f25fe0be457ea81e2cbf6bd40bb5ae85cab9346862d
ghostscript-gtk-7.07-33.2.el4_7.5.s390.rpm SHA-256: f1f9e12dad4236733f32d8a5fd402978d7aab1da3127884ad03e4a51c6979f9e

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7

SRPM
s390x
ghostscript-7.07-33.2.el4_7.5.s390.rpm SHA-256: ea633625017259e70cd48bae014aafe41dee97b11260459cf111ed5073aa4a97
s390
ghostscript-7.07-33.2.el4_7.5.s390.rpm SHA-256: ea633625017259e70cd48bae014aafe41dee97b11260459cf111ed5073aa4a97
ghostscript-devel-7.07-33.2.el4_7.5.s390.rpm SHA-256: ab105b84ae4e0883fd3b5f25fe0be457ea81e2cbf6bd40bb5ae85cab9346862d
ghostscript-gtk-7.07-33.2.el4_7.5.s390.rpm SHA-256: f1f9e12dad4236733f32d8a5fd402978d7aab1da3127884ad03e4a51c6979f9e

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.