USN-5643-1: Ghostscript vulnerabilities

Releases

• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• ghostscript - PostScript and PDF interpreter

Details

It was discovered that GhostScript incorrectly handled certain PDF files.
If a user or automated system were tricked into opening a specially crafted
PDF file, a remote attacker could use this issue to cause GhostScript to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-27792)

It was discovered that GhostScript incorrectly handled certain PDF files.
If a user or automated system were tricked into opening a specially crafted
PDF file, a remote attacker could use this issue to cause GhostScript to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-2085)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• ghostscript - 9.55.0~dfsg1-0ubuntu5.1

Ubuntu 20.04

• ghostscript - 9.50~dfsg-5ubuntu4.6

Ubuntu 18.04

• ghostscript - 9.26~dfsg+0-0ubuntu0.18.04.17

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-2085
• CVE-2020-27792

Related notices

• USN-5618-1: libgs9-common, ghostscript, ghostscript-doc, libgs9, ghostscript-x, libgs-dev