ALT-BU-2023-3238-1
Branch sisyphus_e2k update bulletin.
Package ghostscript updated to version 10.01.1-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-00147
Уязвимость реализации функции sampled_data_finish() набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-02055
Уязвимость набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, связанная с записью за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-3781
A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Modified: 2024-11-21
CVE-2021-45949
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp).
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=34675
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=2a3129365d3bc0d4a41f107ef175920d1505d1f7
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=2a3129365d3bc0d4a41f107ef175920d1505d1f7
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
- [debian-lts-announce] 20220114 [SECURITY] [DLA 2879-1] ghostscript security update
- [debian-lts-announce] 20220114 [SECURITY] [DLA 2879-1] ghostscript security update
- DSA-5038
- DSA-5038
Modified: 2025-02-14
CVE-2023-28879
In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.
- [oss-security] 20230412 Ghostscript CVE-2023-28879: "Shell in the Ghost"
- https://bugs.ghostscript.com/show_bug.cgi?id=706494
- https://ghostscript.readthedocs.io/en/latest/News.html
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179
- [debian-lts-announce] 20230404 [SECURITY] [DLA 3381-1] ghostscript security update
- FEDORA-2023-f51bc947bb
- FEDORA-2023-fbf86d8916
- FEDORA-2023-366850fc87
- GLSA-202309-03
- DSA-5383
- DSA-5383
- GLSA-202309-03
- FEDORA-2023-366850fc87
- FEDORA-2023-fbf86d8916
- FEDORA-2023-f51bc947bb
- [debian-lts-announce] 20230404 [SECURITY] [DLA 3381-1] ghostscript security update
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179
- https://ghostscript.readthedocs.io/en/latest/News.html
- https://bugs.ghostscript.com/show_bug.cgi?id=706494
- [oss-security] 20230412 Ghostscript CVE-2023-28879: "Shell in the Ghost"
Package mate-file-manager-extensions updated to version 1.26.1-alt3 for branch sisyphus_e2k.
Closed bugs
Функция "Отправить" не работает при попытке передачи файла на подключенный сервер.
Package kdenlive updated to version 22.12.3-alt2 for branch sisyphus_e2k.
Closed bugs
kf.service.services: KServiceTypeTrader: serviceType "ThumbCreator" not found
Kdenlive no effects list: Type NewStuff.Page unavailable. Type NewStuff.Action unavailable.
kdenlive автоматическая установка модуле средствами pip No module named 'pkg_resources'