Printing exposes system files to reading.

When used in a spooling environment, it is inappropriate to allow programs
to read arbitrary files as a result of print requests. Ghostscript, a
postscript interpreter, can read arbitrary system files with the same
permissions as the print spooler, potentially exposing the system to an
information compromise.

Ghostscript, a postscript interpreter, possess various 'file', 'run',
etc., commands internally. It also provides a -dSAFER flag to restrict the
use of the commands. However, the -dSAFER flag is meant to protect a user
from malicious postscript, not to protect a system from inappropriate
snooping by a user, and so it is still possible to _read_ files in the
SAFER mode.

In a print spooling context, even reading arbitrary files is dangerous, and
so this needs to be disabled in that context.

[UPDATE] : previous versions of this errata used packages:
rhs-printfilters-1.46-6,
rhs-printfilters-1.63-2.rh6.2,
rhs-printfilters-1.63-2.rh6.2j,
rhs-printfilters-1.81-2.rh7.0, and
rhs-printfilters-1.81-2.rh7.0j.

These caused spools to break upon upgrade, though they could easily be fixed
by editing the spools with printtool. The updated versions of the errata
packages address this bug.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

After updating the packages, the spool filter will have to be repaired to
use the -dPARANOIDSAFER mode, IF and only IF you have modified the spools
from what printtool provided. If this is the case, delete the spool queue,
and simply re-add it.

Custom filters and processes can make use of this mode by setting and
exporting the GS_OPTIONS environment variable to contain -dPARANOIDSAFER,
or by adding -dPARANOIDSAFER to the command line call to ghostscript.

Ghostscript, lpr, LPRng, printing