Skip to navigation

Security Advisory Ghostscript command execution vulnerability

Advisory: RHSA-2002:083-22
Type: Security Advisory
Severity: N/A
Issued on: 2002-05-07
Last updated on: 2002-06-03
Affected Products: Red Hat Linux 6.2
Red Hat Linux 7.0
Red Hat Linux 7.1
Red Hat Linux 7.2
Red Hat Linux 7.3
CVEs (cve.mitre.org): CVE-2002-0363

Details

Updated packages are available for GNU Ghostscript which fix a
vulnerability found during Postscript interpretation.

Ghostscript is a program for displaying PostScript files or printing them
to non-PostScript printers.

An untrusted PostScript file can cause ghostscript to execute arbitrary
commands due to insufficient checking. Since ghostscript is often used
during the course of printing a document (and is run as user 'lp'), all
users should install these fixed packages.

The problem is fixed in the 6.53 source release of GNU Ghostscript, and the
fix has been backported and applied to the packages referenced by this
advisory.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2002-0363 to this issue.

Please note that this vulnerability is different to the 'local file read'
issue corrected by our previous Ghostscript errata (RHSA-2001:112 and
RHSA-2001:138)


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Updated packages

Red Hat Linux 6.2

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-11.6x/SRPMS/VFlib2-2.25.1-11.6x.src.rpm
Missing file
    MD5: 39b9b94fb6a17c6d3a02c9e52db84d75
ftp://updates.redhat.com/rhn/repository/NULL/ghostscript/6.51-16.1.6x.1/SRPMS/ghostscript-6.51-16.1.6x.1.src.rpm
Missing file
    MD5: fd9392c8956670b0032136e7470ebb4b
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-8.6x/SRPMS/xtt-fonts-0.19990222-8.6x.src.rpm
Missing file
    MD5: 2be01efc98d82b5f1b5ed8cd58ae38ca
 
Alpha:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-11.6x/alpha/VFlib2-2.25.1-11.6x.alpha.rpm
Missing file
    MD5: a0f75f1ca786acf5352f150d517d9ac5
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-VFjfm/2.25.1-11.6x/alpha/VFlib2-VFjfm-2.25.1-11.6x.alpha.rpm
Missing file
    MD5: dbfb7d677e1a94bf3070abb662e406b5
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-devel/2.25.1-11.6x/alpha/VFlib2-devel-2.25.1-11.6x.alpha.rpm
Missing file
    MD5: 7077d0eb914bf0cb72431c883735821f
ftp://updates.redhat.com/rhn/repository/NULL/ghostscript/6.51-16.1.6x.1/alpha/ghostscript-6.51-16.1.6x.1.alpha.rpm
Missing file
    MD5: d7734831910f1e8de8fe022cbae8a3d7
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-8.6x/noarch/xtt-fonts-0.19990222-8.6x.noarch.rpm
Missing file
    MD5: 1455e9fc7056f4593cee248a580d6fae
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-11.6x/i386/VFlib2-2.25.1-11.6x.i386.rpm
Missing file
    MD5: 2ae611a68c01f9376b825b536068669c
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-VFjfm/2.25.1-11.6x/i386/VFlib2-VFjfm-2.25.1-11.6x.i386.rpm
Missing file
    MD5: 21420c0e8e89c78205e00f251e66f844
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-devel/2.25.1-11.6x/i386/VFlib2-devel-2.25.1-11.6x.i386.rpm
Missing file
    MD5: 1b757aea2d8051f8922961501f9a8678
ftp://updates.redhat.com/rhn/repository/NULL/ghostscript/6.51-16.1.6x.1/i386/ghostscript-6.51-16.1.6x.1.i386.rpm
Missing file
    MD5: e54c57c10e28fd145c5e1f97f3f8f5ed
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-8.6x/noarch/xtt-fonts-0.19990222-8.6x.noarch.rpm
Missing file
    MD5: 1455e9fc7056f4593cee248a580d6fae
 
Sparc:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-11.6x/sparc/VFlib2-2.25.1-11.6x.sparc.rpm
Missing file
    MD5: 18baaa094259076a7edd4c4d7d2ec7e9
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-VFjfm/2.25.1-11.6x/sparc/VFlib2-VFjfm-2.25.1-11.6x.sparc.rpm
Missing file
    MD5: c2fe83310287c7f1f0ca743261240c28
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-devel/2.25.1-11.6x/sparc/VFlib2-devel-2.25.1-11.6x.sparc.rpm
Missing file
    MD5: ebbc6503b8f99e1e3dd79ad9766cac04
ftp://updates.redhat.com/rhn/repository/NULL/ghostscript/6.51-16.1.6x.1/sparc/ghostscript-6.51-16.1.6x.1.sparc.rpm
Missing file
    MD5: fbf618b69fd5404081d761029778c696
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-8.6x/noarch/xtt-fonts-0.19990222-8.6x.noarch.rpm
Missing file
    MD5: 1455e9fc7056f4593cee248a580d6fae
 
Red Hat Linux 7.0

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-12/SRPMS/VFlib2-2.25.1-12.src.rpm
Missing file
    MD5: d25a61585c232c8f56d5ec49922ad246
ghostscript-6.51-16.1.7x.src.rpm
File outdated by:  RHSA-2003:181
    MD5: 93532d180a459cf853a59945ff81b6ee
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-9/SRPMS/xtt-fonts-0.19990222-9.src.rpm
Missing file
    MD5: 40037639055d00c9b4f1af144beabee4
 
Alpha:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-12/alpha/VFlib2-2.25.1-12.alpha.rpm
Missing file
    MD5: b1a69584ede57bd1a264e8e892d9e182
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-VFjfm/2.25.1-12/alpha/VFlib2-VFjfm-2.25.1-12.alpha.rpm
Missing file
    MD5: bea84891fe60e6c08005b7a9d9219e11
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-devel/2.25.1-12/alpha/VFlib2-devel-2.25.1-12.alpha.rpm
Missing file
    MD5: 75dd6c3d2d5af442fc6f150a4d71671a
ftp://updates.redhat.com/rhn/repository/NULL/ghostscript/6.51-16.1.7x/alpha/ghostscript-6.51-16.1.7x.alpha.rpm
Missing file
    MD5: 8fe589c020ef43db2b27dfc47fd8b4be
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-9/noarch/xtt-fonts-0.19990222-9.noarch.rpm
Missing file
    MD5: bf996108e1bfed22384d849a10a03807
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-12/i386/VFlib2-2.25.1-12.i386.rpm
Missing file
    MD5: ee7127247a44d2e49f0be52d815db09d
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-VFjfm/2.25.1-12/i386/VFlib2-VFjfm-2.25.1-12.i386.rpm
Missing file
    MD5: 979ea17d5ef0db8f9e825381453524fb
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-devel/2.25.1-12/i386/VFlib2-devel-2.25.1-12.i386.rpm
Missing file
    MD5: 9a5a772d9b9bd01b3b80e130ece11c48
ftp://updates.redhat.com/rhn/repository/NULL/ghostscript/6.51-16.1.7x/i386/ghostscript-6.51-16.1.7x.i386.rpm
Missing file
    MD5: a317acb4dbee54a5239356f1d3612df6
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-9/noarch/xtt-fonts-0.19990222-9.noarch.rpm
Missing file
    MD5: bf996108e1bfed22384d849a10a03807
 
Red Hat Linux 7.1

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-12/SRPMS/VFlib2-2.25.1-12.src.rpm
Missing file
    MD5: d25a61585c232c8f56d5ec49922ad246
ghostscript-6.51-16.1.7x.src.rpm
File outdated by:  RHSA-2003:181
    MD5: 93532d180a459cf853a59945ff81b6ee
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-9/SRPMS/xtt-fonts-0.19990222-9.src.rpm
Missing file
    MD5: 40037639055d00c9b4f1af144beabee4
 
Alpha:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-12/alpha/VFlib2-2.25.1-12.alpha.rpm
Missing file
    MD5: b1a69584ede57bd1a264e8e892d9e182
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-VFjfm/2.25.1-12/alpha/VFlib2-VFjfm-2.25.1-12.alpha.rpm
Missing file
    MD5: bea84891fe60e6c08005b7a9d9219e11
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-devel/2.25.1-12/alpha/VFlib2-devel-2.25.1-12.alpha.rpm
Missing file
    MD5: 75dd6c3d2d5af442fc6f150a4d71671a
ftp://updates.redhat.com/rhn/repository/NULL/ghostscript/6.51-16.1.7x/alpha/ghostscript-6.51-16.1.7x.alpha.rpm
Missing file
    MD5: 8fe589c020ef43db2b27dfc47fd8b4be
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-9/noarch/xtt-fonts-0.19990222-9.noarch.rpm
Missing file
    MD5: bf996108e1bfed22384d849a10a03807
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2/2.25.1-12/i386/VFlib2-2.25.1-12.i386.rpm
Missing file
    MD5: ee7127247a44d2e49f0be52d815db09d
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-VFjfm/2.25.1-12/i386/VFlib2-VFjfm-2.25.1-12.i386.rpm
Missing file
    MD5: 979ea17d5ef0db8f9e825381453524fb
ftp://updates.redhat.com/rhn/repository/NULL/VFlib2-devel/2.25.1-12/i386/VFlib2-devel-2.25.1-12.i386.rpm
Missing file
    MD5: 9a5a772d9b9bd01b3b80e130ece11c48
ghostscript-6.51-16.1.7x.i386.rpm
File outdated by:  RHSA-2003:181
    MD5: a317acb4dbee54a5239356f1d3612df6
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-9/noarch/xtt-fonts-0.19990222-9.noarch.rpm
Missing file
    MD5: bf996108e1bfed22384d849a10a03807
 
IA-64:
ftp://updates.redhat.com/rhn/repository/NULL/ghostscript/6.51-16.1.7x/ia64/ghostscript-6.51-16.1.7x.ia64.rpm
Missing file
    MD5: 75db622c8177dffc116f221d678f7c0d
ftp://updates.redhat.com/rhn/repository/NULL/xtt-fonts/0.19990222-9/noarch/xtt-fonts-0.19990222-9.noarch.rpm
Missing file
    MD5: bf996108e1bfed22384d849a10a03807
 
Red Hat Linux 7.2

SRPMS:
ghostscript-6.51-16.2.src.rpm
File outdated by:  RHSA-2003:181
    MD5: ddb0f44bdbd59608cf1a0e07bc4fdf01
ftp://updates.redhat.com/rhn/private/redhat-linux-as-2.1-IPF/SRPMS/printconf-0.3.61-4.1.src.rpm
Missing file
    MD5: c5232bb663dbde2e04d7b19cbba87246
ftp://updates.redhat.com/rhn/public/2703533/printconf/0.3.61-4.1/SRPMS/printconf-0.3.61-4.1.src.rpm
Missing file
    MD5: c5232bb663dbde2e04d7b19cbba87246
 
IA-32:
ghostscript-6.51-16.2.i386.rpm
File outdated by:  RHSA-2003:181
    MD5: 04199f3a2f4fa4b6998c6b229c4f4f3a
ftp://updates.redhat.com/rhn/repository/NULL/printconf/0.3.61-4.1/i386/printconf-0.3.61-4.1.i386.rpm
Missing file
    MD5: c722ab94c36110b54e600854e7e5f20d
ftp://updates.redhat.com/rhn/repository/NULL/printconf-gui/0.3.61-4.1/i386/printconf-gui-0.3.61-4.1.i386.rpm
Missing file
    MD5: 3156e37a7252c3603b83310b0b4cd50b
 
IA-64:
ghostscript-6.51-16.2.ia64.rpm
File outdated by:  RHSA-2003:181
    MD5: 448bb8057d7669158c19efeae2f310ec
ftp://updates.redhat.com/rhn/private/redhat-linux-as-2.1-IPF/RPMS/printconf-0.3.61-4.1.ia64.rpm
Missing file
    MD5: aea25c90e71a2f3d927aa0c62a29c687
ftp://updates.redhat.com/rhn/private/redhat-linux-as-2.1-IPF/RPMS/printconf-gui-0.3.61-4.1.ia64.rpm
Missing file
    MD5: 53ce3bddd1f78b5de5067478f719b39f
 
Red Hat Linux 7.3

SRPMS:
ghostscript-6.52-9.4.src.rpm
File outdated by:  RHSA-2003:181
    MD5: a447ff805d6d55a9e93498bdb41699a5
 
IA-32:
ghostscript-6.52-9.4.i386.rpm
File outdated by:  RHSA-2003:181
    MD5: 0f85846611c14aad7ca81e2a36f1247e
 

References


Keywords

ghostscript, PARANOIDSAFER, SAFER


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/