Hi, Fedora released an advisory on October 16: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PG5AQV7JOL5TAU76FWPJCMSKO5DREKV5/ Ubuntu released an advisory on October 17: https://ubuntu.com/security/notices/USN-6433-1
CC: (none) => nicolas.salgueroWhiteboard: (none) => MGA8TOOAssignee: bugsquad => nicolas.salgueroSource RPM: (none) => ghostscript-10.00.0-6.2.mga9.src.rpm
Suggested advisory: ======================== The updated packages fix a security vulnerability: In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. (CVE-2023-43115) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43115 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PG5AQV7JOL5TAU76FWPJCMSKO5DREKV5/ https://ubuntu.com/security/notices/USN-6433-1 ======================== Updated packages in 9/core/updates_testing: ======================== ghostscript-10.00.0-6.3.mga9 ghostscript-X-10.00.0-6.3.mga9 ghostscript-common-10.00.0-6.3.mga9 ghostscript-doc-10.00.0-6.3.mga9 ghostscript-dvipdf-10.00.0-6.3.mga9 ghostscript-module-X-10.00.0-6.3.mga9 lib64gs10-10.00.0-6.3.mga9 lib64gs-devel-10.00.0-6.3.mga9 lib64ijs1-0.35-173.3.mga9 lib64ijs-devel-0.35-173.3.mga9 from SRPM: ghostscript-10.00.0-6.3.mga9.src.rpm Updated packages in 8/core/updates_testing: ======================== ghostscript-9.53.3-2.7.mga8 ghostscript-X-9.53.3-2.7.mga8 ghostscript-common-9.53.3-2.7.mga8 ghostscript-doc-9.53.3-2.7.mga8 ghostscript-dvipdf-9.53.3-2.7.mga8 ghostscript-module-X-9.53.3-2.7.mga8 lib64gs9-9.53.3-2.7.mga8 lib64gs-devel-9.53.3-2.7.mga8 lib64ijs1-0.35-162.7.mga8 lib64ijs-devel-0.35-162.7.mga8 from SRPM: ghostscript-9.53.3-2.7.mga8.src.rpm
Assignee: nicolas.salguero => qa-bugsStatus: NEW => ASSIGNED
Advisory from comment 1 added to SVN. Please remove the "advisory" keyword if it needs to be changed. It also helps when obsolete advisories are tagged as "obsolete".
Keywords: (none) => advisoryCC: (none) => marja11
mga9-64 OK in short test here: Updated, rebooted, printed from Firefox and Okular to black-white network laser printer, and to Boomaga.
CC: (none) => fri
CC: (none) => mageia
Mageia9, x86_64 Looked around for PoC but found none. Experimented a little with ghostscript then updated all the packages. $ gs -dSAFER -dNODISPLAY GPL Ghostscript 10.0.0 (2022-09-21) Copyright (C) 2022 Artifex Software, Inc. All rights reserved. This software is supplied under the GNU AGPLv3 and comes with NO WARRANTY: see the file COPYING for details. GS>quit $ gs abc-0.ps ..... Querying operating system for font files... Can't find (or can't open) font file /usr/share/ghostscript/10.00.0/Resource/Font//usr/sh. Can't find (or can't open) font file Gemelli. Loading Gemelli font from /home/lcl/.local/share/fonts/gemelli.pfb... 4302720 2834542 7049496 5668374 3 done. >>showpage, press <return> to continue<< GS>quit $ gs -dSAFER Your-TV-Licence.pdf GPL Ghostscript 10.0.0 (2022-09-21) Copyright (C) 2022 Artifex Software, Inc. All rights reserved. This software is supplied under the GNU AGPLv3 and comes with NO WARRANTY: see the file COPYING for details. Processing pages 1 through 1. Page 1 Loading font Arial,Bold (or substitute) from /usr/share/ghostscript/10.00.0/Resource/Font/NimbusSans-Bold >>showpage, press <return> to continue<< GS>quit gs handles display of PDF and EPS files OK. From previous experience have found that the TTF fonts need to be installed in /usr/share/fonts/default/ghostscript. Copied all the .afm and .pfb files to that directory as root and then ran type1inst in that directory to establish them. Trying to verify that ghostscript is involved when using CUPS to print a PostScript file found this quote from a Google search: * CUPS has a native driver style called “CUPS Raster”. These are executable programs, installed into CUPS' filter directory, which CUPS drives using a set of filters and Ghostscript. Such drivers are relatively easy to get going with CUPS, so are usually the best choice for CUPS users. * So :- $ lpr -Pprocyon tmp/abc-0.ps would seem to be a valid test. File header reads: %!PS-Adobe-3.0 EPSF-3.0 %%Creator: Tk Canvas Widget %%For: Len Lawrence %%Title: Window .w00053.w00054 %%CreationDate: Thu Sep 7 16:09:43 2023 %%BoundingBox: 0 0 596 842 %%Pages: 1 %%DocumentData: Clean7Bit %%Orientation: Portrait %%DocumentNeededResources: font Gemelli %%EndComments %%BeginProlog % This is a standard prolog for Postscript generated by Tk's canvas % widget. ........ File printed OK.
CC: (none) => tarazed25
Giving this the go-ahead on the basis of comments 3 and 4.
Whiteboard: MGA8TOO => MGA8TOO MGA9-64-OK
MGA8-64 Plasma in VirtualBox. No installation issues. I used the "gs" command to display a color .ps image from another test, then printed it from Okular in monochrome on my Laserjet CP1215. Looks good. Giving this an OK in MGA8 and validating.
CC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_updateWhiteboard: MGA8TOO MGA9-64-OK => MGA8TOO MGA8-64-OK MGA9-64-OK
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0290.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED