Advisories » MGASA-2018-0219

Updated ghostscript packages fix security vulnerability

Publication date: 04 May 2018
Modification date: 04 May 2018
Type: security
Affected Mageia releases : 5 , 6
CVE: CVE-2018-10194

Description

The set_text_distance function in devices/vector/gdevpdts.c in the
pdfwrite component in Artifex Ghostscript through 9.22 does not prevent
overflows in text-positioning calculation, which allows remote attackers
to cause a denial of service (application crash) or possibly have
unspecified other impact via a crafted PDF document (CVE-2018-10194).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=22931
• http://openwall.com/lists/oss-security/2018/04/19/5
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KAA4HM5ZWQWEFKXJK72E6S3MLTY2VN36/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10194

SRPMS

5/core

• ghostscript-9.23-1.mga5

6/core

• ghostscript-9.23-1.mga6