USN-599-1: Ghostscript vulnerability

Releases

• Ubuntu 7.10
• Ubuntu 7.04
• Ubuntu 6.10
• Ubuntu 6.06

Packages

• ghostscript -
• gs-esp -
• gs-gpl -

Details

Chris Evans discovered that Ghostscript contained a buffer overflow in
its color space handling code. If a user or automated system were
tricked into opening a crafted Postscript file, an attacker could cause
a denial of service or execute arbitrary code with privileges of the
user invoking the program. (CVE-2008-0411)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 7.10

• libgs8 - 8.61.dfsg.1~svn8187-0ubuntu3.4

Ubuntu 7.04

• gs-gpl - 8.54.dfsg.1-5ubuntu0.2
• gs-esp - 8.15.4.dfsg.1-0ubuntu1.1

Ubuntu 6.10

• gs-gpl - 8.50-1.1ubuntu1.2
• gs-esp - 8.15.2.dfsg.0ubuntu1-0ubuntu4.1

Ubuntu 6.06

• gs-gpl - 8.15-4ubuntu3.1
• gs-esp - 8.15.2.dfsg.0ubuntu1-0ubuntu1.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2008-0411