SUSE-SU-2018:1140-1: moderate: Security update for ghostscript-library

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for ghostscript-library
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:1140-1
Rating:             moderate
References:         #1018128 #1030263 #1032138 #1032230 #1040643 
                    #1050879 #1050887 #1050888 #1050889 #1050891 
                    #1051184 
Cross-References:   CVE-2016-10219 CVE-2016-9601 CVE-2017-11714
                    CVE-2017-7207 CVE-2017-9216 CVE-2017-9612
                    CVE-2017-9726 CVE-2017-9727 CVE-2017-9739
                    CVE-2017-9835
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11-SP4
                    SUSE Linux Enterprise Server 11-SP4
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that solves 10 vulnerabilities and has one errata
   is now available.

Description:

   This update for ghostscript-library fixes several issues.

   These security issues were fixed:

   - CVE-2017-7207: The mem_get_bits_rectangle function allowed remote
     attackers to cause a denial of service (NULL pointer dereference) via a
     crafted PostScript document (bsc#1030263).
   - CVE-2016-9601: Prevent heap-buffer overflow by checking for an integer
     overflow in jbig2_image_new function (bsc#1018128).
   - CVE-2017-9612: The Ins_IP function in base/ttinterp.c allowed remote
     attackers to cause a denial of service (use-after-free and application
     crash)
     or possibly have unspecified other impact via a crafted document
      (bsc#1050891)
   - CVE-2017-9726: The Ins_MDRP function in base/ttinterp.c allowed remote
     attackers to cause a denial of service (heap-based buffer over-read and
     application crash) or possibly have unspecified other impact via a
     crafted document (bsc#1050889)
   - CVE-2017-9727: The gx_ttfReader__Read function in base/gxttfb.c allowed
     remote attackers to cause a denial of service (heap-based buffer
     over-read and application crash) or possibly have unspecified other
     impact via a crafted document (bsc#1050888)
   - CVE-2017-9739: The Ins_JMPR function in base/ttinterp.c allowed remote
     attackers to cause a denial of service (heap-based buffer over-read and
     application crash) or possibly have unspecified other impact via a
     crafted document (bsc#1050887)
   - CVE-2017-11714: psi/ztoken.c mishandled references to the scanner state
     structure, which allowed remote attackers to cause a denial of service
     (application crash) or possibly have unspecified other impact via a
     crafted PostScript document, related to an out-of-bounds read in the
     igc_reloc_struct_ptr function in psi/igc.c (bsc#1051184)
   - CVE-2017-9835: The gs_alloc_ref_array function allowed remote attackers
     to cause a denial of service (heap-based buffer overflow and application
     crash) or possibly have unspecified other impact via a crafted
     PostScript document (bsc#1050879)
   - CVE-2016-10219: The intersect function in base/gxfill.c allowed remote
     attackers to cause a denial of service (divide-by-zero error and
     application crash) via a crafted file (bsc#1032138)
   - CVE-2017-9216: Prevent NULL pointer dereference in the jbig2_huffman_get
     function in jbig2_huffman.c which allowed for DoS (bsc#1040643)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11-SP4:

      zypper in -t patch sdksp4-ghostscript-library-13588=1

   - SUSE Linux Enterprise Server 11-SP4:

      zypper in -t patch slessp4-ghostscript-library-13588=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-ghostscript-library-13588=1



Package List:

   - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      ghostscript-devel-8.62-32.47.7.1
      ghostscript-ijs-devel-8.62-32.47.7.1
      libgimpprint-devel-4.2.7-32.47.7.1

   - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      ghostscript-fonts-other-8.62-32.47.7.1
      ghostscript-fonts-rus-8.62-32.47.7.1
      ghostscript-fonts-std-8.62-32.47.7.1
      ghostscript-library-8.62-32.47.7.1
      ghostscript-omni-8.62-32.47.7.1
      ghostscript-x11-8.62-32.47.7.1
      libgimpprint-4.2.7-32.47.7.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      ghostscript-library-debuginfo-8.62-32.47.7.1
      ghostscript-library-debugsource-8.62-32.47.7.1


References:

   https://www.suse.com/security/cve/CVE-2016-10219.html
   https://www.suse.com/security/cve/CVE-2016-9601.html
   https://www.suse.com/security/cve/CVE-2017-11714.html
   https://www.suse.com/security/cve/CVE-2017-7207.html
   https://www.suse.com/security/cve/CVE-2017-9216.html
   https://www.suse.com/security/cve/CVE-2017-9612.html
   https://www.suse.com/security/cve/CVE-2017-9726.html
   https://www.suse.com/security/cve/CVE-2017-9727.html
   https://www.suse.com/security/cve/CVE-2017-9739.html
   https://www.suse.com/security/cve/CVE-2017-9835.html
   https://bugzilla.suse.com/1018128
   https://bugzilla.suse.com/1030263
   https://bugzilla.suse.com/1032138
   https://bugzilla.suse.com/1032230
   https://bugzilla.suse.com/1040643
   https://bugzilla.suse.com/1050879
   https://bugzilla.suse.com/1050887
   https://bugzilla.suse.com/1050888
   https://bugzilla.suse.com/1050889
   https://bugzilla.suse.com/1050891
   https://bugzilla.suse.com/1051184