In Ghostscript, a toolkit for processing, converting, and generating documents in PostScript and PDF formats, vulnerability (), which can lead to file modifications and arbitrary command execution when opening specially crafted PostScript documents. The use of a non-standard PostScript operator in the document can trigger a uint32_t overflow when calculating size, rewriting memory areas outside the allocated buffer, and accessing files in the file system, which can be exploited to launch an attack that executes arbitrary code on the system (for example, by adding commands to ~/.bashrc or ~/.profile).
The issue affects from 9.50 to 9.52 (the bug starting from release 9.28rc1, but, according to researchers who identified the vulnerability, appears from version 9.50).
A fix has been proposed in the release (). Package updates with the fix have already been issued for , , . The packages in are not affected by the issues.
It should be noted that vulnerabilities in Ghostscript pose a heightened risk, as this package is used in many popular applications for processing PostScript and PDF formats. For instance, Ghostscript is invoked during thumbnail creation on the desktop, during background data indexing, and when converting images. In many cases, a successful attack may only require uploading a file with an exploit or viewing a directory containing it in Nautilus. Vulnerabilities in Ghostscript can also be exploited via image handlers based on ImageMagick and GraphicsMagick by passing a JPEG or PNG file that contains PostScript code instead of an image (this file will be processed in Ghostscript since the MIME type is recognized by content rather than relying on the extension).
Source: opennet.ru
