Chiwopsezo mu Ghostscript chomwe chimalola kukhazikitsidwa kwa ma code mukatsegula chikalata cha PostScript

Mu Ghostscript, zida zosinthira, kusintha ndi kupanga zolemba mu PostScript ndi ma PDF, kudziwika kusatetezeka (CVE-2020-15900), zomwe zingapangitse mafayilo kusinthidwa ndi malamulo osamveka kuti aphedwe potsegula zolemba za PostScript zopangidwa mwapadera. Kugwiritsa ntchito wogwiritsa ntchito wa PostScript wosakhala wamba mu chikalata fufuzani amakulolani kuti mupangitse kusefukira kwa mtundu wa uint32_t powerengera kukula kwake, lembani malo okumbukira kunja kwa buffer yomwe mwapatsidwa ndikupeza mafayilo mu FS, omwe angagwiritsidwe ntchito pokonzekera kuwukira kuti apereke code yosagwirizana pa dongosolo (mwachitsanzo, powonjezera malamulo ku ~/.bashrc kapena ~/. mbiri).

Vuto limakhudza nkhani kuyambira 9.50 mpaka 9.52 (zolakwika kupezeka kuyambira kumasulidwa 9.28rc1, koma, malinga ndi zoperekedwa ofufuza omwe adazindikira chiwopsezocho, akuwoneka kuyambira mtundu 9.50).

Konzani zomwe zatulutsidwa 9.52.1 (chigamba). Zosintha za phukusi la Hotfix zatulutsidwa kale Debian, Ubuntu, SUSE. Phukusi mkati RHEL mavuto sakhudzidwa.

Tikukumbutseni kuti kusatetezeka mu Ghostscript kumabweretsa chiwopsezo chowonjezereka, chifukwa phukusili limagwiritsidwa ntchito m'mapulogalamu ambiri otchuka pokonza ma PostScript ndi ma PDF. Mwachitsanzo, Ghostscript imatchedwa panthawi yopanga thumbnail pakompyuta, kulondolera deta yakumbuyo, ndi kusintha kwa zithunzi. Kuti muwukire bwino, nthawi zambiri ndikwanira kungotsitsa fayiloyo ndikugwiritsa ntchito kapena kuyang'ana chikwatu ndi Nautilus. Zowopsa mu Ghostscript zitha kugwiritsidwanso ntchito pogwiritsa ntchito ma processor azithunzi kutengera phukusi la ImageMagick ndi GraphicsMagick powapatsira fayilo ya JPEG kapena PNG yokhala ndi code ya PostScript m'malo mwa chithunzi (fayilo yotereyi idzasinthidwa mu Ghostscript, popeza mtundu wa MIME umadziwika ndi zokhutira, komanso popanda kudalira zowonjezera).

Source: opennet.ru

Kuwonjezera ndemanga