SUSE-SU-2023:2844-1

Details

Description of the patch:

This update for ghostscript fixes the following issues:

CVE-2023-36664: Fixed permission validation mishandling for pipe devices with the %pipe% prefix or the | pipe character prefix (bsc#1212711).

Affected Packages

ghostscript

SUSE Linux Enterprise High Performance Computing 12 SP2SUSE Linux Enterprise High Performance Computing 12 SP4SUSE Linux Enterprise High Performance Computing 12 SP5SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP4

Fixed in:

0:9.52-23.54.1

ghostscript-devel

SUSE Linux Enterprise High Performance Computing 12 SP2SUSE Linux Enterprise High Performance Computing 12 SP4SUSE Linux Enterprise High Performance Computing 12 SP5SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP4

Fixed in:

0:9.52-23.54.1

ghostscript-x11

SUSE Linux Enterprise High Performance Computing 12 SP2SUSE Linux Enterprise High Performance Computing 12 SP4SUSE Linux Enterprise High Performance Computing 12 SP5SUSE Linux Enterprise Server 12 SP2-BCLSUSE Linux Enterprise Server 12 SP4

Fixed in:

0:9.52-23.54.1

References

ADVISORY

https://bugzilla.suse.com/1212711

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2023-July/015506.html

ADVISORY

https://www.suse.com/security/cve/CVE-2023-36664/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2023/suse-su-20232844-1/