SB2014102702 - Code Injection in Ghostscript
Published: October 27, 2014 Updated: August 10, 2020
Security Bulletin ID
SB2014102702
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Code Injection (CVE-ID: CVE-2010-4820)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Untrusted search path vulnerability in Ghostscript 8.62 allows local users to execute arbitrary PostScript code via a Trojan horse Postscript library file in Encoding/ under the current working directory, a different vulnerability than CVE-2010-2055.
Remediation
Install update from vendor's website.
References
- http://bugs.ghostscript.com/show_bug.cgi?id=691339
- http://rhn.redhat.com/errata/RHSA-2012-0095.html
- http://rhn.redhat.com/errata/RHSA-2012-0096.html
- http://www.openwall.com/lists/oss-security/2012/01/04/7
- http://www.securityfocus.com/archive/1/511433
- http://www.securityfocus.com/bid/51847
- https://bugzilla.redhat.com/show_bug.cgi?id=599564
- https://bugzilla.redhat.com/show_bug.cgi?id=771853