[Cucumber-linux-security] ghostscript (security update is available)

[Scott C. <sc...@cu...>]

  Update Information

A security update is available for ghostscript for the following
versions of Cucumber Linux:

  * 1.0
  * 1.1

Here are the details from the Cucumber 1.1 changelog:

+----------------+
Fri Aug 31 13:16:34 EDT 2018
apps-base/ghostscript rebuilt (build 3) to fix several security vulnerabilities:
	CVE-2018-15908, CVE-2018-15909, CVE-2018-15910 and CVE-2018-15911 . The
	last three vulnerabilities allowed for a crash of the ghostscript
	interpreter and potential code execution if an attacker could supply a
	maliciously crafted postscript file. CVE-2018-15908 allowed for an
	attacker to bypass write restrictions. For more information see:
		https://security.cucumberlinux.com/security/details.php?id=534
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15908
		https://security.cucumberlinux.com/security/details.php?id=532
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15909
		https://security.cucumberlinux.com/security/details.php?id=533
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15910
		https://security.cucumberlinux.com/security/details.php?id=535
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15911
multilib/apps-base/ghostscript-lib_i686 rebuilt (build 3, x86_64 only)
* SECURITY FIX *
+----------------+

------------------------------------------------------------------------


  CLD and CVE Information

This update is associated with the following Cucumber Linux Deficiency
(CLD) and CVE numbers:

  * CLD-532 [CVE-2018-15909]
    (https://security.cucumberlinux.com/security/details.php?id=532)
  * CLD-533 [CVE-2018-15910]
    (https://security.cucumberlinux.com/security/details.php?id=533)
  * CLD-534 [CVE-2018-15908]
    (https://security.cucumberlinux.com/security/details.php?id=534)
  * CLD-535 [CVE-2018-15911]
    (https://security.cucumberlinux.com/security/details.php?id=535)

More information about these CLDs can be found at their respective pages
on the Cucumber Linux Security Advisory Tracker (these are the URLs in
parenthesis above).

------------------------------------------------------------------------


  Installing the Update

The updated package can be installed via Pickle by running the following
commands (as root):

# pickle --update
# pickle

Make sure ghostscript is selected on the update list, and then select
Ok. Pickle will then install the updated package.

If you prefer to download the updated package manually, it can be found
on the mirror at http://mirror.cucumberlinux.com/cucumber/.

------------------------------------------------------------------------
The Cucumber Linux Security Team
cuc...@li...
<mailto:cuc...@li...>
https://www.cucumberlinux.com/security.php