Test ID:	1.3.6.1.4.1.25623.1.0.883005
Category:	CentOS Local Security Checks
Title:	CentOS Update for ghostscript CESA-2019:0229 centos7
Summary:	The remote host is missing an update for the 'ghostscript'; package(s) announced via the CESA-2019:0229 advisory.
Description:	Summary: The remote host is missing an update for the 'ghostscript' package(s) announced via the CESA-2019:0229 advisory. Vulnerability Insight: The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: use-after-free in copydevice handling (699661) (CVE-2018-16540) * ghostscript: access bypass in psi/zdevice2.c (700153) (CVE-2018-19475) * ghostscript: access bypass in psi/zicc.c (700169) (CVE-2018-19476) * ghostscript: access bypass in psi/zfjbig2.c (700168) (CVE-2018-19477) * ghostscript: subroutines within pseudo-operators must themselves be pseudo-operators (700317) (CVE-2019-6116) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Tavis Ormandy (Google Project Zero) for reporting CVE-2019-6116. Bug Fix(es): * Previously, ghostscript-9.07-31.el7_6.1 introduced a regression during the standard input reading, causing a '/invalidfileaccess in --run--' error. With this update, the regression has been fixed and the described error no longer occurs. (BZ#1665919) Affected Software/OS: ghostscript on CentOS 7. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-6116 BugTraq ID: 106700 http://www.securityfocus.com/bid/106700 Bugtraq: 20190402 [slackware-security] ghostscript (SSA:2019-092-01) (Google Search) https://seclists.org/bugtraq/2019/Apr/4 Debian Security Information: DSA-4372 (Google Search) https://www.debian.org/security/2019/dsa-4372 https://www.exploit-db.com/exploits/46242/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7N6T5L3SSJX2AVUPHP7GCPATFWUPKZT2/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MWVAVCDXBLPLJMVGNSKGGDTBEOHCJBKK/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZP34D27RKYV2POJ3NJLSVCHUA5V5C45A/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVWXVKG72IGEJYHLWE6H3CGALHGFSGGY/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6AATIHU32MYKUOXQDJQU4X4DDVL7NAY3/ https://security.gentoo.org/glsa/202004-03 http://packetstormsecurity.com/files/151307/Ghostscript-Pseudo-Operator-Remote-Code-Execution.html http://packetstormsecurity.com/files/152367/Slackware-Security-Advisory-ghostscript-Updates.html https://bugs.chromium.org/p/project-zero/issues/detail?id=1729 https://lists.debian.org/debian-lts-announce/2019/02/msg00016.html http://www.openwall.com/lists/oss-security/2019/03/21/1 http://www.openwall.com/lists/oss-security/2019/01/23/5 RedHat Security Advisories: RHBA-2019:0327 https://access.redhat.com/errata/RHBA-2019:0327 RedHat Security Advisories: RHSA-2019:0229 https://access.redhat.com/errata/RHSA-2019:0229 https://usn.ubuntu.com/3866-1/
Copyright	Copyright (C) 2019 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.