Updated KDE packages available

New KDE 3.1.1a packages are available for Slackware 9.0 which fix a security problem with the handling of PS and PDF documents. Here are the details from the Slackware 9.0 ChangeLog: Thu Apr 17 15:32:15 PDT 2003 patches/packages/kde/: Upgraded to KDE 3.1.1a. Also included in this directory are a...

CVE-2003-0204

KDE 2 and KDE 3.1.1 and earlier 3.x versions allows attackers to execute arbitrary commands via 1 PostScript PS or 2 PDF files, related to missing -dPARANOIDSAFER and -dSAFER arguments when using the kghostview Ghostscript viewer...

CVE-2003-0207

ps2epsi creates insecure temporary files when calling ghostscript, which allows local attackers to overwrite arbitrary files...

ghostscript symbolic link problem

Symboli link problem during temporary files creation in ps2epsi...

[SECURITY] [DSA 284-1] New kdegraphics packages fix arbitrary command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 284-1 [email protected] http://www.debian.org/security/ Martin Schulze April 12th, 2003 http://www.debian.org/security/faq -...

DSA-284 kdegraphics - insecure execution

Bulletin has no description...

KDE Security Advisory: PS/PDF file handling vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: PS/PDF file handling vulnerability Original Release Date: 2003-04-09 URL: http://www.kde.org/info/security/advisory-20030409-1.txt 0. References http://bugs.kde.org/showbug.cgi?id=53157 http://bugs.kde.org/showbug.cgi?id=53343...

CVE-2002-0363

CVE-2002-0363 affects GNU Ghostscript prior to 6.53. A vulnerability in PostScript interpretation allows an attacker to cause Ghostscript to execute arbitrary commands by tricking the renderer into resetting the current pagedevice using .locksafe or .setsafe. The issue is due to insufficient vali...

CVE-2002-0363

ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice...

ASA-0000: GV Execution of Arbitrary Shell Commands

"After" Security Advisory Title: GV Execution of Arbitrary Shell Commands Affects: gv-3.5.8 and probably older versions Advisory ID: ASA-0000 Release Date: 2002-10-01 Author: Marc Bevand bevandm at epita.fr URL: http://www.epita.fr/bevandm/asa/asa-0000 --oOo-- 0. Table of Contents 0. Table of...

Important: Red Hat Security Advisory: ghostscript security update

Updated packages are available for GNU Ghostscript, which fix a vulnerability found during PostScript interpretation. Ghostscript is a program for displaying PostScript files or printing them to non-PostScript printers. An untrusted PostScript file can cause ghostscript to execute arbitrary...

CVE-2001-1353

Vulnerability (CVE-2001-1353) affects Ghostscript up to version 6.50, where the file operator can be exploited by a local user to read and write arbitrary files as the lp user, even when running with -dSAFER . The root cause is that the file operator integrity check does not prevent untrusted fil...

CVE-2001-1353

ghostscript before 6.51 allows local users to read and write arbitrary files as the 'lp' user via the file operator, even with -dSAFER enabled...

Important: Red Hat Security Advisory: : Ghostscript command execution vulnerability

Updated packages are available for GNU Ghostscript which fix a vulnerability found during Postscript interpretation. Ghostscript is a program for displaying PostScript files or printing them to non-PostScript printers. An untrusted PostScript file can cause ghostscript to execute arbitrary comman...

CVE-2002-0363

ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe or .setsafe to reset the current pagedevice...

CVE-2001-1353

ghostscript before 6.51 allows local users to read and write arbitrary files as the 'lp' user via the file operator, even with -dSAFER enabled...

Aladdin Ghostscript creates insecure temporary files allowing a local user to create symbolic links to other files

Overview Alladin Ghostscript, a previewer for postscript files, creates temporary files with a predictable names. The creation allows attackers to use symbolic links to overwrite other files on the host. Description Alladin Ghostscript is a previewer for postscript files. It creates temporary fil...

Samsung ml85p Printer Driver 1.0 - Insecure Temporary File Creation (1)

// source: https://www.securityfocus.com/bid/3008/info ml85p is a Linux driver for Samsung ML-85G series printers. It may be bundled with distributions of Ghostscript. ml85p does not check for symbolic links when creating image output files. These files are created in /tmp with a guessable naming...

Samsung ml85p Printer Driver 1.0 - Insecure Temporary File Creation (3)

Samsung ml85p Printer Driver 1.0 - Insecure Temporary File Creation 3 source: https://www.securityfocus.com/bid/3008/info ml85p is a Linux driver for Samsung ML-85G series printers. It may be bundled with distributions of Ghostscript. ml85p does not check for symbolic links when creating image...

CVE-2000-1163

CVE-2000-1163 affects Ghostscript prior to 5.10-16, which uses an insecure LD_RUN_PATH value to locate libraries in the current directory. This enables a local attacker to place a Trojan horse library in a directory from which another user runs Ghostscript, potentially executing code with the use...