UbuntuUpdates.org

Package "libgs-common"

Name: libgs-common

Description:

interpreter for the PostScript language and for PDF - ICC profiles
Latest version: 10.07.1~dfsg-1ubuntu2.1
Release: stonking (26.10)
Level: security
Repository: main
Head package: ghostscript
Homepage: https://www.ghostscript.com/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libgs-common"

All arch deb package
APT INSTALL

Other versions of "libgs-common" in Stonking

Repository Area Version
base main 10.07.1~dfsg-1ubuntu2

Changelog

Version: 10.07.1~dfsg-1ubuntu2.1 2026-10-21 16:07:47 UTC

ghostscript (10.07.1~dfsg-1ubuntu2.1) stonking-security; urgency=medium

  * SECURITY UPDATE: -dSAFER bypass via use-after-free and heap buffer overflow
    - debian/patches/CVE-2026-101258-1.patch: copy the string returned by a
      procedure data source into global VM so a restore cannot leave a
      dangling pointer in psi/zfproc.c.
    - debian/patches/CVE-2026-101258-2.patch: validate that shading /Function
      array members produce exactly one output in base/gsshade.c.
    - CVE-2026-101258
  * SECURITY UPDATE: stack-based buffer overflow in pdfwrite Type 1 font
    conversion
    - debian/patches/CVE-2026-103226.patch: check there is space on the control
      stack before handling a subroutine call in devices/vector/gdevpsfx.c.
    - CVE-2026-103226
  * SECURITY UPDATE: -dSAFER bypass via missing operand validation in
    .putgstringcopy (LP: #2171528)
    - debian/patches/lp2171528.patch: verify operand types so an error handler
      cannot reach .forceput in Resource/Init/gs_fonts.ps.
    - No CVE number

 -- Charles Cochran Tue, 20 Oct 2026 12:40:15 -0400
2171528 Type 1 font-loader `.forceput` save/restore UAF yields native read/write and controlled dispatch/RCE under `-dSAFER`
CVE-2026-101258 A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitra
CVE-2026-103226 A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of


About   -   Send Feedback to @ubuntu_updates