This bug was fixed in the package ghostscript - 10.07.1~dfsg-1ubuntu2.1
---------------
ghostscript (10.07.1~dfsg-1ubuntu2.1) stonking-security; urgency=medium
* SECURITY UPDATE: -dSAFER bypass via use-after-free and heap buffer overflow
- debian/patches/CVE-2026-101258-1.patch: copy the string returned by a
procedure data source into global VM so a restore cannot leave a
dangling pointer in psi/zfproc.c.
- debian/patches/CVE-2026-101258-2.patch: validate that shading /Function
array members produce exactly one output in base/gsshade.c.
- CVE-2026-101258
* SECURITY UPDATE: stack-based buffer overflow in pdfwrite Type 1 font
conversion
- debian/patches/CVE-2026-103226.patch: check there is space on the control
stack before handling a subroutine call in devices/vector/gdevpsfx.c.
- CVE-2026-103226
* SECURITY UPDATE: -dSAFER bypass via missing operand validation in
.putgstringcopy (LP: #2171528)
- debian/patches/lp2171528.patch: verify operand types so an error handler
cannot reach .forceput in Resource/Init/gs_fonts.ps.
- No CVE number
-- Charles Cochran <[email protected]> Tue, 20 Oct 2026
12:40:15 -0400
** Changed in: ghostscript (Ubuntu Stonking)
Status: New => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2026-101258
** CVE added: https://cve.org/CVERecord?id=CVE-2026-103226
** Changed in: ghostscript (Ubuntu Noble)
Status: New => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171528
Title:
Type 1 font-loader `.forceput` save/restore UAF yields native
read/write and controlled dispatch/RCE under `-dSAFER`
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ghostscript/+bug/2171528/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
