SUSE Linux Enterprise 12 SP5 Security Update: Ghostscript RCE Fixes (CVE-2024-46951/53/55/56)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Advisory ID: SUSE-SU-2024:3942-1 2. Release Date: 2024-11-07T10:11:51Z 3. Severity Rating: Important 4. Reference Numbers: - bsc#1232265 - bsc#1232267 - bsc#1232269 - bsc#1232270 5. CVE IDs: - CVE-2024-46951 - CVE-2024-46953 - CVE-2024-46955 - CVE-2024-46956 6. Affected Products: - SUSE Linux Enterprise High Performance Computing 12 SP5 - SUSE Linux Enterprise Server 12 SP5 - SUSE Linux Enterprise Server 12 SP5 LTSS 12-SP5 - SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security 12-SP5 - SUSE Linux Enterprise Server for SAP Applications 12 SP5 7. Description: Fixes four vulnerabilities, including: - CVE-2024-46951: Arbitrary code execution via unchecked "Implementation" pointer in "Pattern" color space. - CVE-2024-46953: Integer overflow during page format parsing leading to path truncation, path traversal, and code execution. - CVE-2024-46956: Arbitrary code execution via out-of-bounds data access in filenameforall. - CVE-2024-46955: Out-of-bounds read during color reading in "Indexed" color space. 8. Patch Instructions: Use SUSE-recommended installation methods such as YaST Online Update or . Specific product commands can also be run. 9. Reference Links: - CVE-2024-46951 - CVE-2024-46953 - CVE-2024-46955 - CVE-2024-46956 - Multiple bug report links on bugzilla.suse.com This information provides detailed descriptions of the vulnerabilities, a list of affected products, and guidance on how to install the patches.

Goal Reached Thanks to every supporter — we hit 100%!

SUSE Linux Enterprise 12 SP5 Security Update: Ghostscript RCE Fixes (CVE-2024-46951/53/55/56)