Ghostscript-CVE-2023-36664 - How to fix

Overview

This page is related to the BSSA-2023-01 Security Advisory.

Older versions of Ghostscript open a way for script infusion.

Because of bugs in the Ghostscript binary out of the BlueSpice package manager, Hallo Welt! mostly installed manually on Linux systems. These bugs no longer seem to be a problem.

How to update - Linux

1. Check the system for manual installation and delete it:

   ls -al /usr/local/bin
   

   If there is a binary called

   gs
   

   delete it:

   rm -fr /usr/local/bin/gs
   

2. Check the system for an installation out of the package manager (Ghostscript comes as a dependency of ImageMagik):

   dpkg -l ghostscript
   

   for Debian 11 this should look like:

   root@XXXXXXXXXXXX:~# dpkg -l ghostscript
   Gewünscht=Unbekannt/Installieren/R=Entfernen/P=Vollständig Löschen/Halten
   | Status=Nicht/Installiert/Config/U=Entpackt/halb konFiguriert/
            Halb installiert/Trigger erWartet/Trigger anhängig
   |/ Fehler?=(kein)/R=Neuinstallation notwendig (Status, Fehler: GROSS=schlecht)
   ||/ Name           Version               Architektur  Beschreibung
   +++-==============-=====================-============-===================================================
   ii  ghostscript    9.53.3~dfsg-7+deb11u5 amd64        interpreter for the PostScript language and for PDF
   

   For Debian 12 the Version is "10.0.0~dfsg-11+deb12u1"
   For Ubuntu 22 the Version is "9.50~dfsg-5ubuntu4.8"
   
   If it does not match the needed Version please do an:

   apt update
   apt upgrade -y
   

   and recheck.
   
3. Change the settings in the codebase.
   
   Go to the directory where the codebase is saved (check your ApacheConfiguration forDocumentRoot if you are not sure). Normally it should look like this:

   root@XXXXX:/var/www/bluespice/w/settings.d# grep -rin PdfProcessor
   005-PdfHandler.php:5:$wgPdfProcessor = '/usr/local/bin/gs';
   

   It could be 005-PdfHandler.php or some other configuration file.
   
4. Find and change the variable to the correct path, for example with this command:

   sed -i 's/local\///g' 005-PdfHandler.php
   

   Double-check:

   root@XXXXXXXXXXX:/var/www/bluespice/w/settings.d# grep -rin PdfProcessor
   005-PdfHandler.php:5:$wgPdfProcessor = '/usr/bin/gs';
   

Your system is now patched.

How to update - Windows

1. Deinstall the package GPL Ghostscript.
2. Download the package Ghostscript AGPL Release from https://www.ghostscript.com/releases/gsdnld.html .
3. Install the new package.

Your system is now patched.

---

To submit feedback about this documentation, visit our community forum.