QSN-8949-1: Ghostscript vulnerabilities
2026-10-21

Summary:
Several security issues were fixed in Ghostscript.

Details:
Rick de Jager discovered that Ghostscript incorrectly handled memory
under certain circumstances when processing PostScript documents. If a
user or automated system were tricked into processing a specially crafted
document, an attacker could possibly use this issue to bypass the sandbox
and execute arbitrary code. (CVE-2026-101258)

It was discovered that Ghostscript incorrectly handled memory when
converting certain fonts. If a user or automated system were tricked into
processing a specially crafted file, an attacker could possibly use this
issue to cause Ghostscript to crash, or possibly execute arbitrary code.
(CVE-2026-103226)

Paulos Yibelo discovered that Ghostscript did not properly validate
certain operands when loading fonts. If a user or automated system were
tricked into processing a specially crafted file, an attacker could
possibly use this issue to bypass the sandbox and execute arbitrary code.
(No CVE number)

Affected QuantaStor releases:
  6.9.1.001 jammy: ghostscript 9.55.0~dfsg1-0ubuntu5.15 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.9.1.001 jammy: libgs9 9.55.0~dfsg1-0ubuntu5.15 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.9.1.001 jammy: libgs9-common 9.55.0~dfsg1-0ubuntu5.15 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.9.0.464 jammy: ghostscript 9.55.0~dfsg1-0ubuntu5.14 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.9.0.464 jammy: libgs9 9.55.0~dfsg1-0ubuntu5.14 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.9.0.464 jammy: libgs9-common 9.55.0~dfsg1-0ubuntu5.14 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.6.015 jammy: ghostscript 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.6.015 jammy: libgs9 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.6.015 jammy: libgs9-common 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.5.018 jammy: ghostscript 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.5.018 jammy: libgs9 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.5.018 jammy: libgs9-common 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.4.038 jammy: ghostscript 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.4.038 jammy: libgs9 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.4.038 jammy: libgs9-common 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.3.018 jammy: ghostscript 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.3.018 jammy: libgs9 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.3.018 jammy: libgs9-common 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.2.002 jammy: ghostscript 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.2.002 jammy: libgs9 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.2.002 jammy: libgs9-common 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.1.007 jammy: ghostscript 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.1.007 jammy: libgs9 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.1.007 jammy: libgs9-common 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.0.205 jammy: ghostscript 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.0.205 jammy: libgs9 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)
  6.8.0.205 jammy: libgs9-common 9.55.0~dfsg1-0ubuntu5.13 (fixed in 9.55.0~dfsg1-0ubuntu5.15)

CVEs: CVE-2026-103226, CVE-2026-101258

References:
  https://ubuntu.com/security/notices/USN-8949-1
  https://bugs.launchpad.net/bugs/2171528