USN-8949-1: Ubuntu patches Ghostscript sandbox bypass

Canonical published security advisory USN-8949-1 on 21 October 2026 for Ghostscript, the PostScript and PDF interpreter present by default on most Linux servers. The update affects all currently supported Ubuntu releases, from 16.04 LTS to 26.10.\n\n## Vulnerabilities corrected\n\nWhen Ghostscript renders a specially crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process (CVE-2026-101258). The second vulnerability, CVE-2026-103226, is a stack-based buffer overflow in pdfwrite via specially crafted font data. The official advisory also reports a third operand validation issue in font loading, without an assigned CVE number, discovered by Paulos Yibelo.\n\n## Why this matters for hosting providers\n\nGhostscript is not merely a command-line tool for converting files: when generating a PDF preview, WordPress can use the PHP Imagick extension to call ImageMagick, which in turn invokes Ghostscript. Any site with PDF uploads open to users (forms, media library, document management plugins) passes those files through this interpreter. In August 2026, a similar vulnerability (CVE-2026-39919) had already emerged, exploitable through PDF uploads on WordPress, affecting any online system running Ghostscript 9.21 through 10.07.1: a reminder that the package should be kept updated even when never invoked directly from the terminal.\n\n## Corrected versions\n\n| Release | Package | Version |\n|---|---|---|\n| 26.10 | libgs10 / libgs10-common | 10.07.1dfsg-1ubuntu2.1 |\n| 26.04 LTS | libgs10 / libgs10-common | 10.06.0dfsg-3ubuntu1.2 |\n| 24.04 LTS | libgs10 / libgs10-common | 10.02.1dfsg1-0ubuntu7.10 |\n| 22.04 LTS | libgs9 / libgs9-common | 9.55.0dfsg1-0ubuntu5.15 |\n| 20.04 LTS (ESM) | libgs9 / libgs9-common | 9.50dfsg-5ubuntu4.15+esm3 |\n| 18.04 LTS (ESM) | libgs9 / libgs9-common | 9.26dfsg+0-0ubuntu0.18.04.18+esm6 |\n| 16.04 LTS (ESM) | libgs9 / libgs9-common | 9.26~dfsg+0-0ubuntu0.16.04.14+esm11 |\n\nFor releases 20.04, 18.04 and 16.04, the fix requires an Ubuntu Pro subscription. On all others, a standard apt update && apt upgrade suffices. Anyone managing servers with automatic PDF preview generation (WordPress, DMS, document galleries) should apply the patch without waiting for the next maintenance cycle."