diff -Nru ghostscript-9.26~dfsg+0/debian/changelog ghostscript-9.26~dfsg+0/debian/changelog
--- ghostscript-9.26~dfsg+0/debian/changelog	2018-11-28 13:58:32.000000000 +0000
+++ ghostscript-9.26~dfsg+0/debian/changelog	2018-12-06 16:35:16.000000000 +0000
@@ -1,3 +1,12 @@
+ghostscript (9.26~dfsg+0-0ubuntu0.14.04.3) trusty-security; urgency=medium
+
+  * SECURITY REGRESSION: multiple regressions (LP: #1806517)
+    - debian/patches/020181126-96c381c*.patch: fix duplex issue.
+    - debian/patches/020181205-fae21f16*.patch: fix -dFirstPage and
+      -dLastPage issue.
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 06 Dec 2018 07:18:19 -0500
+
 ghostscript (9.26~dfsg+0-0ubuntu0.14.04.1) trusty-security; urgency=medium
 
   * SECURITY UPDATE: Updated to 9.26 to fix multiple security issues
diff -Nru ghostscript-9.26~dfsg+0/debian/patches/020181126-96c381c-ps2write-move-the-page-level-save-restore-wrapper.patch ghostscript-9.26~dfsg+0/debian/patches/020181126-96c381c-ps2write-move-the-page-level-save-restore-wrapper.patch
--- ghostscript-9.26~dfsg+0/debian/patches/020181126-96c381c-ps2write-move-the-page-level-save-restore-wrapper.patch	1970-01-01 00:00:00.000000000 +0000
+++ ghostscript-9.26~dfsg+0/debian/patches/020181126-96c381c-ps2write-move-the-page-level-save-restore-wrapper.patch	2018-12-06 12:18:14.000000000 +0000
@@ -0,0 +1,39 @@
+Description: ps2write - move the page level save/restore wrapper
+Author: Ken Sharp <ken.sharp@artifex.com>
+Last-Update: 2018-11-26
+Bug: https://bugs.ghostscript.com/show_bug.cgi?id=700232
+
+--- a/devices/vector/gdevpdf.c
++++ b/devices/vector/gdevpdf.c
+@@ -2907,12 +2907,10 @@
+                     pdf_write_page(pdev, pagecount++);
+ 
+                     stream_puts(pdev->strm, "%%EndPageSetup\n");
+-                    stream_puts(pdev->strm, "/pagesave save def\n");
+                     pprintld1(pdev->strm, "%ld 0 obj\n", pres->object->id);
+                     code = cos_write(pres->object, pdev, pres->object->id);
+                     stream_puts(pdev->strm, "endobj\n");
+                     pres->object->written = true;
+-                    stream_puts(pdev->strm, "pagesave restore\n%%PageTrailer\n");
+                 }
+         }
+         code1 = pdf_free_resource_objects(pdev, resourcePage);
+--- a/devices/vector/opdfread.ps
++++ b/devices/vector/opdfread.ps
+@@ -748,6 +748,7 @@
+       } repeat
+     } if
+     EPS2Write not {showpage} if
++    pagesave restore
+   } if
+ } bind def
+ 
+@@ -999,6 +1000,8 @@
+   dup /ImmediateExec true put
+   dup /IsPage true put
+   SetPageSize {dup /Context get //SetupPageView exec} if
++  % This gets restored at the end of ExecuteStream if IsPage is true.
++  /pagesave save def
+ } bind def
+ 
+ /FontFileDaemon % <id> <obj> <font_descriptor> FontFileDaemon <id> <obj>
diff -Nru ghostscript-9.26~dfsg+0/debian/patches/020181205-fae21f16-subclassing-devices-fix-put-image-method.patch ghostscript-9.26~dfsg+0/debian/patches/020181205-fae21f16-subclassing-devices-fix-put-image-method.patch
--- ghostscript-9.26~dfsg+0/debian/patches/020181205-fae21f16-subclassing-devices-fix-put-image-method.patch	1970-01-01 00:00:00.000000000 +0000
+++ ghostscript-9.26~dfsg+0/debian/patches/020181205-fae21f16-subclassing-devices-fix-put-image-method.patch	2018-12-06 16:34:57.000000000 +0000
@@ -0,0 +1,20 @@
+Description: subclassing devices - fix put_image method
+Author: Ken Sharp <ken.sharp@artifex.com>
+Last-Update: 2018-12-04
+Bug: https://bugs.ghostscript.com/show_bug.cgi?id=700315
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1806517
+
+--- a/base/gdevsclass.c
++++ b/base/gdevsclass.c
+@@ -797,7 +797,10 @@
+             int alpha_plane_index, int tag_plane_index)
+ {
+     if (dev->child)
+-        return dev_proc(dev->child, put_image)(dev->child, mdev, buffers, num_chan, x, y, width, height, row_stride, alpha_plane_index, tag_plane_index);
++        if (dev == mdev)
++            return dev_proc(dev->child, put_image)(dev->child, dev->child, buffers, num_chan, x, y, width, height, row_stride, alpha_plane_index, tag_plane_index);
++        else
++            return dev_proc(dev->child, put_image)(dev->child, mdev, buffers, num_chan, x, y, width, height, row_stride, alpha_plane_index, tag_plane_index);
+ 
+     return 0;
+ }
diff -Nru ghostscript-9.26~dfsg+0/debian/patches/series ghostscript-9.26~dfsg+0/debian/patches/series
--- ghostscript-9.26~dfsg+0/debian/patches/series	2018-11-28 13:37:02.000000000 +0000
+++ ghostscript-9.26~dfsg+0/debian/patches/series	2018-12-06 16:34:57.000000000 +0000
@@ -7,3 +7,5 @@
 2007_suggest_install_ghostscript-doc_in_code.patch
 2008_mention_ghostscript-x_in_docs.patch
 2010_add_build_timestamp_setting.patch
+020181126-96c381c-ps2write-move-the-page-level-save-restore-wrapper.patch
+020181205-fae21f16-subclassing-devices-fix-put-image-method.patch