Most recent entries from all

ALSA-2024:6197 — Moderate: ghostscript security update

Affected: AlmaLinux:9: ghostscript, AlmaLinux:9: ghostscript-doc, AlmaLinux:9: ghostscript-tools-dvipdf, AlmaLinux:9: ghostscript-tools-fonts, AlmaLinux:9: ghostscript-tools-printing, AlmaLinux:9: ghostscript-x11, AlmaLinux:9: libgs, AlmaLinux:9: libgs-devel

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

* ghostscript: format string injection leads to shell command execution (SAFER bypass) (CVE-2024-29510) * ghostscript: path traversal and command execution due to path reduction (CVE-2024-33869) * ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths (CVE-2024-33870)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-05063

BELL-CVE-2024-33870

Affected: Alpaquita:23: ghostscript, Alpaquita:stream: ghostscript

EUVD-2026-200087

fkie_cve-2024-33870

An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted.

GHSA-3xr3-vrm2-6jc7

gsd-2024-33870

OESA-2024-2176 — ghostscript security update

Affected: openEuler:22.03-LTS-SP3: ghostscript

Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library. Security Fix(es): An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard.(CVE-2023-52722) An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.(CVE-2024-33869) An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted.(CVE-2024-33870)

openSUSE-SU-2024:14090-1 — ghostscript-10.03.1-1.1 on GA media

ghostscript-10.03.1-1.1 on GA media

RHSA-2024:6466 — Red Hat Security Advisory: ghostscript security update

ghostscript: format string injection leads to shell command execution (SAFER bypass) ghostscript: path traversal and command execution due to path reduction ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths

SUSE-SU-2024:2276-1 — Security update for ghostscript

Security update for ghostscript

UBUNTU-CVE-2024-33870

Affected: Ubuntu:20.04:LTS: ghostscript, Ubuntu:22.04:LTS: ghostscript, Ubuntu:24.04:LTS: ghostscript

WID-SEC-W-2024-1444 — Ghostscript: Mehrere Schwachstellen

Ein entfernter anonymer oder ein lokaler Angreifer kann mehrere Schwachstellen in Ghostscript ausnutzen, um Informationen offenzulegen oder beliebigen Code auszuführen.