ALSA-2024:4000 - Ghostscript Security Update
Summary
ALSA-2024:4000: Important: ghostscript security update. Affects ghostscript versions < 9.27-13.el8_10. Fixed in 9.27-13.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats for display or printing purposes.
Vulnerability Detail
The vulnerability (CVE-2024-33871) in Ghostscript's OPVP device allows for arbitrary code execution through a custom Driver library. This can have severe consequences, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Minimum fixed version
9.27-13.el8_10
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. Updating to the fixed version is the recommended solution.
Conclusion
The Ghostscript suite contains a vulnerability (CVE-2024-33871) that allows for arbitrary code execution. It is crucial to update the affected packages to version 9.27-13.el8_10 or later to mitigate this issue. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents.
The vulnerability allows for arbitrary code execution, which can lead to unauthorized access, data breaches, or system compromise.
To fix this vulnerability, update the affected packages to version 9.27-13.el8_10 or later.
No specific workaround has been provided. Updating to the fixed version is recommended.
For more details about this vulnerability, including the impact and CVSS score, refer to the CVE page listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
