ALSA-2024:3999 - Important: ghostscript security update
Summary
ALSA-2024:3999: Important: ghostscript security update. Affects ghostscript versions < 9.54.0-16.el9_4. Fixed in 9.54.0-16.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats for display or printing purposes. The vulnerability affects the Ghostscript package in AlmaLinux 9. Ghostscript versions prior to 9.54.0-16.el9_4 are impacted.
Vulnerability Detail
The vulnerability in Ghostscript, identified as CVE-2024-33871, allows for arbitrary code execution via a custom Driver library. This means that an attacker could exploit this vulnerability to execute malicious code on a system running an affected version of Ghostscript. The impact of this vulnerability can be severe, potentially leading to unauthorized access, data breaches, or system compromise.
How To Fix
Minimum fixed version
9.54.0-16.el9_4
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the security update as soon as possible to protect the system from potential exploitation.
Conclusion
The vulnerability in Ghostscript can lead to arbitrary code execution and potential system compromise. It is highly recommended to update the Ghostscript package to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats for display or printing purposes.
The vulnerability allows for arbitrary code execution, which can lead to unauthorized access, data breaches, or system compromise.
To fix this vulnerability, update the Ghostscript package to version 9.54.0-16.el9_4 or later using the package manager of AlmaLinux 9.
There is no known workaround for this vulnerability. It is crucial to apply the security update as soon as possible.
You can find more information about this vulnerability, including the CVE page, in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
