Moderate: ghostscript security update
Summary
ALSA-2024:6197: Moderate: ghostscript security update. Affects ghostscript versions < 9.54.0-17.el9_4. Fixed in 9.54.0-17.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats for display or printing purposes.
Vulnerability Detail
This vulnerability allows for format string injection, which can lead to shell command execution by bypassing the SAFER mechanism. Additionally, it enables path traversal and command execution due to path reduction. If the current directory is in the permitted paths, it allows for path traversal to arbitrary files.
How To Fix
Minimum fixed version
9.54.0-17.el9_4
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, this vulnerability in Ghostscript allows for format string injection, path traversal, and command execution. It is recommended to update to the latest version of Ghostscript to mitigate the risk.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of utilities for rendering PostScript and PDF documents.
Format string injection is a vulnerability that occurs when user input is directly included in a format string function without proper sanitization, allowing an attacker to execute arbitrary code.
Path traversal is a technique used by attackers to access files and directories outside of the intended directory structure.
The SAFER mechanism is a security feature in Ghostscript that restricts the execution of certain operations to prevent malicious code execution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your version of Ghostscript is affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
