Arbitrary Code Execution in Artifex Ghostscript
Summary
CVE-2024-33871: An issue was discovered in Artifex Ghostscript before 10.03.1. Affects ghostscript across 2 version ranges.
< 10.04.0-r0
< 865d8905b3fdb3a0fabe3628a67bad634cf88ba9
Fixed in 10.04.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is widely used for rendering and manipulating documents in various applications. However, a vulnerability has been discovered in versions before 10.03.1 that allows arbitrary code execution. This vulnerability exists in the contrib/opvp/gdevopvp.c file and can be exploited through a crafted PostScript document. The issue arises from the ability to load a custom Driver library with an arbitrary name, leading to the execution of malicious code.
Vulnerability Detail
The vulnerability (CVE-2024-33871) in Artifex Ghostscript allows an attacker to execute arbitrary code by exploiting the custom Driver library functionality. By creating a specially crafted PostScript document, an attacker can manipulate the Driver parameter for opvp (and oprp) devices and load a dynamic library with a malicious payload. This can lead to remote code execution and potential compromise of the affected system. The vulnerability was first published on July 3, 2024, and affects versions prior to 10.03.1.
How To Fix
Minimum fixed version
10.04.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version of Artifex Ghostscript to address the issue.
Conclusion
Artifex Ghostscript versions prior to 10.03.1 are vulnerable to arbitrary code execution. This can be exploited by loading a custom Driver library with a malicious payload through a crafted PostScript document. To mitigate the risk, users should update to version 10.03.1 or later, which includes a fix for this vulnerability.
See every vulnerability recorded for ghostscript →
FAQ
Artifex Ghostscript is an open-source interpreter for the PostScript language and the PDF file format. It is commonly used for rendering and manipulating documents in various applications.
This vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to remote code execution and compromise of the system.
To fix this vulnerability, it is recommended to update Artifex Ghostscript to version 10.03.1 or later, which includes a fix for the arbitrary code execution issue.
There is no known workaround for this vulnerability. It is crucial to update to the patched version of Artifex Ghostscript to address the issue.
You can find more information about this vulnerability in the CVE-2024-33871 entry on the Vulert vulnerability database.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
