Critical Vulnerabilities in Ghostscript Package: Security Update Required
Summary
RLSA-2025:4362: Moderate: ghostscript security update. Affects ghostscript versions < 0:9.27-16.el8_10. Fixed in 0:9.27-16.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of software that provides utilities for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats for display and printing. The package is widely used in various applications for document processing, making it essential for users to ensure its security and integrity.
Vulnerability Detail
The Ghostscript package has multiple vulnerabilities that could lead to severe security risks. These include a heap buffer overwrite vulnerability (CVE-2020-27792), a dangling pointer issue (CVE-2023-46751), and several critical vulnerabilities that could allow arbitrary code execution, buffer overflows, and directory traversal attacks (CVE-2024-46951, CVE-2024-46952, CVE-2024-46953, CVE-2024-46954, CVE-2024-46956). These vulnerabilities can be exploited by attackers to execute malicious code, potentially compromising the system's security.
How To Fix
Minimum fixed version
0:9.27-16.el8_10
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the Ghostscript utilities or disabling features that may expose the vulnerabilities until the package can be updated.
Conclusion
The Ghostscript package has several critical vulnerabilities that require immediate attention. Users are advised to update to the latest patched version to mitigate potential security risks. Regular monitoring and vulnerability management practices are essential to maintain software security.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of software that interprets PostScript and PDF files, allowing them to be rendered and printed.
The vulnerabilities can lead to arbitrary code execution, data breaches, and system compromise, posing significant security risks.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider implementing access restrictions or disabling vulnerable features as a temporary workaround.
The CVSS score for the vulnerabilities in Ghostscript is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
