Important: ghostscript security update
Summary
RLSA-2024:3999: Important: ghostscript security update. Affects ghostscript versions < 0:9.54.0-16.el9_4. Fixed in 0:9.54.0-16.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It provides the capability to translate PostScript code into common bitmap formats for display or printing purposes. The Ghostscript package is vulnerable to an arbitrary code execution vulnerability through the OPVP device via a custom Driver library.
Vulnerability Detail
The vulnerability identified in Ghostscript allows an attacker to execute arbitrary code by exploiting the OPVP device through a custom Driver library. This can lead to unauthorized access, data manipulation, or system compromise. The impact of this vulnerability can be severe, potentially resulting in the execution of malicious code on the affected system.
How To Fix
Minimum fixed version
0:9.54.0-16.el9_4
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The Ghostscript package is vulnerable to an arbitrary code execution vulnerability through the OPVP device via a custom Driver library. Users are advised to update their installations to the latest version to mitigate the risk of unauthorized code execution and ensure the security of their systems.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code into common bitmap formats for display or printing purposes.
The vulnerability allows an attacker to execute arbitrary code, potentially leading to unauthorized access, data manipulation, or system compromise.
To fix this vulnerability, update the Ghostscript package to version 9.54.0-16.el9_4 or later.
No workaround has been provided for this vulnerability.
For more details about this vulnerability, refer to the CVE page listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
