An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libgsUpgrade ghostscriptUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-docUpgrade ghostscript-x11Upgrade libgs-develUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-fonts | Jun 21, 2024 | Jun 20, 2024 |
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Jul 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ghostscript-cupsUpgrade ghostscript-gtkUpgrade ghostscript-docUpgrade ghostscript-debuginfoUpgrade ghostscriptUpgrade libgsUpgrade libgs-devel | Jun 13, 2024 | Jun 13, 2024 |
| Amazon_linux_2023 | — | Upgrade libgs-develUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-x11Upgrade ghostscriptUpgrade ghostscript-gtkUpgrade ghostscript-docUpgrade ghostscript-debugsourceUpgrade libgs-debuginfoUpgrade ghostscript-tools-printingUpgrade libgsUpgrade ghostscript-tools-fontsUpgrade ghostscript-debuginfoUpgrade ghostscript-tools-dvipdf | Feb 17, 2025 | May 2, 2024 |
| Debian | — | Upgrade ghostscript | May 17, 2024 | May 17, 2024 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 23, 2024 | Jul 3, 2024 |
| Ghostscript | — | Upgrade to Ghostscript version 10.03.1 | Nov 19, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscriptUpgrade ghostscript-help | Jan 14, 2025 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscriptUpgrade ghostscript-help | Jan 15, 2025 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade ghostscript-cupsUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printingUpgrade libgsUpgrade ghostscript-gtkUpgrade ghostscript-x11Upgrade libgs-develUpgrade ghostscriptUpgrade ghostscript-docUpgrade ghostscript-tools-dvipdf | Jul 22, 2024 | May 2, 2024 |
| Redhat_linux | — | Upgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-tools-dvipdfUpgrade libgsNo solution existsUpgrade libgs-develUpgrade ghostscript-x11-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-cupsUpgrade ghostscript-tools-printingUpgrade ghostscript-docUpgrade ghostscript-tools-fontsUpgrade ghostscript-gtkUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-debuginfoUpgrade ghostscript-debugsource | Jun 21, 2024 | May 2, 2024 |
| Rocky_linux | — | Upgrade libgs-debuginfoUpgrade libgs-develUpgrade ghostscript-x11Upgrade ghostscript-tools-dvipdfUpgrade libgsUpgrade ghostscript-debuginfoUpgrade ghostscript-tools-fontsUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-debugsourceUpgrade ghostscriptUpgrade ghostscript-tools-printing | Jul 3, 2024 | Jul 2, 2024 |
| Suse | — | Upgrade ghostscript-develUpgrade ghostscript-x11Upgrade ghostscript | Jun 26, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade libgs-commonUpgrade libgs9Upgrade ghostscript-xUpgrade ghostscriptUpgrade libgs-devUpgrade ghostscript-docUpgrade libgs9-commonUpgrade libgs10-commonUpgrade libgs10 | Jun 21, 2024 | Jun 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub