An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ghostscript-tools-printingUpgrade ghostscript-tools-fontsUpgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-docUpgrade libgs-devel | Jun 21, 2024 | Jun 20, 2024 |
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Jul 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ghostscript-gtkUpgrade ghostscript-debuginfoUpgrade ghostscript-cupsUpgrade ghostscript-docUpgrade ghostscriptUpgrade libgs-develUpgrade libgs | Jun 13, 2024 | Jun 13, 2024 |
| Amazon_linux_2023 | — | Upgrade ghostscript-debugsourceUpgrade libgs-develUpgrade ghostscript-gtkUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-docUpgrade ghostscript-x11Upgrade ghostscript-gtk-debuginfoUpgrade ghostscriptUpgrade libgsUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-fontsUpgrade ghostscript-debuginfoUpgrade ghostscript-tools-dvipdfUpgrade libgs-debuginfo | Feb 17, 2025 | May 2, 2024 |
| Debian | — | Upgrade ghostscript | May 17, 2024 | May 17, 2024 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 23, 2024 | Jul 3, 2024 |
| Ghostscript | — | Upgrade to Ghostscript version 10.03.1 | Nov 19, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscript-helpUpgrade ghostscript | Jan 14, 2025 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscript-helpUpgrade ghostscript | Jan 15, 2025 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade ghostscript-x11Upgrade libgs-develUpgrade ghostscript-docUpgrade ghostscript-tools-dvipdfUpgrade ghostscriptUpgrade ghostscript-cupsUpgrade libgsUpgrade ghostscript-gtkUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-fonts | Jul 22, 2024 | May 2, 2024 |
| Redhat_linux | — | Upgrade ghostscript-tools-dvipdfNo solution existsUpgrade ghostscriptUpgrade libgs-develUpgrade ghostscript-x11Upgrade libgsUpgrade ghostscript-tools-printingUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-gtkUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-cupsUpgrade ghostscript-debuginfoUpgrade ghostscript-tools-fontsUpgrade libgs-debuginfoUpgrade ghostscript-debugsourceUpgrade ghostscript-doc | Jun 21, 2024 | May 2, 2024 |
| Rocky_linux | — | Upgrade libgsUpgrade libgs-develUpgrade ghostscript-tools-fontsUpgrade ghostscript-x11Upgrade libgs-debuginfoUpgrade ghostscript-debuginfoUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-tools-printingUpgrade ghostscriptUpgrade ghostscript-debugsourceUpgrade ghostscript-x11-debuginfo | Jul 3, 2024 | Jul 2, 2024 |
| Suse | — | Upgrade ghostscript-develUpgrade ghostscript-x11Upgrade ghostscript | Jun 26, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade libgs9-commonUpgrade libgs10-commonUpgrade ghostscript-docUpgrade libgs10Upgrade libgs-devUpgrade libgs9Upgrade ghostscriptUpgrade libgs-commonUpgrade ghostscript-x | Jun 21, 2024 | Jun 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub