An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libgs-develUpgrade ghostscript-docUpgrade libgsUpgrade ghostscript-x11Upgrade ghostscript-tools-dvipdfUpgrade ghostscriptUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-fonts | Jun 21, 2024 | Jun 20, 2024 |
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Jul 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ghostscriptUpgrade libgsUpgrade libgs-develUpgrade ghostscript-cupsUpgrade ghostscript-docUpgrade ghostscript-gtkUpgrade ghostscript-debuginfo | Jun 13, 2024 | Jun 13, 2024 |
| Amazon_linux_2023 | — | Upgrade ghostscript-tools-fontsUpgrade ghostscript-debuginfoUpgrade libgsUpgrade ghostscript-tools-printingUpgrade libgs-debuginfoUpgrade ghostscript-tools-dvipdfUpgrade libgs-develUpgrade ghostscript-x11Upgrade ghostscript-debugsourceUpgrade ghostscript-gtk-debuginfoUpgrade ghostscriptUpgrade ghostscript-docUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-gtk | Feb 17, 2025 | May 2, 2024 |
| Debian | — | Upgrade ghostscript | May 17, 2024 | May 17, 2024 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 23, 2024 | Jul 3, 2024 |
| Ghostscript | — | Upgrade to Ghostscript version 10.03.1 | Nov 19, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscript-helpUpgrade ghostscript | Jan 14, 2025 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscript-helpUpgrade ghostscript | Jan 15, 2025 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade ghostscript-tools-fontsUpgrade libgsUpgrade ghostscript-gtkUpgrade ghostscript-tools-printingUpgrade ghostscript-cupsUpgrade ghostscript-x11Upgrade ghostscriptUpgrade libgs-develUpgrade ghostscript-docUpgrade ghostscript-tools-dvipdf | Jul 22, 2024 | May 2, 2024 |
| Redhat_linux | — | Upgrade ghostscript-debuginfoUpgrade ghostscript-debugsourceUpgrade ghostscript-tools-printingUpgrade ghostscript-cupsUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-gtkUpgrade ghostscript-tools-fontsUpgrade ghostscript-docUpgrade libgs-debuginfoNo solution existsUpgrade libgsUpgrade ghostscriptUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-x11Upgrade libgs-devel | Jun 21, 2024 | May 2, 2024 |
| Rocky_linux | — | Upgrade ghostscript-x11-debuginfoUpgrade ghostscript-tools-printingUpgrade ghostscript-debugsourceUpgrade ghostscriptUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-tools-fontsUpgrade libgsUpgrade libgs-debuginfoUpgrade ghostscript-debuginfoUpgrade libgs-develUpgrade ghostscript-x11 | Jul 3, 2024 | Jul 2, 2024 |
| Suse | — | Upgrade ghostscript-x11Upgrade ghostscriptUpgrade ghostscript-devel | Jun 26, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade ghostscript-docUpgrade libgs-devUpgrade libgs10Upgrade libgs10-commonUpgrade libgs9-commonUpgrade ghostscriptUpgrade ghostscript-xUpgrade libgs9Upgrade libgs-common | Jun 21, 2024 | Jun 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub