The Ghostscript suite contains utilities for rendering PostScript and PDF documents by translating PostScript code into bitmap formats. Three security vulnerabilities have been fixed: CVE-2024-29510 is a format string injection vulnerability that allows shell command execution bypassing SAFER restrictions; CVE-2024-33869 is a path traversal vulnerability leading to command execution due to path reduction; and CVE-2024-33870 is a path traversal vulnerability allowing access to arbitrary files if the current directory is in permitted paths. Red Hat Product Security has released updates for Red Hat Enterprise Linux 9 and its Extended Update Support and Extended Life Cycle variants to remediate these issues. The advisory references specific bugzilla entries and provides package updates for multiple architectures. No CVSS score is provided in the advisory, but the impact is rated moderate.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary shell commands by bypassing Ghostscript's SAFER mode or by leveraging path traversal to execute commands or access arbitrary files. This could lead to unauthorized code execution and potential compromise of affected systems running vulnerable versions of Ghostscript on Red Hat Enterprise Linux 9. The advisory rates the security impact as moderate.

Red Hat has released official security updates addressing these vulnerabilities in Ghostscript for Red Hat Enterprise Linux 9 and its variants. Users should apply these updates as detailed in the Red Hat advisory RHSA-2024:6197 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.