Threats affecting pkg:rpm/ghostscript

A compression buffer overflow vulnerability (CVE-2025-27832) exists in the NPDL device component of the Ghostscript suite, which is used for rendering PostScript and PDF documents. This vulnerability has been addressed by a security update provided by Red Hat for various architectures and distributions of Red Hat Enterprise Linux 9.0. The issue is rated as moderate severity by the vendor. No known exploits are reported in the wild at this time.

Multiple vulnerabilities have been identified in the Ghostscript suite used for rendering PostScript and PDF documents. These include a format string injection vulnerability that can lead to shell command execution bypassing SAFER restrictions (CVE-2024-29510), and two path traversal vulnerabilities that can lead to command execution or arbitrary file access (CVE-2024-33869 and CVE-2024-33870). Red Hat has issued a security advisory updating Ghostscript packages in Red Hat Enterprise Linux 9.2 Extended Update Support to address these issues. The update is rated as having moderate security impact. Users of affected Red Hat Enterprise Linux 9.2 versions should apply the provided update to mitigate these vulnerabilities.

An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.

A high severity security vulnerability (CVE-2024-33871) exists in the Ghostscript suite affecting Red Hat Enterprise Linux 7 Extended Lifecycle Support. The vulnerability allows arbitrary code execution via the OPVP device through a custom Driver library. Red Hat has released an important security update in the ghostscript 9.25-5.el7_9.1 package to address this issue. No CVSS score is provided in the advisory.