Threat Intelligence Database

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple vulnerabilities have been identified in the Ghostscript suite used for rendering PostScript and PDF documents. These include a format string injection vulnerability that can lead to shell command execution bypassing SAFER restrictions (CVE-2024-29510), and two path traversal vulnerabilities that can lead to command execution or arbitrary file access (CVE-2024-33869 and CVE-2024-33870). Red Hat has issued a security advisory updating Ghostscript packages in Red Hat Enterprise Linux 9.2 Extended Update Support to address these issues. The update is rated as having moderate security impact. Users of affected Red Hat Enterprise Linux 9.2 versions should apply the provided update to mitigate these vulnerabilities.

Multiple security vulnerabilities have been identified in the Ghostscript suite used for rendering PostScript and PDF documents. These include a format string injection vulnerability that can lead to shell command execution bypassing SAFER restrictions (CVE-2024-29510), and two path traversal vulnerabilities that can lead to command execution or arbitrary file access (CVE-2024-33869 and CVE-2024-33870). Red Hat has issued a security advisory with updates for Red Hat Enterprise Linux 9 and related variants to address these issues. The update is rated as having a moderate security impact. Users of affected Red Hat Enterprise Linux 9 versions are advised to apply the provided updates to mitigate these vulnerabilities.

A security vulnerability (CVE-2024-33871) in the Ghostscript suite affects Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issue involves arbitrary code execution via the OPVP device through a custom Driver library. Red Hat has released an important security update to address this vulnerability in Ghostscript 9.25-5.el7_9.1 packages. The vulnerability is rated as high severity by Red Hat Product Security. No CVSS score is provided in the advisory.

An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2024-33869