This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Ghostscript 10.03.1 fixes 5 vulnerabilities

Ghostscript version 10.03.1 fixes multiple vulnerabilities [1].

Ghostsript - RCE (CVE-2024-33871)
CVSS 8.8 (High)

An unauthenticated remote attacker can submit a specially crafted document which, when processed by Ghostscript, may potentially lead to arbitrary code execution [2].

The vulnerability is present in product:

  • Ghostscript; <10.03.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 2. 5. 2024.

Ghostsript - arbitrary file acces (CVE-2024-33870)
CVSS 6.8 (Medium)

An unauthenticated local attacker, due to improper validation of relative paths in the 'gp_validate_path_len' function, can submit a specially crafted document which, when processed by Ghostscript, may lead to arbitrary file access [3].

The vulnerability is present in product:

  • Ghostscript; <10.03.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

More information:

The vulnerability was publicly disclosed 16. 5. 2024.

Ghostsript - (CVE-2024-29510)
CVSS 5.5 (Medium)

An unauthenticated local attacker, due to improper handling of format strings in the 'gp_fprintf' and 'gs_snprintf' functions, can submit a specially crafted document which, when processed by Ghostscript, may lead to stack data leakage and memory corruption [4].

The vulnerability is present in product:

  • Ghostscript; <10.03.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 16. 5. 2024.

Ghostsript - (CVE-2024-33869)
CVSS 5.3 (Medium)

Allows an unauthenticated local attacker to perform path traversal or execute arbitrary commands under certain circumstances [5].

The vulnerability is present in product:

  • Ghostscript; <10.03.1

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

More information:

The vulnerability was publicly disclosed 16. 5. 2024.

Ghostsript - (CVE-2023-52722)
CVSS 5.3 (Medium)

Allows an unauthenticated remote attacker to use "eexec seeds" other than the Type 1 standard, even when SAFER mode is enabled [6].

The vulnerability is present in product:

  • Ghostscript; <10.03.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 28. 4. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 1. 7. 2024.

CESNET, z.s.p.o. Logo