High ALAS2-2024-2597 1 CVE

Important: ghostscript security update (Amazon Linux 2)

Published Jul 18, 2024 · Updated Jul 22, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-29510: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=3b1735085ecef20b29e8db3416ab36de93e86d1f (ghostpdl-10.03.1) NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707662 ADVISORIES: ['DSA-5692-1']

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2	ghostscript	0:9.54.0-9.amzn2.0.4
Amazon Linux · 2	ghostscript-cups	0:9.54.0-9.amzn2.0.4
Amazon Linux · 2	ghostscript-debuginfo	0:9.54.0-9.amzn2.0.4
Amazon Linux · 2	ghostscript-doc	0:9.54.0-9.amzn2.0.4
Amazon Linux · 2	ghostscript-gtk	0:9.54.0-9.amzn2.0.4
Amazon Linux · 2	libgs	0:9.54.0-9.amzn2.0.4
Amazon Linux · 2	libgs-devel	0:9.54.0-9.amzn2.0.4

Vulnerabilities 1

Medium 6.3

CVE-2024-29510 Public exploit EPSS 28%

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with…

ghostscript ghostscript ghostscript ghostscript Debian Ubuntu Alpine Wolfi

Jul 3, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-29510.html