Medium ALAS2023-2024-691 2 CVEs

Moderate: ghostscript security update (Amazon Linux 2023)

Published Aug 1, 2024 · Updated Aug 6, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-33870: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=79aef19c685984dc3da2dc090450407d9fbcff80 (ghostpdl-10.03.1) NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707686 ADVISORIES: ['DSA-5692-1'] CVE-2024-33869: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43 (ghostpdl-10.03.1) NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f5336e5b4154f515ac83bc5b9eba94302e6618d4 (ghostpdl-10.03.1) NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=707691 ADVISORIES: ['DSA-5692-1']

Fixed packages 14

Release	Package	Fixed in
Amazon Linux · 2023	ghostscript	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-debuginfo	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-debugsource	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-doc	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-gtk	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-gtk-debuginfo	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-tools-dvipdf	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-tools-fonts	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-tools-printing	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-x11	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	ghostscript-x11-debuginfo	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	libgs	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	libgs-debuginfo	0:9.56.1-7.amzn2023.0.10
Amazon Linux · 2023	libgs-devel	0:9.56.1-7.amzn2023.0.10

Vulnerabilities 2

Medium 6.3

CVE-2024-33870

An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript docume…

ghostscript ghostscript ghostscript ghostscript Debian Ubuntu Alpine Wolfi

Jul 3, 2024
Medium 5.3

CVE-2024-33869

An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a cr…

ghostscript ghostscript ghostscript ghostscript Debian Ubuntu Alpine Wolfi

Jul 3, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-33869.html
web
https://alas.aws.amazon.com/cve/html/CVE-2024-33870.html