Summary
[9.54.0-17]
- RHEL-44759 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths
- RHEL-44745 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction
- RHEL-44731 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | ghostscript | 0:9.54.0-17.el9_4 |
| Oracle Linux · 9 | ghostscript-doc | 0:9.54.0-17.el9_4 |
| Oracle Linux · 9 | ghostscript-tools-dvipdf | 0:9.54.0-17.el9_4 |
| Oracle Linux · 9 | ghostscript-tools-fonts | 0:9.54.0-17.el9_4 |
| Oracle Linux · 9 | ghostscript-tools-printing | 0:9.54.0-17.el9_4 |
| Oracle Linux · 9 | ghostscript-x11 | 0:9.54.0-17.el9_4 |
| Oracle Linux · 9 | libgs | 0:9.54.0-17.el9_4 |
| Oracle Linux · 9 | libgs-devel | 0:9.54.0-17.el9_4 |
Vulnerabilities 3
-
Medium 6.3
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with…
-
Medium 6.3
An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript docume…
-
Medium 5.3
An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a cr…