Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:2199-1

Опубликовано: 25 июн. 2024
Источник: suse-cvrf

Описание

Security update for ghostscript

This update for ghostscript fixes the following issues:

  • CVE-2024-33871: Prevent OPVP device arbitrary code execution via custom Driver library. (bsc#1225491)

Список пакетов

SUSE Linux Enterprise Server 12 SP5
ghostscript-9.52-23.77.1
ghostscript-devel-9.52-23.77.1
ghostscript-x11-9.52-23.77.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
ghostscript-9.52-23.77.1
ghostscript-devel-9.52-23.77.1
ghostscript-x11-9.52-23.77.1
SUSE Linux Enterprise Software Development Kit 12 SP5
ghostscript-devel-9.52-23.77.1

Ссылки

Описание

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5:ghostscript-9.52-23.77.1
SUSE Linux Enterprise Server 12 SP5:ghostscript-devel-9.52-23.77.1
SUSE Linux Enterprise Server 12 SP5:ghostscript-x11-9.52-23.77.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5:ghostscript-9.52-23.77.1
Ссылки