{"id":"USN-6835-1","summary":"ghostscript vulnerabilities","details":"It was discovered that Ghostscript did not properly restrict eexec\nseeds to those specified by the Type 1 Font Format standard when\nSAFER mode is used. An attacker could use this issue to bypass SAFER\nrestrictions and cause unspecified impact. (CVE-2023-52722)\nThis issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10.\n\nThomas Rinsma discovered that Ghostscript did not prevent changes to\nuniprint device argument strings after SAFER is activated, resulting\nin a format-string vulnerability. An attacker could possibly use this\nto execute arbitrary code. (CVE-2024-29510)\n\nZdenek Hutyra discovered that Ghostscript did not properly perform\npath reduction when validating paths. An attacker could use this to\naccess file locations outside of those allowed by SAFER policy and\npossibly execute arbitrary code. (CVE-2024-33869)\n\nZdenek Hutyra discovered that Ghostscript did not properly check\narguments when reducing paths. An attacker could use this to\naccess file locations outside of those allowed by SAFER policy.\n(CVE-2024-33870)\n\nZdenek Hutyra discovered that the \"Driver\" parameter for Ghostscript's\n\"opvp\"/\"oprp\" device allowed specifying the name of an arbitrary dynamic\nlibrary to load. An attacker could use this to execute arbitrary code.\n(CVE-2024-33871)\n","modified":"2026-02-10T04:44:20Z","published":"2024-06-17T17:35:07Z","related":["UBUNTU-CVE-2023-52722","UBUNTU-CVE-2024-29510","UBUNTU-CVE-2024-33869","UBUNTU-CVE-2024-33870","UBUNTU-CVE-2024-33871"],"upstream":["CVE-2023-52722","CVE-2024-29510","CVE-2024-33869","CVE-2024-33870","CVE-2024-33871","UBUNTU-CVE-2023-52722","UBUNTU-CVE-2024-29510","UBUNTU-CVE-2024-33869","UBUNTU-CVE-2024-33870","UBUNTU-CVE-2024-33871"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6835-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-52722"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-29510"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-33869"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-33870"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-33871"}],"affected":[{"package":{"name":"ghostscript","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/ghostscript@9.50~dfsg-5ubuntu4.12?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.50~dfsg-5ubuntu4.12"}]}],"versions":["9.27~dfsg+0-0ubuntu3","9.27~dfsg+0-0ubuntu4","9.50~dfsg-5ubuntu1","9.50~dfsg-5ubuntu2","9.50~dfsg-5ubuntu3","9.50~dfsg-5ubuntu4","9.50~dfsg-5ubuntu4.1","9.50~dfsg-5ubuntu4.2","9.50~dfsg-5ubuntu4.3","9.50~dfsg-5ubuntu4.4","9.50~dfsg-5ubuntu4.5","9.50~dfsg-5ubuntu4.6","9.50~dfsg-5ubuntu4.7","9.50~dfsg-5ubuntu4.8","9.50~dfsg-5ubuntu4.9","9.50~dfsg-5ubuntu4.10","9.50~dfsg-5ubuntu4.11"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"9.50~dfsg-5ubuntu4.12","binary_name":"ghostscript"},{"binary_version":"9.50~dfsg-5ubuntu4.12","binary_name":"ghostscript-x"},{"binary_version":"9.50~dfsg-5ubuntu4.12","binary_name":"libgs-dev"},{"binary_version":"9.50~dfsg-5ubuntu4.12","binary_name":"libgs9"},{"binary_version":"9.50~dfsg-5ubuntu4.12","binary_name":"libgs9-common"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:20.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2023-52722"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-29510"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-33869"},{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-33870"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-33871"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6835-1.json"}},{"package":{"name":"ghostscript","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/ghostscript@9.55.0~dfsg1-0ubuntu5.7?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.55.0~dfsg1-0ubuntu5.7"}]}],"versions":["9.54.0~dfsg1-0ubuntu2","9.55.0~dfsg1-0ubuntu4","9.55.0~dfsg1-0ubuntu5","9.55.0~dfsg1-0ubuntu5.1","9.55.0~dfsg1-0ubuntu5.2","9.55.0~dfsg1-0ubuntu5.3","9.55.0~dfsg1-0ubuntu5.4","9.55.0~dfsg1-0ubuntu5.5","9.55.0~dfsg1-0ubuntu5.6"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"9.55.0~dfsg1-0ubuntu5.7","binary_name":"ghostscript"},{"binary_version":"9.55.0~dfsg1-0ubuntu5.7","binary_name":"ghostscript-x"},{"binary_version":"9.55.0~dfsg1-0ubuntu5.7","binary_name":"libgs-dev"},{"binary_version":"9.55.0~dfsg1-0ubuntu5.7","binary_name":"libgs9"},{"binary_version":"9.55.0~dfsg1-0ubuntu5.7","binary_name":"libgs9-common"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2023-52722"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-29510"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-33869"},{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-33870"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-33871"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6835-1.json"}},{"package":{"name":"ghostscript","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/ghostscript@10.02.1~dfsg1-0ubuntu7.1?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.1~dfsg1-0ubuntu7.1"}]}],"versions":["10.01.2~dfsg1-0ubuntu2","10.01.2~dfsg1-0ubuntu2.1","10.02.1~dfsg1-0ubuntu1","10.02.1~dfsg1-0ubuntu2","10.02.1~dfsg1-0ubuntu5","10.02.1~dfsg1-0ubuntu6","10.02.1~dfsg1-0ubuntu7"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"10.02.1~dfsg1-0ubuntu7.1","binary_name":"ghostscript"},{"binary_version":"10.02.1~dfsg1-0ubuntu7.1","binary_name":"libgs-common"},{"binary_version":"10.02.1~dfsg1-0ubuntu7.1","binary_name":"libgs-dev"},{"binary_version":"10.02.1~dfsg1-0ubuntu7.1","binary_name":"libgs10"},{"binary_version":"10.02.1~dfsg1-0ubuntu7.1","binary_name":"libgs10-common"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:24.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-29510"},{"severity":[{"score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-33869"},{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-33870"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2024-33871"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6835-1.json"}}],"schema_version":"1.7.3"}