Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2024-691)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-691 advisory. NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.htmlNOTE: https://cgit.ghostscript.com/cgi- bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43...

Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2024-692)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-692 advisory. Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfiapplyfilter function via a long PDF filter name. CVE-2024-29506 Artifex Ghostscript before 10.03.0 sometimes has ...

ghostscript:gs_device_pdfwrite_fuzzer: Negative-size-param in pdf_resize_resource_arrays

Detailed Report: https://oss-fuzz.com/testcase?key=5685434137509888 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicepdfwritefuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State: pdfresizeresourcearrays...

openSUSE Security Advisory (SUSE-SU-2024:2627-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : ghostscript (SUSE-SU-2024:2627-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2627-1 advisory. - CVE-2024-29508: Fixed heap pointer leak in pdfbasefontalloc bsc1227380 Tenable has extracted the...

Ghostscript Command Injection Code Execution

The vulnerability of the software for processing, transforming, and generating Ghostscript documents is related to the introduction of a specially created pipe command. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

SUSE-SU-2024:2627-1 Security update for ghostscript

This update for ghostscript fixes the following issues: - CVE-2024-29508: Fixed heap pointer leak in pdfbasefontalloc bsc1227380...

ROS-20240730-04

A vulnerability in the document processing, conversion and generation software suite Ghostscript is related to the introduction of a specially crafted pipe command. Exploitation of the vulnerability could Allow an attacker acting remotely to execute arbitrary code...

ghostscript:gs_device_psdcmyk_fuzzer: Crash in clist_fill_rectangle_hl_color

Detailed Report: https://oss-fuzz.com/testcase?key=5464627218022400 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicepsdcmykfuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x7abbc6c9aeb0 Crash State: clistfillrectanglehlcolo...

ghostscript:gs_device_bmpmono_fuzzer: Crash in ireclaim

Detailed Report: https://oss-fuzz.com/testcase?key=6292204293783552 Project: ghostscript Fuzzing Engine: libFuzzer Fuzz Target: gsdevicebmpmonofuzzer Job Type: libfuzzerasanghostscript Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x52a0001dbc98 Crash State: ireclaim interpreclaim...

Metasploit Weekly Wrap-Up 07/26/2024

New module content 3 Magento XXE Unserialize Arbitrary File Read Authors: Heyder and Sergey Temnikov Type: Auxiliary Pull request: 19304 contributed by heyder Path: gather/magentoxxecve202434102 AttackerKB reference: CVE-2024-34102 Description: This adds an auxiliary module for an XXE which resul...

[SECURITY] Fedora 39 Update: ghostscript-10.02.1-7.fc39

This package provides useful conversion utilities based on Ghostscript softwa re, for converting PS, PDF and other document formats between each other. Ghostscript is a suite of software providing an interpreter for Adobe Systems' PostScript PS and Portable Document Format PDF page description...

Tesseract File Function Unauthorized Access

The vulnerability of the software for processing, transforming, and generating Ghostscript documents is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through...

Ghostscript Heap Buffer Overflow Unauthorized Access

The vulnerability of the software for processing, transforming, and generating Ghostscript documents is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

Fedora 39 : ghostscript (2024-52192927d8)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-52192927d8 advisory. Security fix for CVE-2024-33869 ---- Security fixes for CVE-2024-29509, CVE-2024-29508, CVE-2024-29507, CVE-2024-29506 Tenable has extracted the...

[SECURITY] Fedora 40 Update: ghostscript-10.02.1-12.fc40

This package provides useful conversion utilities based on Ghostscript softwa re, for converting PS, PDF and other document formats between each other. Ghostscript is a suite of software providing an interpreter for Adobe Systems' PostScript PS and Portable Document Format PDF page description...

Fedora 40 : ghostscript (2024-053b8330a1)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-053b8330a1 advisory. Security fix for CVE-2024-33869 ---- Security fixes for CVE-2024-29509, CVE-2024-29508, CVE-2024-29507, CVE-2024-29506 Tenable has extracted the...

Amazon Linux 2 : ghostscript (ALAS-2024-2597)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2597 advisory. NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.htmlNOTE: https://cgit.ghostscript.com/cgi-...

Ghostscript Command Execution / Format String

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ghostscript Command Execution via Format String', 'Description' = %q This module exploits a format string vulnerability in Ghostscript versions...

Important: ghostscript

Issue Overview: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=3b1735085ecef20b29e8db3416ab36de93e86d1f ghostpdl-10.03.1 NOTE: https://bugs.ghostscript.com/showbug.cgi?id=707662 ADVISORIES: 'DSA-5692-1'...