CLSA-2026-1787916987 Fix CVE(s): CVE-2024-33871, CVE-2024-46951, CVE-2024-46953, CVE-2024-46956

SECURITY UPDATE: arbitrary code execution via the opvp Driver parameter - debian/patches/CVE-2024-33871.patch: refuse a Driver change once LockSafetyParams is set, and report the Driver length without the trailing NUL, in contrib/opvp/gdevopvp.c. - CVE-2024-33871 SECURITY UPDATE: unchecked...

ghostscript: OPVP device arbitrary code execution via custom Driver library

A flaw was found in Ghostscript. The "Driver" parameter for the "opvp"/"oprp" device specifies the name of a dynamic library and allows any library to be loaded. This flaw allows a malicious user to send a specially crafted document that, when processed by Ghostscript, could potentially lead to...

PT-2024-4560

Name of the Vulnerable Software and Affected Versions: Ghostscript versions prior to 10.03.1 Description: The issue exists due to insufficient input validation in the contrib/opvp/gdevopvp.c component of the Ghostscript interpreter. This can be exploited by a remote attacker using a specially...

MDKA-2005:045 : ghostscript

New ghostscript packages are now available that provide ghostscript 8.15.1 final and provide a number of bug fixes, including: A fix for vertical japanese text. A memory overflow in the 'lips4' driver was fixed. A double-free in gsdevice.c was fixed. A SEGV in the 'inferno' driver was fixed; this...