| Name | CVE-2024-33871 |
| Description | An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-5692-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| ghostscript (PTS) | bullseye (security), bullseye | 9.53.3~dfsg-7+deb11u7 | fixed |
| bookworm, bookworm (security) | 10.0.0~dfsg-11+deb12u4 | fixed | |
| trixie | 10.03.1~dfsg-1 | fixed | |
| sid | 10.03.1~dfsg-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| ghostscript | source | bullseye | 9.53.3~dfsg-7+deb11u7 | DSA-5692-1 | ||
| ghostscript | source | bookworm | 10.0.0~dfsg-11+deb12u4 | DSA-5692-1 | ||
| ghostscript | source | (unstable) | 10.03.1~dfsg~git20240518-1 |
[buster] - ghostscript <ignored> (fix requires API functions introduced in 9.50)
https://ghostscript.readthedocs.io/en/gs10.03.1/News.html
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7145885041bb52cc23964f0aa2aec1b1c82b5908 (ghostpdl-10.03.1)
https://bugs.ghostscript.com/show_bug.cgi?id=707754
API functions used by fixing commit were introduced in:
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=9de16a6637b73e35f79d2d622de403b24e6502f2