8.8

CVE-2024-33871: artifex ghostscript Code Injection

CVSS: 8.8v3.1HighAnalyzed
AliasesALPINE-CVE-2024-33871SUSE-SU-2024:2198-1SUSE-SU-2024:2199-1
Published 03-07-2024Last modified 02-08-2024
Open JSON

Vulnerability summary

CVE-2024-33871 is a high (CVSS 8.8) Code Injection vulnerability in artifex ghostscript. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.5% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
1.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 4
DSA-5692-1MGASA-2024-0192OPENSUSE-SU-2024:14090-1USN-6835-1CGA-FCJ4-4M67-F7HJCGA-JP64-M4CC-467M

Timeline

  1. 03-07-2024
    PublishedVulnerability first disclosed.
  2. 02-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

1.43%

Chance of exploitation in the next 30 days

Percentile

73%

Versus all other CVEs

30-day change

0.00 pp

From 1.43% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse18 products
  • ghostscript&distro=SUSE Enterprise Storage 7.1< 9.52-150000.191.1
  • ghostscript&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 9.52-150000.191.1
  • ghostscript&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 9.52-150000.191.1
  • ghostscript&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 9.52-150000.191.1
  • ghostscript&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 9.52-150000.191.1
Redhat15 products
  • ghostscript< 0:9.54.0-16.el9_4 | < 0:9.27-13.el8_10 | < 0:9.54.0-7.el9_0.3 | < 0:9.27-2.el8_6.1 | < 0:9.27-6.el8_8.1 | < 0:9.25-6.el8_2.1 | < 0:9.54.0-12.el9_2.1 | < 0:9.27-2.el8_4.1 | < 0:9.25-5.el7_9.1
  • ghostscript-cups< 0:9.25-5.el7_9.1
  • ghostscript-debuginfo< 0:9.54.0-16.el9_4 | < 0:9.27-13.el8_10 | < 0:9.54.0-7.el9_0.3 | < 0:9.27-2.el8_6.1 | < 0:9.27-6.el8_8.1 | < 0:9.25-6.el8_2.1 | < 0:9.54.0-12.el9_2.1 | < 0:9.27-2.el8_4.1 | < 0:9.25-5.el7_9.1
  • ghostscript-debugsource< 0:9.54.0-16.el9_4 | < 0:9.27-13.el8_10 | < 0:9.54.0-7.el9_0.3 | < 0:9.27-2.el8_6.1 | < 0:9.27-6.el8_8.1 | < 0:9.25-6.el8_2.1 | < 0:9.54.0-12.el9_2.1 | < 0:9.27-2.el8_4.1
  • ghostscript-doc< 0:9.54.0-16.el9_4 | < 0:9.27-13.el8_10 | < 0:9.54.0-7.el9_0.3 | < 0:9.27-6.el8_8.1 | < 0:9.54.0-12.el9_2.1 | < 0:9.25-5.el7_9.1
Opensuse2 products
  • ghostscript&distro=openSUSE Leap 15.5< 9.52-150000.191.1
  • ghostscript&distro=openSUSE Leap 15.6< 9.52-150000.191.1
Alpine1 product
  • ghostscript< 10.04.0-r0 | < 10.03.1-r0
Artifex1 product
Chainguard1 product
  • ghostscript< 10.03.1-r0
Debian1 product
  • ghostscript< 10.0.0~dfsg-11+deb12u4 | < 10.03.1~dfsg~git20240518-1
Ubuntu1 product
  • ghostscriptAll versions (No fix recorded) | < 9.50~dfsg-5ubuntu4.12 | < 9.55.0~dfsg1-0ubuntu5.7 | < 10.02.1~dfsg1-0ubuntu7.1
Wolfi1 product
  • ghostscript< 10.03.1-r0

9 vendors · 41 products

References

36 links
Show all 36 references