Ghostscript Vulnerabilities Patched in Recent Ubuntu Updates
Canonical has released Ubuntu security updates to address several Ghostscript vulnerabilities identified by security researchers. These vulnerabilities could potentially allow attackers to bypass security restrictions or even execute malicious code on your system.
Ghostscript is a widely used tool for interpreting PostScript and PDF files. It translates the instructions from the PDF or PostScript file into a format that your computer screen or printer can understand. This allows you to view PDFs on your screen or print them accurately.
Ghostscript Vulnerabilities Fixed in Ubuntu
CVE-2023-52722
This vulnerability affected Ubuntu 20.04 LTS, 22.04 LTS, and 23.10. It allowed attackers to potentially bypass restrictions designed to improve security (SAFER mode) and cause harm to your system.
CVE-2024-29510
This vulnerability, discovered by Thomas Rinsma, could have allowed attackers to potentially execute malicious code on vulnerable systems.
CVE-2024-33869 and CVE-2024-33870
Zdenek Hutyra identified two vulnerabilities related to how Ghostscript validates file paths. These vulnerabilities could have been exploited by attackers to access unauthorized files or potentially execute malicious code.
CVE-2024-33871
Another vulnerability discovered by Zdenek Hutyra involved the “Driver” parameter in Ghostscript’s opvp/oprp device. An attacker could have potentially used this to execute arbitrary code on your system.
Importance of Applying Updates
The nature of these vulnerabilities, especially those enabling arbitrary code execution, underscores the critical importance of applying the provided security updates. These updates contain the security patches that address the Ghostscript vulnerabilities mentioned above.
If you use Ghostscript on Ubuntu 20.04 LTS, 22.04 LTS, 23.10, or 24.04 LTS, it’s crucial to update your installation to the latest version. Failure to update could leave systems exposed to potential attacks, resulting in data breaches or system compromises.
Updating Ghostscript is a straightforward process through your usual software update tools provided by Ubuntu. To update Ghostscript on your Ubuntu system, use the following commands in your terminal:
$ sudo apt update
$ sudo apt install --only-upgrade ghostscript
Conclusion
The recent fixes for Ghostscript vulnerabilities in Ubuntu versions emphasize the ongoing need for vigilance against emerging threats. Users and organizations should ensure their systems are updated promptly to protect against potential exploits. By keeping your software updated, you ensure you have the latest security patches in place and minimize the risk of your system being compromised.
Additionally, leveraging techniques like Linux live patching can further enhance security without downtime. Conventionally, patching the Linux kernel would involve a reboot of the system which is often impractical for mission-critical systems. Live patching allows you to apply security updates to a running kernel without having to reboot the system.
TuxCare’s KernelCare Enterprise offers live patching for all popular Linux distributions, including Ubuntu, Debian, RHEL, AlmaLinux, Rocky Linux, CentOS, CloudLinux, Amazon Linux, and more. Furthermore, it automates the patching process ensuring the consistent and prompt deployment of patches on the system. This minimizes the risk of missing or delayed patches that could leave systems vulnerable.
Source: USN-6835-1
The post Ghostscript Vulnerabilities Patched in Recent Ubuntu Updates appeared first on TuxCare.
*** This is a Security Bloggers Network syndicated blog from TuxCare authored by Rohan Timalsina. Read the original post at: https://tuxcare.com/blog/ghostscript-vulnerabilities-patched-in-recent-ubuntu-updates/