CVE-2024-33871

A flaw was found in Ghostscript. The "Driver" parameter for the "opvp"/"oprp" device specifies the name of a dynamic library and allows any library to be loaded. This flaw allows a malicious user to send a specially crafted document that, when processed by Ghostscript, could potentially lead to arbitrary code execution with the privileges of the Ghostscript process on the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Passing the -dSAFER safety argument on the command line prevents the issue by locking security-related variables after Ghostscript’s initialization. In RHEL 9, -dSAFER is enabled by default, ensuring that insecure commands are rejected in a safer environment. This mitigation is equally effective in RHEL 7 and 8 when -dSAFER is explicitly passed on the command line, addressing the vulnerability that allows insecure commands within PostScript files. Since the OPVP device, cannot be removed, we recommend to use -dSAFER in RHEL 7 and 8 as a practical security measure.