CVE-2024-46953

NameCVE-2024-46953
DescriptionAn issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5808-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ghostscript (PTS)jessie, jessie (lts)9.26a~dfsg-0+deb8u12vulnerable
stretch (security)9.26a~dfsg-0+deb9u9vulnerable
stretch (lts), stretch9.26a~dfsg-0+deb9u12vulnerable
buster (security), buster, buster (lts)9.27~dfsg-2+deb10u9vulnerable
bullseye9.53.3~dfsg-7+deb11u7vulnerable
bullseye (security)9.53.3~dfsg-7+deb11u8vulnerable
bookworm10.0.0~dfsg-11+deb12u5vulnerable
bookworm (security)10.0.0~dfsg-11+deb12u6fixed
sid, trixie10.04.0~dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ghostscriptsourcebookworm10.0.0~dfsg-11+deb12u6DSA-5808-1
ghostscriptsource(unstable)10.04.0~dfsg-1

Notes

https://bugs.ghostscript.com/show_bug.cgi?id=707793
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00
https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=294a3755e33f453dd92e2a7c4cfceb087ac09d6a (ghostpdl-10.04.0)

Search for package or bug name: Reporting problems