An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
14 Nov 2024, 02:01
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* cpe:2.3:o:suse:linux_enterprise_server_for_sap:12:sp5:*:*:*:*:*:* cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:-:*:*:* cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:* cpe:2.3:o:suse:linux_enterprise_high_performance_computing:12.0:sp5:*:*:-:*:*:* cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:ltss:*:*:* cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:ltss_extended_security:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Suse linux Enterprise Server
Artifex ghostscript Artifex Debian Suse linux Enterprise Server For Sap Debian debian Linux Suse linux Enterprise High Performance Computing Suse |
|
| CWE | CWE-190 | |
| References | () https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html - Product | |
| References | () https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00 - Patch | |
| References | () https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/ - Third Party Advisory | |
| References | () https://bugs.ghostscript.com/show_bug.cgi?id=707793 - Permissions Required |
10 Nov 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-10 22:15
Updated : 2024-11-14 02:01
NVD link : CVE-2024-46953
Mitre link : CVE-2024-46953
JSON object : View
Products Affected
debian
- debian_linux
suse
- linux_enterprise_server_for_sap
- linux_enterprise_server
- linux_enterprise_high_performance_computing
artifex
- ghostscript
CWE
CWE-190
Integer Overflow or Wraparound