Out-of-Bounds Read Vulnerability in Ghostscript - CVE-2024-46955
Summary
CVE-2024-46955: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space. Affects ghostscript versions < 10.04.0-r0. Fixed in 10.04.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The software is known for its ability to convert files, manage printing tasks, and provide a robust platform for document manipulation. However, it has recently been identified to have a vulnerability that could lead to security risks when handling Indexed color spaces.
Vulnerability Detail
CVE-2024-46955 is an out-of-bounds read vulnerability found in the psi/zcolor.c file of Artifex Ghostscript versions prior to 10.04.0. This vulnerability arises when the software processes color in Indexed color space, potentially allowing attackers to read memory outside the intended boundaries. The ramifications of this vulnerability could include unauthorized access to sensitive data or application crashes, making it critical for users to address this issue promptly.
How To Fix
Minimum fixed version
10.04.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing files that utilize Indexed color space until they can update to the patched version. Additionally, users should ensure that their applications are configured to limit access to sensitive data.
Conclusion
The CVE-2024-46955 vulnerability in Ghostscript poses significant risks due to its out-of-bounds read issue when handling Indexed color spaces. Users are strongly advised to update to the latest patched version to mitigate these risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2024-46955 is a vulnerability in Ghostscript that allows for out-of-bounds reads when processing Indexed color spaces.
You can check your Ghostscript version by running 'gs --version' in your terminal. If it is below 10.04.0, it is affected.
The risks include potential unauthorized access to sensitive information and application instability or crashes.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application for vulnerabilities without signup at the Vulert playground.
If you cannot update immediately, avoid processing files with Indexed color spaces and limit access to sensitive data as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
