Critical Vulnerability in Ghostscript: Unchecked Pointer Leading to Arbitrary Code Execution
Summary
ALPINE-CVE-2024-46951: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. Affects ghostscript versions < 10.04.0-r0. Fixed in 10.04.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The software is known for its versatility in handling graphics and text, making it a popular choice among developers and organizations. However, a recent vulnerability has been discovered that affects multiple versions of Ghostscript, posing a significant risk to systems utilizing this package.
Vulnerability Detail
An issue was discovered in psi/zcolor.c in Artifex Ghostscript before version 10.04.0. The vulnerability arises from an unchecked Implementation pointer in the Pattern color space, which could lead to arbitrary code execution. This means that an attacker could exploit this flaw to execute malicious code on the affected system, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
10.04.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the Ghostscript service or disabling it temporarily until the update can be applied. This can help mitigate the risk of exploitation.
Conclusion
The vulnerability in Ghostscript poses a serious risk due to the potential for arbitrary code execution. It is crucial for users and organizations to update to the latest patched version to safeguard their systems. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for ghostscript →
FAQ
The CVSS score for this vulnerability is 7.8, indicating a high severity level.
Ghostscript versions prior to 10.04.0 are affected by this vulnerability.
Exploitation of this vulnerability could lead to arbitrary code execution, allowing attackers to run malicious code on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
