Directory Traversal Vulnerability in Ghostscript - CVE-2024-46954
Summary
ALPINE-CVE-2024-46954: An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Affects ghostscript versions < 10.04.0-r0. Fixed in 10.04.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering PDF files and is integral to many applications that require document manipulation. The vulnerability in question affects multiple versions of Ghostscript across various Alpine Linux distributions, making it critical for users relying on this package for PDF processing.
Vulnerability Detail
An issue was discovered in the decode_utf8 function in base/gp_utf8.c in Artifex Ghostscript before version 10.04.0. The vulnerability arises from overlong UTF-8 encoding, which can lead to directory traversal attacks. This means that an attacker could potentially exploit this flaw to access files and directories outside the intended scope of the application, leading to unauthorized data exposure or manipulation.
How To Fix
Minimum fixed version
10.04.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict file access permissions or implement input validation to prevent overlong UTF-8 sequences from being processed. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
The directory traversal vulnerability in Ghostscript (CVE-2024-46954) poses significant risks to applications using this package. Users are strongly advised to update to the latest version to mitigate potential threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2024-46954 is a vulnerability in Ghostscript that allows for directory traversal due to overlong UTF-8 encoding.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
If exploited, this vulnerability could allow attackers to access sensitive files and directories, leading to data breaches or unauthorized access.
Yes, the permanent fix is to update Ghostscript to version 10.04.0-r0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
