Out-of-Bounds Read Vulnerability in Ghostscript - CVE-2024-46955
Summary
ALPINE-CVE-2024-46955: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space. Affects ghostscript versions < 10.04.0-r0. Fixed in 10.04.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is essential for applications that require document manipulation, conversion, and printing. However, it is susceptible to vulnerabilities that can lead to security risks, particularly when handling color spaces in images.
Vulnerability Detail
An issue was discovered in psi/zcolor.c in Artifex Ghostscript before version 10.04.0. The vulnerability manifests as an out-of-bounds read when reading color in Indexed color space. This flaw can potentially allow attackers to exploit the system, leading to unauthorized access or data leakage, thereby posing a significant risk to applications relying on Ghostscript for document processing.
How To Fix
Minimum fixed version
10.04.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the use of Ghostscript for processing documents that may involve Indexed color space until the package can be updated to the patched version. Additionally, review and sanitize any input files to minimize risk.
Conclusion
The vulnerability CVE-2024-46955 in Ghostscript poses a significant risk due to an out-of-bounds read issue. It is crucial for users to update to the patched version 10.04.0-r0 to mitigate potential security threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2024-46955 is a vulnerability in Ghostscript that allows for an out-of-bounds read when processing Indexed color space, potentially leading to security risks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Exploiting this vulnerability may allow attackers to gain unauthorized access or leak sensitive data, compromising the integrity of applications that utilize Ghostscript.
Yes, the patched version of Ghostscript is 10.04.0-r0. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, limit the use of Ghostscript for processing potentially risky documents and review input files to reduce exposure.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
