Path Traversal and Command Execution in Artifex Ghostscript
Summary
CVE-2024-33869: An issue was discovered in Artifex Ghostscript before 10.03.1. Affects ghostscript across 2 version ranges.
< 10.04.0-r0
< 865d8905b3fdb3a0fabe3628a67bad634cf88ba9
Fixed in 10.04.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Artifex Ghostscript is an open-source interpreter for the PostScript language and the Adobe Portable Document Format (PDF). It is widely used for rendering and manipulating PDF files. Ghostscript provides a comprehensive set of functions for processing and converting PDF documents. However, a vulnerability has been discovered in versions before 10.03.1 that allows for path traversal and command execution.
Vulnerability Detail
The vulnerability arises due to path reduction in the base/gpmisc.c file of Artifex Ghostscript. By exploiting this issue through a crafted PostScript document, an attacker can bypass restrictions on the use of %pipe% and execute arbitrary commands. This can lead to unauthorized access, data leakage, and potential remote code execution on the affected system.
How To Fix
Minimum fixed version
10.04.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds are available for this vulnerability.
Conclusion
The path traversal and command execution vulnerability in Artifex Ghostscript versions before 10.03.1 can be exploited through a crafted PostScript document. Upgrading to the latest version is crucial to mitigate the risk of unauthorized access, data leakage, and potential remote code execution. No workarounds are currently available for this vulnerability.
See every vulnerability recorded for ghostscript →
FAQ
Artifex Ghostscript is an open-source interpreter for the PostScript language and the Adobe Portable Document Format (PDF). It is commonly used for rendering and manipulating PDF files.
This vulnerability allows an attacker to execute arbitrary commands on the affected system, potentially leading to unauthorized access, data leakage, and remote code execution.
To fix this vulnerability, it is recommended to upgrade to version 10.03.1 or later of Artifex Ghostscript.
No known workarounds are available for this vulnerability.
You can find more information about this vulnerability in the CVE-2024-33869 JSON report available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-33869.json
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
