Directory Traversal Vulnerability in Ghostscript Affects File Security
Summary
DEBIAN-CVE-2024-29511: Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. Affects ghostscript versions < 10.03.0~dfsg-1. Fixed in 10.03.0~dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and PDF files, widely used for processing and rendering documents. It is an essential tool in various applications, particularly in printing and document conversion. However, versions prior to 10.03.1 are vulnerable to a directory traversal issue when used with Tesseract for Optical Character Recognition (OCR), which can lead to unauthorized file access.
Vulnerability Detail
The vulnerability arises from a directory traversal issue in Artifex Ghostscript versions before 10.03.1 when Tesseract is utilized for OCR. This flaw allows attackers to read arbitrary files on the system and write error messages to unintended locations. For instance, by manipulating the OCRLanguage parameter, an attacker could exploit this vulnerability to access sensitive files such as /etc/passwd, potentially leading to further system compromise.
How To Fix
Minimum fixed version
10.03.0~dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using Tesseract for OCR with Ghostscript until the package is updated. Additionally, ensure that proper file permissions are set to limit access to sensitive files.
Conclusion
The directory traversal vulnerability in Ghostscript poses a significant risk to file security when using Tesseract for OCR. It is crucial to update to the latest version to mitigate this risk and protect sensitive information from unauthorized access.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability is a directory traversal issue that allows unauthorized file access when using Tesseract for OCR.
Ghostscript versions prior to 10.03.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files and potentially compromise the security of the system.
If an immediate update is not possible, avoid using Tesseract for OCR with Ghostscript and ensure that file permissions are properly configured.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
