Directory Traversal Vulnerability in Ghostscript: CVE-2024-46954
Summary
UBUNTU-CVE-2024-46954: An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Affects ghostscript versions < 10.02.1~dfsg1-0ubuntu7.4. Fixed in 10.02.1~dfsg1-0ubuntu7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is essential for applications that require document manipulation and conversion. However, a vulnerability has been identified in Ghostscript that could allow attackers to exploit the software through malformed UTF-8 encoding.
Vulnerability Detail
An issue was discovered in the decode_utf8 function in base/gp_utf8.c in Artifex Ghostscript before version 10.04.0. This vulnerability allows for overlong UTF-8 encoding, which can lead to directory traversal attacks. An attacker could potentially exploit this flaw to access restricted directories and files on the server, posing a significant security risk.
How To Fix
Minimum fixed version
10.02.1~dfsg1-0ubuntu7.4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to sensitive directories and files on your server to mitigate the risk of directory traversal attacks. Additionally, ensure that your application validates and sanitizes all user inputs.
Conclusion
CVE-2024-46954 is a significant vulnerability in Ghostscript that can lead to directory traversal attacks. It is crucial for users to update to the latest patched version to mitigate the risk. Regular monitoring and validation of user inputs are also recommended to enhance security.
See every vulnerability recorded for ghostscript →
FAQ
CVE-2024-46954 is a vulnerability in Ghostscript that allows for directory traversal due to overlong UTF-8 encoding.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized access to sensitive files and directories, which may compromise the security of your system.
Yes, the patched version of Ghostscript is 10.02.1~dfsg1-0ubuntu7.4. Updating to this version will fix the vulnerability.
The CVSS score for CVE-2024-46954 is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
