Stack-based buffer overflow in Ghostscript - CVE-2024-29506

Vulnerability identifier: #VU93813

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29506

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the pdfi_apply_filter() function via a long PDF filter name. A remote attacker can pass a specially crafted file to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Ghostscript
Debian Linux
Ubuntu
openEuler
Fedora
ghostscript (Ubuntu package)
libgs9 (Ubuntu package)
ghostscript-help
ghostscript-tools-dvipdf
ghostscript-devel
ghostscript-debugsource
ghostscript-debuginfo
ghostscript
ghostscript (Debian package)
libgs10 (Ubuntu package)

Install update from vendor's website.

Ghostscript - update to 10.03.0
ghostscript (Ubuntu package) - addressed in versions 9.50~dfsg-5ubuntu4.13, 9.55.0~dfsg1-0ubuntu5.9, 10.02.1~dfsg1-0ubuntu7.3
libgs9 (Ubuntu package) - addressed in versions 9.50~dfsg-5ubuntu4.13, 9.55.0~dfsg1-0ubuntu5.9
ghostscript-help - update to 9.55.0-23
ghostscript-tools-dvipdf - update to 9.55.0-23
ghostscript-devel - update to 9.55.0-23
ghostscript-debugsource - update to 9.55.0-23
ghostscript-debuginfo - update to 9.55.0-23
ghostscript - update to 9.55.0-23
ghostscript (Debian package) - update to 10.0.0~dfsg-11+deb12u5
libgs10 (Ubuntu package) - update to 10.02.1~dfsg1-0ubuntu7.3
ghostscript - addressed in versions 10.02.1-6.fc39, 10.02.1-7.fc39, 10.02.1-11.fc40, 10.02.1-12.fc40

• https://bugs.ghostscript.com/show_bug.cgi?id=707510
• https://git.ghostscript.com/?p=ghostpdl.git%3Bh=77dc7f699beba606937b7ea23b50cf5974fa64b1
• https://www.openwall.com/lists/oss-security/2024/07/03/7

• Multiple vulnerabilities in Artifex Ghostscript
• Ubuntu update for ghostscript
• Fedora 40 update for ghostscript
• Fedora 39 update for ghostscript
• Fedora 40 update for ghostscript
• Fedora 39 update for ghostscript
• Debian update for ghostscript
• openEuler 22.03 LTS SP4 update for ghostscript