Stack-based buffer overflow in Ghostscript - CVE-2024-29507

Vulnerability identifier: #VU93814

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29507

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing the CIDFSubstPath and CIDFSubstFont parameters. A remote attacker can trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Ghostscript
Debian Linux
Ubuntu
openEuler
Fedora
ghostscript (Ubuntu package)
libgs9 (Ubuntu package)
ghostscript-help
ghostscript-tools-dvipdf
ghostscript-devel
ghostscript-debugsource
ghostscript-debuginfo
ghostscript
ghostscript (Debian package)
libgs10 (Ubuntu package)

Install update from vendor's website.

Ghostscript - update to 10.03.0
ghostscript (Ubuntu package) - addressed in versions 9.50~dfsg-5ubuntu4.13, 9.55.0~dfsg1-0ubuntu5.9, 10.02.1~dfsg1-0ubuntu7.3
libgs9 (Ubuntu package) - addressed in versions 9.50~dfsg-5ubuntu4.13, 9.55.0~dfsg1-0ubuntu5.9
ghostscript-help - addressed in versions 9.55.0-16, 9.55.0-17, 9.56.1-13
ghostscript-tools-dvipdf - addressed in versions 9.55.0-16, 9.55.0-17, 9.56.1-13
ghostscript-devel - addressed in versions 9.55.0-16, 9.55.0-17, 9.56.1-13
ghostscript-debugsource - addressed in versions 9.55.0-16, 9.55.0-17, 9.56.1-13
ghostscript-debuginfo - addressed in versions 9.55.0-16, 9.55.0-17, 9.56.1-13
ghostscript - addressed in versions 9.55.0-16, 9.55.0-17, 9.56.1-13
ghostscript (Debian package) - update to 10.0.0~dfsg-11+deb12u5
libgs10 (Ubuntu package) - update to 10.02.1~dfsg1-0ubuntu7.3
ghostscript - addressed in versions 10.02.1-6.fc39, 10.02.1-7.fc39, 10.02.1-11.fc40, 10.02.1-12.fc40

• https://bugs.ghostscript.com/show_bug.cgi?id=707510
• https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=7745dbe24514
• https://www.openwall.com/lists/oss-security/2024/07/03/7

• Multiple vulnerabilities in Artifex Ghostscript
• Ubuntu update for ghostscript
• Fedora 40 update for ghostscript
• Fedora 39 update for ghostscript
• Fedora 40 update for ghostscript
• Fedora 39 update for ghostscript
• Debian update for ghostscript
• openEuler 22.03 LTS SP3 update for ghostscript
• openEuler 22.03 LTS SP4 update for ghostscript
• openEuler 24.03 LTS update for ghostscript
• openEuler 22.03 LTS SP1 update for ghostscript