CVE-2024-29511: High severity Artifex GhostScript vulnerability
Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debugfile /tmp/out and userpatternsfile /etc/passwd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 10.03.1~dfsg-2 - Upgrade
Upgrade
Artifex Ghostscriptto a version that resolves this vulnerability.Fixed in 10.03.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29511?
CVE-2024-29511 has been classified as a high severity vulnerability due to its potential for unauthorized file reading and manipulation.
How do I fix CVE-2024-29511?
To mitigate CVE-2024-29511, update to Ghostscript version 10.03.1 or later immediately.
What type of attack does CVE-2024-29511 enable?
CVE-2024-29511 enables an attacker to perform directory traversal attacks, allowing them to read arbitrary files on the system.
Which versions of Ghostscript are affected by CVE-2024-29511?
CVE-2024-29511 affects Ghostscript versions prior to 10.03.1.
Is Tesseract the only component involved in CVE-2024-29511?
Yes, CVE-2024-29511 specifically involves Tesseract as it is used for OCR functionality in Ghostscript.