CVE-2024-46953: Integer Overflow
An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 10.0.0~dfsg-11+deb12u6 - Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 10.04.0~dfsg-1 - Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 10.0.0~dfsg-11+deb12u8Fixed in 10.05.1~dfsg-1+deb13u1Fixed in 10.05.1~dfsg-1+deb13u3Fixed in 10.08.0~dfsg-2 - Upgrade
Upgrade
alpine/ghostscriptto a version that resolves this vulnerability.Fixed in 10.04.0-r0 - Upgrade
Upgrade
Artifex Ghostscriptto a version that resolves this vulnerability.Fixed in 10.04.0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46953?
CVE-2024-46953 is a high severity vulnerability due to its potential for path traversal and code execution.
How do I fix CVE-2024-46953?
To fix CVE-2024-46953, update to a patched version of Ghostscript such as 10.04.0 or later.
What versions of Ghostscript are affected by CVE-2024-46953?
CVE-2024-46953 affects all Ghostscript versions prior to 10.04.0.
What is the nature of the vulnerability in CVE-2024-46953?
CVE-2024-46953 is caused by an integer overflow when parsing the output filename format string leading to path truncation.
Can CVE-2024-46953 lead to remote code execution?
Yes, CVE-2024-46953 can potentially allow for remote code execution due to its path traversal capabilities.