CVE-2024-46953

Katalog CVE

CVSS 7.8 · High EPSS 0,39%

Kerentanan Integer Overflow or Wraparound pada artifex ghostscript, debian linux +3 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.

Rincian

Terbit di NVD

10 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00 patch
• https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/ advisory pihak ketiga
• https://bugs.ghostscript.com/show_bug.cgi?id=707793 permissions required
• https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html product
• https://lists.debian.org/debian-lts-announce/2024/11/msg00023.html