CVE-2024-46953

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-46953
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-46953.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-46953
Downstream
Related
Published
2024-11-10T22:15:12.750Z
Modified
2026-02-11T14:58:46.514871Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.

References

Affected packages

Git / github.com/artifexsoftware/ghostpdl

Affected ranges

Type
GIT
Repo
https://github.com/artifexsoftware/ghostpdl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
df8f4966577fff70320be2eb33cb55eb15d05d52

Affected versions

Other
chrisl-test
ghostpdl
ghostpdl-ebuild
ken_20220210_baseline
robin_test_ref
ghostpdl-1.*
ghostpdl-1.53
ghostpdl-1.54
ghostpdl-10.*
ghostpdl-10.01.1-gse-10174
ghostpdl-10.02.0-test-base-001
ghostpdl-10.04.0rc1
ghostpdl-10.04.0rc1_test001
ghostpdl-10.04.0rc2_test001
ghostpdl-8.*
ghostpdl-8.70
ghostpdl-8.71
ghostpdl-9.*
ghostpdl-9.00
ghostpdl-9.01
ghostpdl-9.02
ghostpdl-9.52-test-base-1
ghostpdl-9.52-test-base-3
ghostpdl-9.52-test-base-4
ghostpdl-9.54.0-test-base-0
ghostpdl-9.55-test-base-0
ghostpdl-9.56.0-test-base-0
ghostpdl-9.56.0-test-base-2
ghostpdl-9.56.0-test-base-3
ghostpdl-9.56.0-test-base-4
ghostpdl-9.56.0-test-base-5
ghostscript-6.*
ghostscript-6.0
ghostscript-6.01
ghostscript-6.20
ghostscript-6.21
ghostscript-6.22
ghostscript-6.23
ghostscript-6.30
ghostscript-6.31
ghostscript-6.32
ghostscript-6.50
ghostscript-6.60
ghostscript-6.61
ghostscript-6.62
ghostscript-6.63
ghostscript-6.64
ghostscript-7.*
ghostscript-7.00
ghostscript-7.02
ghostscript-7.03
ghostscript-7.04
ghostscript-7.20
ghostscript-7.21
ghostscript-7.22
ghostscript-7.30
ghostscript-7.31
ghostscript-7.32
ghostscript-7.33
ghostscript-8.*
ghostscript-8.00
ghostscript-8.01
ghostscript-8.10
ghostscript-8.11
ghostscript-8.12
ghostscript-8.13
ghostscript-8.14
ghostscript-8.15
ghostscript-8.30
ghostscript-8.31
ghostscript-8.32
ghostscript-8.33
ghostscript-8.50
ghostscript-8.51
ghostscript-8.52
ghostscript-8.53
ghostscript-8.56
ghostscript-8.57
ghostscript-8.60
ghostscript-8.61
ghostscript-8.62
ghostscript-8.63
ghostscript-8.64
ghostscript-8.70
ghostscript-8.71
ghostscript-9.*
ghostscript-9.01
ghostscript-9.02
jbig2dec-0.*
jbig2dec-0.14

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-46953.json"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "id": "CVE-2024-46953-678ed2ab",
        "target": {
            "file": "base/gscdefs.h"
        },
        "digest": {
            "line_hashes": [
                "51349389685971879127722065848668744976",
                "38793997789482228263181637852994441109",
                "236140452785076161394171543611930980858",
                "252281609283495551321526765862374920250"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/artifexsoftware/ghostpdl/commit/df8f4966577fff70320be2eb33cb55eb15d05d52"
    }
]