Ubuntu update for ghostscript

Published: 2024-07-15

Risk	High
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2024-29506 CVE-2024-29507 CVE-2024-29508 CVE-2024-29509 CVE-2024-29511
CWE-ID	CWE-121 CWE-122 CWE-22
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	Ubuntu Operating systems & Components / Operating system libgs9 (Ubuntu package) Operating systems & Components / Operating system package or component libgs10 (Ubuntu package) Operating systems & Components / Operating system package or component ghostscript (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Stack-based buffer overflow

EUVDB-ID: #VU93813

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-29506

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the pdfi_apply_filter() function via a long PDF filter name. A remote attacker can pass a specially crafted file to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ghostscript to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 24.04

libgs9 (Ubuntu package): before 9.55.0~dfsg1-0ubuntu5.9

libgs10 (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

ghostscript (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

External links

http://ubuntu.com/security/notices/USN-6897-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU93814

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-29507

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing the CIDFSubstPath and CIDFSubstFont parameters. A remote attacker can trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ghostscript to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 24.04

libgs9 (Ubuntu package): before 9.55.0~dfsg1-0ubuntu5.9

libgs10 (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

ghostscript (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

External links

http://ubuntu.com/security/notices/USN-6897-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-based buffer overflow

EUVDB-ID: #VU93815

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-29508

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the pdf_base_font_alloc() function. A remote attacker can pass specially crafted PDF file to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package ghostscript to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 24.04

libgs9 (Ubuntu package): before 9.55.0~dfsg1-0ubuntu5.9

libgs10 (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

ghostscript (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

External links

http://ubuntu.com/security/notices/USN-6897-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Heap-based buffer overflow

EUVDB-ID: #VU93812

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-29509

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a boundary error when parsing passwords, when PDFPassword (e.g., for runpdf) has a 00 byte in the middle. A remote attacker can trick the victim to pass a specially crafted password to the application, trigger a heap-based buffer overflow and crash it.

Mitigation

Update the affected package ghostscript to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 24.04

libgs9 (Ubuntu package): before 9.55.0~dfsg1-0ubuntu5.9

libgs10 (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

ghostscript (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

External links

http://ubuntu.com/security/notices/USN-6897-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Path traversal

EUVDB-ID: #VU93816

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-29511

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences when Tesseract is used for OCR. A remote attacker can view arbitrary files on the system.

Mitigation

Update the affected package ghostscript to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 24.04

libgs9 (Ubuntu package): before 9.55.0~dfsg1-0ubuntu5.9

libgs10 (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

ghostscript (Ubuntu package): before 10.02.1~dfsg1-0ubuntu7.3

External links

http://ubuntu.com/security/notices/USN-6897-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.