Gentoo update for GPL Ghostscript



Risk High
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2024-46951
CVE-2024-46952
CVE-2024-46953
CVE-2024-46954
CVE-2024-46955
CVE-2024-46956
CWE-ID CWE-20
CWE-190
CWE-787
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Gentoo Linux
Operating systems & Components / Operating system

app-text/ghostscript-gpl
Operating systems & Components / Operating system package or component

Vendor Gentoo

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU99618

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-46951

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an unspecified error when handling untrusted input. A remote attacker can pass a specially crafted file to the application and execute arbitrary code on the system.

Mitigation

Update the affected packages.
app-text/ghostscript-gpl to version: 10.04.0

Vulnerable software versions

Gentoo Linux: All versions

app-text/ghostscript-gpl: before 10.04.0

CPE2.3 External links

http://security.gentoo.org/glsa/202501-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU99619

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-46952

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an unspecified error when handling untrusted input. A remote attacker can pass a specially crafted file to the application and execute arbitrary code on the system.

Mitigation

Update the affected packages.
app-text/ghostscript-gpl to version: 10.04.0

Vulnerable software versions

Gentoo Linux: All versions

app-text/ghostscript-gpl: before 10.04.0

CPE2.3 External links

http://security.gentoo.org/glsa/202501-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU99616

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-46953

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when parsing the page format results in path truncation. A remote attacker can pass specially crafted file to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.
app-text/ghostscript-gpl to version: 10.04.0

Vulnerable software versions

Gentoo Linux: All versions

app-text/ghostscript-gpl: before 10.04.0

CPE2.3 External links

http://security.gentoo.org/glsa/202501-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU99620

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-46954

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an unspecified error when handling untrusted input. A remote attacker can pass a specially crafted file to the application and execute arbitrary code on the system.

Mitigation

Update the affected packages.
app-text/ghostscript-gpl to version: 10.04.0

Vulnerable software versions

Gentoo Linux: All versions

app-text/ghostscript-gpl: before 10.04.0

CPE2.3 External links

http://security.gentoo.org/glsa/202501-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU99621

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-46955

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an unspecified error when handling untrusted input. A remote attacker can pass a specially crafted file to the application and execute arbitrary code on the system.

Mitigation

Update the affected packages.
app-text/ghostscript-gpl to version: 10.04.0

Vulnerable software versions

Gentoo Linux: All versions

app-text/ghostscript-gpl: before 10.04.0

CPE2.3 External links

http://security.gentoo.org/glsa/202501-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds write

EUVDB-ID: #VU99617

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-46956

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in filenameforall. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update the affected packages.
app-text/ghostscript-gpl to version: 10.04.0

Vulnerable software versions

Gentoo Linux: All versions

app-text/ghostscript-gpl: before 10.04.0

CPE2.3 External links

http://security.gentoo.org/glsa/202501-06


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###