PT-2024-32297 · Artifex+7 · Artifex Ghostscript+7

Published 2024-06-18 · Updated 2026-05-13 · CVE-2024-46954

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 10.04.0

Description An issue was discovered in the decode utf8 function in base/gp utf8.c of Artifex Ghostscript. This issue is related to overlong UTF-8 encoding, which can lead to possible ../ directory traversal.

Recommendations For Artifex Ghostscript versions prior to 10.04.0, update to version 10.04.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the decode utf8 function in base/gp utf8.c to minimize the risk of exploitation.

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALSA-2025:4362

ALSA-2025:7422

BDU:2026-07721

CESA-2025_4362

CVE-2024-46954

INFSA-2025_4362

INFSA-2025_7422

MGASA-2024-0326

OPENSUSE-SU-2024:14423-1

RHSA-2025:4362

RHSA-2025:7422

RHSA-2025:7499

RHSA-2025_4362

RHSA-2025_7422

USN-7103-1

Affected Products

Almalinux

Artifex Ghostscript

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Ubuntu

References · 71

• https://linux.oracle.com/errata/ELSA-2025-4362.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-7422.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:4362 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46955 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-46954 · Security Note
• https://advisories.mageia.org/MGASA-2024-0326.html · Security Note
• https://bdu.fstec.ru/vul/2026-07721 · Security Note
• https://osv.dev/vulnerability/USN-7103-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-46954 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7103-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14423-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46954 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46953 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:7422 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0326 · Vendor Advisory