PT-2024-5149 · Artifex+3 · Artifex Ghostscript+3

Thomas Rinsma · Published 2024-07-03 · Updated 2025-10-28 · CVE-2024-29511

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 10.03.1

Description The Ghostscript software suite contains a directory traversal issue when using Tesseract for Optical Character Recognition (OCR). This allows for arbitrary file reading and writing of error messages to arbitrary files through the OCRLanguage parameter. Specifically, exploitation can occur via the debug file and user patterns file parameters. The API endpoints potentially involved are those utilizing OCR functionality. The vulnerable parameters are debug file and user patterns file.

Recommendations Versions prior to 10.03.1 should be updated to version 10.03.1 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-489

Related Identifiers

BDU:2024-05696

CVE-2024-29511

USN-6897-1

Affected Products

Artifex Ghostscript

Debian

Linuxmint

Ubuntu

References · 31

• https://cve.org/CVERecord?id=CVE-2024-29511 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-29511 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29508 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-29511 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29507 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/USN-6897-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05696 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29511 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-29511 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-29511 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29511 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2024-29511 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6897-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29511 · Security Note