PT-2024-5150 · Artifex+3 · Artifex Ghostscript+3

Thomas Rinsma · Published 2024-01-01 · Updated 2025-04-28 · CVE-2024-29507

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.03.0

Description: The issue is related to a stack-based buffer overflow in the Ghostscript software, which can be exploited via the CIDFSubstPath and CIDFSubstFont parameters. This can potentially allow a remote attacker to gain unauthorized access to protected information.

Recommendations: For Artifex Ghostscript versions prior to 10.03.0, update to version 10.03.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the CIDFSubstPath and CIDFSubstFont parameters until a patch is available.

Fix

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

CWE-120

Related Identifiers

BDU:2024-05697

CVE-2024-29507

DSA-5760-1

OESA-2024-2454

OESA-2024-2455

OESA-2024-2456

OESA-2024-2457

USN-6897-1

Affected Products

Artifex Ghostscript

Astra Linux

Linuxmint

Ubuntu

References · 43

• https://osv.dev/vulnerability/OESA-2024-2457 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05697 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2456 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29507 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-29507 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2454 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-29507 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5760-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-29507 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29506 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2455 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29508 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-29507 · Vendor Advisory