PT-2024-8201 · Artifex+9 · Artifex Ghostscript+9

Published 2024-09-16 · Updated 2026-05-13 · CVE-2024-46953

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.04.0

Description: The issue is related to an integer overflow in the base/gsdevice.c component of Artifex Ghostscript, which can result in path truncation and possible path traversal and code execution when parsing the filename format string for the output filename. This can potentially allow an attacker to execute arbitrary code.

Recommendations: For Artifex Ghostscript versions prior to 10.04.0, upgrade to version 10.04.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable base/gsdevice.c component until a patch is available. Avoid using the filename format string for the output filename in the affected API endpoint until the issue is resolved.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2025:4362

ALSA-2025:7422

BDU:2024-09743

CESA-2025_4362

CVE-2024-46953

DLA-3965-1

DSA-5808-1

INFSA-2025_4362

INFSA-2025_7422

MGASA-2024-0326

OESA-2024-2310

OPENSUSE-SU-2024:14423-1

OPENSUSE-SU-2024_3941-1

RHSA-2025:4362

RHSA-2025:7422

RHSA-2025:7499

RHSA-2025_4362

RHSA-2025_7422

SUSE-SU-2024:3941-1

SUSE-SU-2024:3942-1

USN-7103-1

USN-7138-1

Affected Products

Almalinux

Artifex Ghostscript

Astra Linux

Centos

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 95

• https://linux.oracle.com/errata/ELSA-2025-7422.html · Vendor Advisory
• https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00 · Patch
• https://osv.dev/vulnerability/DSA-5808-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09743 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-46953 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-46953 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7103-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2025-7422.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2310 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-46953 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7138-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-46956 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2025-4362.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0326 · Vendor Advisory