CVE-2024-46951
HIGH severity · CVSS 7.8 · CWE-824
7.8CVSS HIGH
Summary
An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space could lead to arbitrary code execution.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionRequired
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)0%
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Official patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f49812186baa7d1362880673408a6fbe8719b4f8 ↗
Additional information
- NVD record
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f49812186baa7d1362880673408a6fbe8719b4f8Patch
- https://bugs.ghostscript.com/show_bug.cgi?id=707991
- https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html
- https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/Advisory
- https://lists.debian.org/debian-lts-announce/2024/11/msg00023.html