CVE-2024-29510

2024-05-0900:00:00

ubuntu.com

vulnerability

cve-2024-29510

unix

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

AI Score

6.8

Confidence

High

EPSS

0.007

Percentile

80.8%

JSON

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER
sandbox bypass, via format string injection with a uniprint device.

Bugs

<https://bugs.ghostscript.com/show_bug.cgi?id=707662>

Notes

Author	Note
sayun	the fix for this issue depends on SAFER infrastructure changes that were introduced after the 9.26 versions in bionic and xenial. Attempting to pull back infrastructure piecemeal runs the risk of introducing regressions; we may need to pull back 9.50 version included in focal/20.04 LTS to bionic and xenial.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchghostscript< anyUNKNOWN
ubuntu20.04noarchghostscript< 9.50~dfsg-5ubuntu4.12UNKNOWN
ubuntu22.04noarchghostscript< 9.55.0~dfsg1-0ubuntu5.7UNKNOWN
ubuntu23.10noarchghostscript< 10.01.2~dfsg1-0ubuntu2.3UNKNOWN
ubuntu24.04noarchghostscript< 10.02.1~dfsg1-0ubuntu7.1UNKNOWN
ubuntu16.04noarchghostscript< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	ghostscript	< any	UNKNOWN
ubuntu	20.04	noarch	ghostscript	< 9.50~dfsg-5ubuntu4.12	UNKNOWN
ubuntu	22.04	noarch	ghostscript	< 9.55.0~dfsg1-0ubuntu5.7	UNKNOWN
ubuntu	23.10	noarch	ghostscript	< 10.01.2~dfsg1-0ubuntu2.3	UNKNOWN
ubuntu	24.04	noarch	ghostscript	< 10.02.1~dfsg1-0ubuntu7.1	UNKNOWN
ubuntu	16.04	noarch	ghostscript	< any	UNKNOWN