Skip to content
OpenAdvisories
Medium ALAS2-2024-2614 2 CVEs

Moderate: ghostscript security update (Amazon Linux 2)

Published Aug 1, 2024 · Updated Aug 13, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-29511: Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd. CVE-2024-29508: Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 ghostscript 0:9.54.0-9.amzn2.0.5
Amazon Linux · 2 ghostscript-cups 0:9.54.0-9.amzn2.0.5
Amazon Linux · 2 ghostscript-debuginfo 0:9.54.0-9.amzn2.0.5
Amazon Linux · 2 ghostscript-doc 0:9.54.0-9.amzn2.0.5
Amazon Linux · 2 ghostscript-gtk 0:9.54.0-9.amzn2.0.5
Amazon Linux · 2 libgs 0:9.54.0-9.amzn2.0.5
Amazon Linux · 2 libgs-devel 0:9.54.0-9.amzn2.0.5

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-29508.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-29511.html