Skip to content
OpenAdvisories
Medium ALAS2023-2024-692 5 CVEs

Moderate: ghostscript security update (Amazon Linux 2023)

Published Aug 1, 2024 · Updated Aug 6, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-29511: Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd. CVE-2024-29509: Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle. CVE-2024-29508: Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc. CVE-2024-29507: Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters. CVE-2024-29506: Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name.

Fixed packages 14

ReleasePackageFixed in
Amazon Linux · 2023 ghostscript 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-debuginfo 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-debugsource 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-doc 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-gtk 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-gtk-debuginfo 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-tools-dvipdf 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-tools-fonts 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-tools-printing 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-x11 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 ghostscript-x11-debuginfo 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 libgs 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 libgs-debuginfo 0:9.56.1-7.amzn2023.0.9
Amazon Linux · 2023 libgs-devel 0:9.56.1-7.amzn2023.0.9

Vulnerabilities 5

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-29506.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-29507.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-29508.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-29509.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-29511.html