CVE-2024-29510

Publication date 9 May 2024

Last updated 30 May 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.3 · Medium

Score breakdown

Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.

Read the notes from the security team

Status

Package Ubuntu Release Status
ghostscript 25.04 plucky
Fixed 10.02.1~dfsg1-0ubuntu9
24.10 oracular
Fixed 10.02.1~dfsg1-0ubuntu9
24.04 LTS noble
Fixed 10.02.1~dfsg1-0ubuntu7.1
23.10 mantic
Fixed 10.01.2~dfsg1-0ubuntu2.3
22.04 LTS jammy
Fixed 9.55.0~dfsg1-0ubuntu5.7
20.04 LTS focal
Fixed 9.50~dfsg-5ubuntu4.12
18.04 LTS bionic
Vulnerable
16.04 LTS xenial
Vulnerable

Notes

sayun

the fix for this issue depends on SAFER infrastructure changes that were introduced after the 9.26 versions in bionic and xenial. Attempting to pull back infrastructure piecemeal runs the risk of introducing regressions; we may need to pull back 9.50 version included in focal/20.04 LTS to bionic and xenial.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
ghostscript

Severity score breakdown

Parameter Value
Base score 6.3 · Medium
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Scope Changed
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

    • USN-6835-1
    • Ghostscript vulnerabilities
    • 17 June 2024

Other references