CVE-2024-33869
Published: 9 May 2024
An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
ghostscript
Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Released
(9.50~dfsg-5ubuntu4.12)
|
|
| jammy |
Released
(9.55.0~dfsg1-0ubuntu5.7)
|
|
| mantic |
Released
(10.01.2~dfsg1-0ubuntu2.3)
|
|
| noble |
Released
(10.02.1~dfsg1-0ubuntu7.1)
|
|
| upstream |
Released
(10.03.1~dfsg-1)
|
|
| xenial |
Needs triage
|
|
|
Patches:
upstream: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43 upstream: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f5336e5b4154f515ac83bc5b9eba94302e6618d4 |
||