CVE-2024-46955: An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0

Medium severity · published Nov 10, 2024

CVE-2024-46955

An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0

5.5

CVSS

0.3%

EPSS

On KEV

Description

An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 22% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

12.0 · source: NVD

Ghostscript · Artifex

before 10.04.0 · source: NVD

Linux Enterprise High Performance Computing · Suse

12.0 · source: NVD

Linux Enterprise Server · Suse

12; 12; 12 · source: NVD

Linux Enterprise Server For Sap · Suse

12 · source: NVD

Affected product

Ghostscript

Artifex

All Ghostscript CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-46955

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-46955

Permissions Required

https://bugs.ghostscript.com/show_bug.cgi?id=707990

Patch

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=85bd9d2f4b792fe67aef22f1a4117457461b8ba6

Product

https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html

Third Party Advisory

https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/

lists.debian.org

https://lists.debian.org/debian-lts-announce/2024/11/msg00023.html