CVE-2024-29510
published 2024-07-03CVE-2024-29510: Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
PriorityP180medium6.3CVSS 3.1
AVLACLPRNUIRSCCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
27.97%
97.9th percentile
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | ghostscript | < 10.03.1 | 10.03.1 |
| artifex | ghostscript | >= 0 < 9.53.3~dfsg-7+deb11u7 | 9.53.3~dfsg-7+deb11u7 |
| artifex | ghostscript | >= 0 < 10.0.0~dfsg-11+deb12u4 | 10.0.0~dfsg-11+deb12u4 |
| artifex | ghostscript | >= 0 < 10.03.1~dfsg~git20240518-1 | 10.03.1~dfsg~git20240518-1 |
| artifex | ghostscript | >= 0 < 10.03.1~dfsg~git20240518-1 | 10.03.1~dfsg~git20240518-1 |
| artifex | ghostscript | >= 0 < 9.50~dfsg-5ubuntu4.12 | 9.50~dfsg-5ubuntu4.12 |
| artifex | ghostscript | >= 0 < 9.55.0~dfsg1-0ubuntu5.7 | 9.55.0~dfsg1-0ubuntu5.7 |
| artifex | ghostscript | >= 0 < 10.02.1~dfsg1-0ubuntu7.1 | 10.02.1~dfsg1-0ubuntu7.1 |
| debian | ghostscript | < ghostscript 10.0.0~dfsg-11+deb12u4 (bookworm) | ghostscript 10.0.0~dfsg-11+deb12u4 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect Ghostscript invocations selecting the uniprint output device on the command line, especially with upWriteComponentCommands or upYMoveCommand parameters containing format specifiers (e.g., %s, %n, %x). ↗
- →Monitor document processing pipelines (e.g., ImageMagick, resume/form handlers) for EPS files submitted with JPG file extensions, as this is the known attack delivery method. ↗
- →Flag Ghostscript processes spawning shell child processes, as successful exploitation results in shell command execution via SAFER sandbox bypass. ↗
- →This vulnerability is reachable via ImageMagick; monitor ImageMagick-invoked Ghostscript processes for anomalous uniprint device usage. ↗
- →The exploit is confirmed to work against Ghostscript versions 10.03.0 and 10.01.2 specifically; prioritize detection on hosts running these exact versions. ↗
- ·Passing -dSAFER on the Ghostscript command line prevents exploitation by locking security-related variables after initialization. On RHEL 9+, -dSAFER is enabled by default. ↗
- ·On RHEL 7 and RHEL 8, -dSAFER is NOT enabled by default; operators must explicitly pass it on the command line and must avoid manually selecting the uniprint output device. ↗
- ·The vulnerability is triggered specifically when uniprint device option strings (upWriteComponentCommands, upYMoveCommand) are not restricted after SAFER activation — configurations that allow post-SAFER device argument changes are vulnerable. ↗
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
osv6.3MEDIUM
vulncheck6.3MEDIUM
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
vendor_ubuntu5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Ghostscript vulnerabilities
vendor_ubuntu·2024-06-17·CVSS 5.5
CVE-2024-33871 [MEDIUM] Ghostscript vulnerabilities
Title: Ghostscript vulnerabilities
Summary: Several security issues were fixed in Ghostscript.
It was discovered that Ghostscript did not properly restrict eexec
seeds to those specified by the Type 1 Font Format standard when
SAFER mode is used. An attacker could use this issue to bypass SAFER
restrictions and cause unspecified impact. (CVE-2023-52722)
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10.
Thomas Rinsma discovered that Ghostscript did not prevent changes to
uniprint device argument strings after SAFER is activated, resulting
in a format-string vulnerability. An attacker could possibly use this
to execute arbitrary code. (CVE-2024-29510)
Zdenek Hutyra discovered that Ghostscript did not properly perform
path reduction when validating paths. An a
Red Hat
ghostscript: format string injection leads to shell command execution (SAFER bypass)
vendor_redhat·2024-05-16·CVSS 6.3
CVE-2024-29510 [MEDIUM] CWE-20 ghostscript: format string injection leads to shell command execution (SAFER bypass)
ghostscript: format string injection leads to shell command execution (SAFER bypass)
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
A flaw in Ghostscript has been identified where the uniprint device allows users to pass various string fragments as device options. These strings, particularly upWriteComponentCommands and upYMoveCommand, are treated as format strings for gp_fprintf and gs_snprintf. This lack of restriction permits arbitrary format strings with multiple specifiers, potentially leading to data leakage from the stack and memory corruption. In RHEL 9 or newer, an attacker could exploit this vulnerability to temporarily disable Ghostscript’s SAFER mode, which prevents Postscript code fro
Debian
CVE-2024-29510: ghostscript - Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox b...
vendor_debian·2024·CVSS 6.3
CVE-2024-29510 [MEDIUM] CVE-2024-29510: ghostscript - Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox b...
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
Scope: local
bookworm: resolved (fixed in 10.0.0~dfsg-11+deb12u4)
bullseye: resolved (fixed in 9.53.3~dfsg-7+deb11u7)
forky: resolved (fixed in 10.03.1~dfsg~git20240518-1)
sid: resolved (fixed in 10.03.1~dfsg~git20240518-1)
trixie: resolved (fixed in 10.03.1~dfsg~git20240518-1)
GHSA
GHSA-r824-gq56-gjgx: Artifex Ghostscript before 10
ghsa_unreviewed·2024-07-03
CVE-2024-29510 [MEDIUM] CWE-693 GHSA-r824-gq56-gjgx: Artifex Ghostscript before 10
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
OSV
CVE-2024-29510: Artifex Ghostscript before 10
osv·2024-07-03·CVSS 6.3
CVE-2024-29510 [MEDIUM] CVE-2024-29510: Artifex Ghostscript before 10
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
OSV
ghostscript vulnerabilities
osv·2024-06-17·CVSS 5.5
CVE-2023-52722 [MEDIUM] ghostscript vulnerabilities
ghostscript vulnerabilities
It was discovered that Ghostscript did not properly restrict eexec
seeds to those specified by the Type 1 Font Format standard when
SAFER mode is used. An attacker could use this issue to bypass SAFER
restrictions and cause unspecified impact. (CVE-2023-52722)
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10.
Thomas Rinsma discovered that Ghostscript did not prevent changes to
uniprint device argument strings after SAFER is activated, resulting
in a format-string vulnerability. An attacker could possibly use this
to execute arbitrary code. (CVE-2024-29510)
Zdenek Hutyra discovered that Ghostscript did not properly perform
path reduction when validating paths. An attacker could use this to
access file locations outside of those all
VulnCheck
Artifex Ghostscript SAFER Sandbox Bypass
vulncheck·2024·CVSS 6.3
CVE-2024-29510 [MEDIUM] Artifex Ghostscript SAFER Sandbox Bypass
Artifex Ghostscript SAFER Sandbox Bypass
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
Affected: Artifex Ghostscript
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://hachyderm.io/@llimllib/112722578840238142
No detection rules found.
Greynoiseio
NoiseLetter September 2025
blogs_greynoiseio
NoiseLetter September 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Greynoiseio
Storm⚡Watch: Unplugged
blogs_greynoiseio
Storm⚡Watch: Unplugged
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
https://bugs.ghostscript.com/show_bug.cgi?id=707662https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/https://www.openwall.com/lists/oss-security/2024/07/03/7https://bugs.ghostscript.com/show_bug.cgi?id=707662https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/https://www.openwall.com/lists/oss-security/2024/07/03/7https://www.vicarius.io/vsociety/posts/critical-vulnerability-in-ghostscript-cve-2024-29510
2024-07-03
Published
Exploited in the wild