CVE-2024-46954 — Path Traversal in Ghostscript

CWE-22 — Path TraversalCWE-24 — Path Traversal: '../filedir'8 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 67.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Artifex Ghostscript
Timeline
PublishedNov 10
Latest updateApr 26

Description

An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../ directory traversal.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5artifex/ghostscript< 10.05.0
▶NVDartifex/ghostscript< 10.04.0
▶Debianartifex/ghostscript< 10.04.0~dfsg-1+1

Patches

Patch: cgit.ghostscript.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-2v5c-72gh-q5f7: An issue was discovered in decode_utf8 in base/gp_utf8↗2024-11-11
▶
CVEList
CVE-2024-46954: An issue was discovered in decode_utf8 in base/gp_utf8↗2024-11-10
▶
OSV
CVE-2024-46954: An issue was discovered in decode_utf8 in base/gp_utf8↗2024-11-10
▶

📋Vendor Advisories

4
Red Hat
Ghostscript: Mishandling of Overlong UTF-8 Encoding in Artifex Ghostscript's decode_utf8 Function↗2025-04-26
▶
Ubuntu
Ghostscript vulnerabilities↗2024-11-12
▶
Red Hat
ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding↗2024-11-10
▶
Debian
CVE-2024-46954: ghostscript - An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript ...↗2024
▶