CVE-2024-46953 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CISA-ADP	ADP	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 16%

Vendor	Product	Version
artifex	ghostscript	𝑥 < 10.04.0
debian	debian_linux	12.0
suse	linux_enterprise_high_performance_computing	12.0:sp5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ghostscript

bullseye	vulnerable
bullseye (security)	9.53.3~dfsg-7+deb11u10 fixed
bookworm	10.0.0~dfsg-11+deb12u7 fixed
bookworm (security)	10.0.0~dfsg-11+deb12u7 fixed
sid	10.05.1~dfsg-1 fixed
trixie	10.05.1~dfsg-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

ghostscript

oracular	Fixed 10.03.1~dfsg1-0ubuntu2.1 released
noble	Fixed 10.02.1~dfsg1-0ubuntu7.4 released
jammy	Fixed 9.55.0~dfsg1-0ubuntu5.10 released
focal	Fixed 9.50~dfsg-5ubuntu4.14 released
bionic	Fixed 9.26~dfsg+0-0ubuntu0.18.04.18+esm3 released
xenial	Fixed 9.26~dfsg+0-0ubuntu0.16.04.14+esm8 released

Common Weakness Enumeration

CWE-190 - Integer Overflow or Wraparound
The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

References

https://bugs.ghostscript.com/show_bug.cgi?id=707793

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1f21a45df0fa3abec4cff12951022b192dda3c00

https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html

https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/