Heap-Based Pointer Disclosure in Ghostscript Before 10.03.0

CVE-2024-29508

What is CVE-2024-29508?

A vulnerability identified in Artifex Ghostscript prior to version 10.03.0 involves a heap-based pointer disclosure originating from the pdf_base_font_alloc function. This flaw may lead to unwanted information being exposed in constructed BaseFont names, potentially allowing an attacker to glean sensitive memory addresses. This can escalate to more severe security risks, affecting the confidentiality and integrity of the system. Users of Ghostscript should upgrade to the latest version to mitigate this vulnerability and safeguard against possible exploitation.

References