Integer Overflow in Ghostscript Could Lead to Path Truncation and Code Execution

CVE-2024-46953

Summary

An integer overflow vulnerability has been identified in the Ghostscript image processing tool, specifically in the base/gsdevice.c file, prior to version 10.04.0. This flaw occurs during the parsing of the filename format string used for output file names, leading to potential truncation of file paths. As a consequence, attackers may exploit this vulnerability to execute arbitrary code or perform unauthorized path traversal operations. It is crucial for users and administrators of affected versions to implement timely updates and patches to mitigate potential risks associated with this vulnerability.

References