CVE-2024-46955

MEDIUM

Artifex Ghostscript < 10.04.0 - Out-of-Bounds Read

Title source: rule

Description

An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. There is an out-of-bounds read when reading color in Indexed color space.

References (5)

Core 5

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2024/11/msg00023.html

Permissions Required

https://bugs.ghostscript.com/show_bug.cgi?id=707990

Patch

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=85bd9d2f4b792fe67aef22f1a4117457461b8ba6

Product

https://github.com/ArtifexSoftware/ghostpdl/blob/master/doc/News.html

View Writeup ZIP pw:eip

Third Party Advisory

https://www.suse.com/support/update/announcement/2024/suse-su-20243942-1/

Scores

CVSS v3 5.5

EPSS 0.0004

EPSS Percentile 13.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-125

Status published

Products (5)

artifex/ghostscript < 10.04.0

debian/debian_linux 12.0

suse/linux_enterprise_high_performance_computing 12.0 sp5

suse/linux_enterprise_server 12 sp5 (3 CPE variants)

suse/linux_enterprise_server_for_sap 12 sp5

Published Nov 10, 2024

Tracked Since Feb 18, 2026