Amazon Linux AMI 2: CVE-2024-29508: Security patch for ghostscript (ALAS-2024-2614)

Amazon Linux AMI 2: CVE-2024-29508: Security patch for ghostscript (ALAS-2024-2614)

Severity

2

CVSS

(AV:L/AC:L/Au:S/C:P/I:N/A:N)

Published

07/03/2024

Created

08/14/2024

Added

08/14/2024

Modified

01/28/2025

Description

Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.

Solution(s)

• amazon-linux-ami-2-upgrade-ghostscript
• amazon-linux-ami-2-upgrade-ghostscript-cups
• amazon-linux-ami-2-upgrade-ghostscript-debuginfo
• amazon-linux-ami-2-upgrade-ghostscript-doc
• amazon-linux-ami-2-upgrade-ghostscript-gtk
• amazon-linux-ami-2-upgrade-libgs
• amazon-linux-ami-2-upgrade-libgs-devel

References

• https://attackerkb.com/topics/cve-2024-29508
• AL2/ALAS-2024-2614
• CVE - 2024-29508