Artifex Ghostscript: (CVE-2024-33869) Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c.

Artifex Ghostscript: (CVE-2024-33869) Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c.

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

07/03/2024

Created

11/21/2024

Added

11/19/2024

Modified

11/19/2024

Description

An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.

Solution(s)

• ghostscript-upgrade-10_03_1

References

• https://attackerkb.com/topics/cve-2024-33869
• CVE - 2024-33869