OpenCVE

Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Artifex	Ghostscript

Configuration 1 [-]

cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://bugs.ghostscript.com/show_bug.cgi?id=707510
https://git.ghostscript.com/?p=ghostpdl.git%3Bh=ff1013a0ab485b66783b70145e342a82c670906a
https://lists.debian.org/debian-lts-announce/2024/10/msg00022.html
https://nvd.nist.gov/vuln/detail/CVE-2024-29508
https://www.cve.org/CVERecord?id=CVE-2024-29508
https://www.openwall.com/lists/oss-security/2024/07/03/7

History

Fri, 22 Nov 2024 12:00:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2024/10/msg00022.html

Tue, 22 Oct 2024 11:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-07-03T00:00:00

Updated: 2024-10-22T10:03:01.814Z

Reserved: 2024-03-19T00:00:00

Link: CVE-2024-29508

Vulnrichment

Updated: 2024-10-22T10:03:01.814Z

NVD

Status : Modified

Published: 2024-07-03T18:15:04.903

Modified: 2024-11-21T09:08:06.333

Link: CVE-2024-29508

Redhat

Severity : Moderate

Publid Date: 2024-07-03T00:00:00Z

Links: CVE-2024-29508 - Bugzilla

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*", "matchCriteriaId": "C94A899E-28C1-4FC0-B645-B5BE7AB34082", "versionEndExcluding": "10.03.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc."}, {"lang": "es", "value": "Artifex Ghostscript anterior a 10.03.0 tiene una divulgaci\u00f3n de puntero basada en mont\u00f3n (observable en un nombre BaseFont construido) en la funci\u00f3n pdf_base_font_alloc."}], "id": "CVE-2024-29508", "lastModified": "2024-11-21T09:08:06.333", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-03T18:15:04.903", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://bugs.ghostscript.com/show_bug.cgi?id=707510"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "https://git.ghostscript.com/?p=ghostpdl.git%3Bh=ff1013a0ab485b66783b70145e342a82c670906a"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Technical Description", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2024/07/03/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://bugs.ghostscript.com/show_bug.cgi?id=707510"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://git.ghostscript.com/?p=ghostpdl.git%3Bh=ff1013a0ab485b66783b70145e342a82c670906a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00022.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Technical Description", "Third Party Advisory"], "url": "https://www.openwall.com/lists/oss-security/2024/07/03/7"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "ghostscript: heap pointer leak in pdf_base_font_alloc()", "id": "2295627", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295627"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-401", "details": ["Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.", "A flaw was found in Ghostscript. The`pdf_base_font_alloc` function used by the `pdfwrite` device will use a hexadecimal pointer representation for the constructed BaseFont name if the input name is empty. This flaw allows an attacker to obtain this pointer value by reading back to the output file after writing to a temporary writable and readable location."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-29508", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "gimp:flatpak/ghostscript", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "ghostscript", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-29508\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-29508\nhttps://bugs.ghostscript.com/show_bug.cgi?id=707510\nhttps://git.ghostscript.com/?p=ghostpdl.git%3Bh=ff1013a0ab485b66783b70145e342a82c670906a\nhttps://www.openwall.com/lists/oss-security/2024/07/03/7"], "statement": "The vulnerability in Ghostscript\u2019s pdf_base_font_alloc function represents a moderate severity issue rather than a important one due to the nature of the exposed information. While the hexadecimal pointer representation of the BaseFont name can be read from the output file, it does not directly reveal sensitive data such as user credentials or confidential content. Instead, the pointer value may offer insights into the memory layout or internal data structures, which, although potentially useful for further exploitation, requires additional steps and context to leverage effectively.", "threat_severity": "Moderate"}