CVE-2024-29508

Aliases:DEBIAN-CVE-2024-29508
Advisory lineage Upstream: 0 Downstream: 8
Modified
Published: 03 Jul 2024, 00:00
Last modified:17 Mar 2025, 13:50

Vulnerability Summary

Overall Risk (default)
low
13/100
CVSS Score
3.3 LOW
v3.1 (cve.org)
EPSS Score
0.38% LOW
0% probability +0.34%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

03 Jul 2024, 00:00
Published
Vulnerability first disclosed
17 Mar 2025, 13:50
Last Modified
Vulnerability information updated

Description

Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.

CVSS Metrics

  • v3.1•LOW•Score: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.38%• Percentile: 31%

Techniques & Countermeasures

  • CWE-122•Heap-based Buffer Overflow

    A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Affected Systems

  • artifex•ghostscript

    < 10.03.0

  • debian•ghostscript

    < 9.53.3~dfsg-7+deb11u8 | < 10.0.0~dfsg-11+deb12u5 | < 10.03.0~dfsg-1 | < 10.03.0~dfsg-1

References (5)