CVE-2024-29507
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the...
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
- Record
CVE-2024-29507- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2024-26510
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
- Record
EUVD-2024-26510- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mjm5-gj95-f347
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the...
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
- Record
GHSA-mjm5-gj95-f347- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
- Record
CVE-2024-29507- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVBELL-CVE-2024-29507
- Record
BELL-CVE-2024-29507- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSV
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
- Record
CVE-2024-29507- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2024-29507
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
- Record
DEBIAN-CVE-2024-29507- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2024-2454
ghostscript security update
Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.
Security Fix(es):
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.(CVE-2024-29507)
An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.(CVE-2024-33871)
- Record
OESA-2024-2454- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2455
ghostscript security update
Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.
Security Fix(es):
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.(CVE-2024-29507)
- Record
OESA-2024-2455- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVOESA-2024-2456
ghostscript security update
Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.
Security Fix(es):
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.(CVE-2024-29507)
An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.(CVE-2024-33871)
- Record
OESA-2024-2456- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2457
ghostscript security update
Ghostscript is an interpreter for PostScript™ and Portable Document Format (PDF) files. Ghostscript consists of a PostScript interpreter layer, and a graphics library.
Security Fix(es):
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.(CVE-2024-29507)
An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.(CVE-2024-33871)
- Record
OESA-2024-2457- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-29507
Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
- Record
UBUNTU-CVE-2024-29507- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVUSN-6897-1 No score
ghostscript vulnerabilities
It was discovered that Ghostscript incorrectly handled certain long PDF filter names. An attacker could possibly use this issue to cause Ghostscript to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-29506)
It was discovered that Ghostscript incorrectly handled certain API parameters. An attacker could possibly use this issue to cause Ghostscript to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-29507)
It was discovered that Ghostscript incorrectly handled certain BaseFont names. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-29508)
It was discovered that Ghostscript incorrectly handled certain PDF passwords that contained NULL bytes. An attacker could use this issue to cause Ghostscript to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-29509)
It was discovered that Ghostscript incorrectly handled certain certain file paths when doing OCR. An attacker could use this issue to read arbitrary files and write error messages to arbitrary files. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-29511)
- Record
USN-6897-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ghostscriptAlpaquita:23 |
10.0.0-r0 and later | None known |
ghostscriptAlpaquita:stream |
10.0.0-r0 up to 10.03.1-r0 | 10.03.1-r0 |
ghostscriptDebian:12 |
before 10.0.0~dfsg-11+deb12u5, plus listed versions 10.0.0~dfsg-1110.0.0~dfsg-11+deb12u110.0.0~dfsg-11+deb12u210.0.0~dfsg-11+deb12u310.0.0~dfsg-11+deb12u4 |
10.0.0~dfsg-11+deb12u5 |
ghostscriptDebian:13 |
before 10.03.0~dfsg-1 | 10.03.0~dfsg-1 |
ghostscriptDebian:14 |
before 10.03.0~dfsg-1 | 10.03.0~dfsg-1 |
ghostscriptopenEuler:22.03-LTS-SP1 |
before 9.55.0-16.oe2203sp1 | 9.55.0-16.oe2203sp1 |
ghostscriptopenEuler:24.03-LTS |
before 9.56.1-13.oe2403 | 9.56.1-13.oe2403 |
ghostscriptopenEuler:22.03-LTS-SP4 |
before 9.55.0-17.oe2203sp4 | 9.55.0-17.oe2203sp4 |
ghostscriptopenEuler:22.03-LTS-SP3 |
before 9.55.0-17.oe2203sp3 | 9.55.0-17.oe2203sp3 |
ghostscriptUbuntu:24.04:LTS |
before 10.02.1~dfsg1-0ubuntu7.3, plus listed versions 10.01.2~dfsg1-0ubuntu210.01.2~dfsg1-0ubuntu2.110.02.1~dfsg1-0ubuntu110.02.1~dfsg1-0ubuntu210.02.1~dfsg1-0ubuntu510.02.1~dfsg1-0ubuntu610.02.1~dfsg1-0ubuntu710.02.1~dfsg1-0ubuntu7.1 |
10.02.1~dfsg1-0ubuntu7.3 |
ghostscriptUbuntu:20.04:LTS |
before 9.50~dfsg-5ubuntu4.13, plus listed versions 9.27~dfsg+0-0ubuntu39.27~dfsg+0-0ubuntu49.50~dfsg-5ubuntu19.50~dfsg-5ubuntu29.50~dfsg-5ubuntu3 Show 13 moreShow less9.50~dfsg-5ubuntu49.50~dfsg-5ubuntu4.19.50~dfsg-5ubuntu4.29.50~dfsg-5ubuntu4.39.50~dfsg-5ubuntu4.49.50~dfsg-5ubuntu4.59.50~dfsg-5ubuntu4.69.50~dfsg-5ubuntu4.79.50~dfsg-5ubuntu4.89.50~dfsg-5ubuntu4.99.50~dfsg-5ubuntu4.109.50~dfsg-5ubuntu4.119.50~dfsg-5ubuntu4.12 |
9.50~dfsg-5ubuntu4.13 |
ghostscriptUbuntu:22.04:LTS |
before 9.55.0~dfsg1-0ubuntu5.9, plus listed versions 9.54.0~dfsg1-0ubuntu29.55.0~dfsg1-0ubuntu49.55.0~dfsg1-0ubuntu59.55.0~dfsg1-0ubuntu5.19.55.0~dfsg1-0ubuntu5.2 Show 5 moreShow less9.55.0~dfsg1-0ubuntu5.39.55.0~dfsg1-0ubuntu5.49.55.0~dfsg1-0ubuntu5.59.55.0~dfsg1-0ubuntu5.69.55.0~dfsg1-0ubuntu5.7 |
9.55.0~dfsg1-0ubuntu5.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29507 is a medium vulnerability (CVSS 5.4) in Artifex Ghostscript, published July 3, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 53rd percentile. Fixed in ghostscript 10.03.1-r0.
References
bugs.ghostscript.com/show_bug.cgi?id=707510
git.ghostscript.com?p=ghostpdl.git%3Ba=commitdiff%3Bh=7745dbe24514
openwall.com/lists/oss-security/2024/07/03/7
nvd.nist.gov/vuln/detail/CVE-2024-29507
github.com/advisories/GHSA-mjm5-gj95-f347
docs.bell-sw.com/security/cves/CVE-2024-29507
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2024-29507
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2454
ubuntu.com/security/CVE-2024-29507
cve.org/CVERecord?id=CVE-2024-29507