CVE-2024-29510 – Exploiting Ghostscript using format strings(codeanlabs.com)

41 pointsby ThomasRinsma2 tahun yang lalu9 comments

CVE-2024-29510 – Exploiting Ghostscript using format strings

https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/

9 comments

mistrial92 tahun yang lalu

for v10.03 or less from the article.. patched in Debian systems last May ?

https://tracker.debian.org/pkg/ghostscript

olliej2 tahun yang lalu

%n strikes again.

I believe that by default on osx %n is only respected if the format string is in readonly memory, I thought the default in Linux was to just ignore it?

pryelluw2 tahun yang lalu

Friendly question given the fatigue around bs critical CVEs. Is this properly rated?

nieve2 tahun yang lalu

It allows full RCE from an uploaded or opened file. That seems reasonably critical to me.

worthless-trash2 tahun yang lalu

Thats.. in bad faith.

If thats the qualification for "remote" then you can say that every attack is remote and it clearly isnt.

out_of_protocol2 tahun yang lalu

Does this work with .pdf files? i.e. attacker uploads evil.pdf

llimllib2 tahun yang lalu

yes, also with .eps files

pvg2 tahun yang lalu

The article describes the vulnerability in some detail so you don't have to rely on the rating at all. In fact, you can completely ignore any mention of CVEs lose nothing.

SkyPuncher2 tahun yang lalu

If I see a vulnerability in Ghostscript, I basically assume is full RCE at this point..