Bug 2295648 (CVE-2024-29511) - CVE-2024-29511 ghostscript: ghostscript: arbitrary file read/write through Tesseract configuration
Summary: CVE-2024-29511 ghostscript: ghostscript: arbitrary file read/write through Te...
Keywords:
Status: NEW
Alias: CVE-2024-29511
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2295718
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-03 20:40 UTC by OSIDB Bzimport
Modified: 2024-10-07 07:55 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-07-03 20:40:38 UTC
Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd.

Comment 1 Anna Lime 2024-10-07 07:55:24 UTC
For those who struggle to navigate unfamiliar areas or find their way around, mapquest driving directions is an excellent tool to have on hand. 
Click https://mapsdriving-directions.io/ to use this tool


Note You need to log in before you can comment on or make changes to this bug.