CVE catalog

CVE-2024-46954

Ghostscript vulnerabilities

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Oct 23, 2024, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.55% · Oct 25, 2026

A flaw was found in Ghostscript/base/gp_utf8.c. This vulnerability allows directory traversal via overlong UTF-8 encoding, potentially leading to unauthorized access to filesystem directories. ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ghostscript	sid	`10.08.0~dfsg-2`	fixed
Debian	ghostscript	forky	`10.08.0~dfsg-2`	fixed
Debian	ghostscript	trixie	`10.05.1~dfsg-1+deb13u1`	fixed
Debian	ghostscript	trixie-security	`10.05.1~dfsg-1+deb13u3`	fixed
Debian	ghostscript	bookworm	`10.0.0~dfsg-11+deb12u8`	not affected
Debian	ghostscript	bookworm-security	`10.0.0~dfsg-11+deb12u8`	not affected
Ubuntu	ghostscript	noble	Not reported	not affected
Ubuntu	ghostscript	noble	`10.02.1~dfsg1-0ubuntu7.4`	fixed
Ubuntu	ghostscript-doc	noble	`10.02.1~dfsg1-0ubuntu7.4`	fixed
Ubuntu	libgs-common	noble	`10.02.1~dfsg1-0ubuntu7.4`	fixed
Ubuntu	libgs-dev	noble	`10.02.1~dfsg1-0ubuntu7.4`	fixed
Ubuntu	libgs10	noble	`10.02.1~dfsg1-0ubuntu7.4`	fixed
Ubuntu	libgs10-common	noble	`10.02.1~dfsg1-0ubuntu7.4`	fixed
Alpine	ghostscript	3.18	`10.04.0-r0`	fixed
Alpine	ghostscript	3.19	`10.04.0-r0`	fixed
Alpine	ghostscript	3.20	`10.04.0-r0`	fixed
Alpine	ghostscript	3.21	`10.04.0-r0`	fixed
Alpine	ghostscript	3.22	`10.04.0-r0`	fixed
Alpine	ghostscript	3.23	`10.04.0-r0`	fixed
Ubuntu	ghostscript	24.04	`10.01.2~dfsg1-0ubuntu2`	vulnerable
Ubuntu	ghostscript	24.04	`10.01.2~dfsg1-0ubuntu2.1`	vulnerable
Ubuntu	ghostscript	24.04	`10.02.1~dfsg1-0ubuntu1`	vulnerable
Ubuntu	ghostscript	24.04	`10.02.1~dfsg1-0ubuntu2`	vulnerable
Ubuntu	ghostscript	24.04	`10.02.1~dfsg1-0ubuntu5`	vulnerable
Ubuntu	ghostscript	24.04	`10.02.1~dfsg1-0ubuntu6`	vulnerable
Ubuntu	ghostscript	24.04	`10.02.1~dfsg1-0ubuntu7`	vulnerable
Ubuntu	ghostscript	24.04	`10.02.1~dfsg1-0ubuntu7.1`	vulnerable
Ubuntu	ghostscript	24.04	`10.02.1~dfsg1-0ubuntu7.3`	vulnerable
Ubuntu	ghostscript	24.04	`10.02.1~dfsg1-0ubuntu7.4`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ghostscript	source	sid	`10.04.0~dfsg-1`	not yet assigned	Not reported	Not reported
Debian	ghostscript	source	forky	`10.04.0~dfsg-1`	not yet assigned	Not reported	Not reported
Debian	ghostscript	source	trixie	`10.04.0~dfsg-1`	not yet assigned	Not reported	Not reported
Debian	ghostscript	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Ubuntu	ghostscript	deb	noble	`10.02.1~dfsg1-0ubuntu7.4`	Not reported	Not reported	Not reported
Ubuntu	ghostscript-doc	deb	noble	`10.02.1~dfsg1-0ubuntu7.4`	Not reported	Not reported	Not reported
Ubuntu	libgs-common	deb	noble	`10.02.1~dfsg1-0ubuntu7.4`	Not reported	Not reported	Not reported
Ubuntu	libgs-dev	deb	noble	`10.02.1~dfsg1-0ubuntu7.4`	Not reported	Not reported	Not reported
Ubuntu	libgs10	deb	noble	`10.02.1~dfsg1-0ubuntu7.4`	Not reported	Not reported	Not reported
Ubuntu	libgs10-common	deb	noble	`10.02.1~dfsg1-0ubuntu7.4`	Not reported	Not reported	Not reported
Alpine	ghostscript	apk	3.18	`10.04.0-r0`	Not reported	ALPINE-CVE-2024-46954	Not reported
Alpine	ghostscript	apk	3.19	`10.04.0-r0`	Not reported	ALPINE-CVE-2024-46954	Not reported
Alpine	ghostscript	apk	3.20	`10.04.0-r0`	Not reported	ALPINE-CVE-2024-46954	Not reported
Alpine	ghostscript	apk	3.21	`10.04.0-r0`	Not reported	ALPINE-CVE-2024-46954	Not reported
Alpine	ghostscript	apk	3.22	`10.04.0-r0`	Not reported	ALPINE-CVE-2024-46954	Not reported
Alpine	ghostscript	apk	3.23	`10.04.0-r0`	Not reported	ALPINE-CVE-2024-46954	Not reported
Ubuntu	ghostscript	deb	24.04	`10.02.1~dfsg1-0ubuntu7.4`	Not reported	UBUNTU-CVE-2024-46954	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[ghostscript]Not affected
Details (4)
- 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
[ghostscript-doc]Not affected
Source package: [ghostscript]
Details (4)
- 10.0.0~dfsg-11+deb12u8 · all · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
[ghostscript-x]Not affected
Source package: [ghostscript]
Details (4)
- 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
[libgs10]Not affected
Source package: [ghostscript]
Details (4)
- 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
[libgs10-common]Not affected
Source package: [ghostscript]
Details (4)
- 10.0.0~dfsg-11+deb12u8 · all · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
[libgs9-common]Not affected
Source package: [ghostscript]
Details (4)
- 10.0.0~dfsg-11+deb12u8 · all · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
[libgs-common]Not affected
Source package: [ghostscript]
Details (4)
- 10.0.0~dfsg-11+deb12u8 · all · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · all · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
[libgs-dev]Not affected
Source package: [ghostscript]
Details (4)
- 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · amd64 · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm
- 10.0.0~dfsg-11+deb12u8 · arm64 · bookworm-security
  Not affected
  usn · ghostscript · debian · bookworm

[Debian 13 (Trixie)]

[ghostscript]Fixed
Details (6)
- 10.05.1~dfsg-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
[ghostscript-doc]Fixed
Source package: [ghostscript]
Details (6)
- 10.05.1~dfsg-1+deb13u1 · all · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · all · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u3 · all · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
[libgs10]Fixed
Source package: [ghostscript]
Details (6)
- 10.05.1~dfsg-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
[libgs10-common]Fixed
Source package: [ghostscript]
Details (6)
- 10.05.1~dfsg-1+deb13u1 · all · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · all · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u3 · all · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
[libgs-common]Fixed
Source package: [ghostscript]
Details (6)
- 10.05.1~dfsg-1+deb13u1 · all · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · all · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · all · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u2 · all · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u3 · all · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
[libgs-dev]Fixed
Source package: [ghostscript]
Details (6)
- 10.05.1~dfsg-1+deb13u1 · amd64 · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · arm64 · trixie
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u2 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13
- 10.05.1~dfsg-1+deb13u3 · amd64 · trixie-security
  Fixed · Fixed: 10.04.0~dfsg-1
  usn · ghostscript · debian · 13

Observed: Oct 27, 2026, 6:54:12 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]