Researchers at Codean Labs discovered a critical format string vulnerability in Ghostscript, a widely-used document conversion tool, that allows attackers to bypass the -dSAFER sandbox and achieve remote code execution.
By exploiting a format string in the “uniprint” device’s configuration, they developed a technique to read and write arbitrary memory locations, ultimately allowing them to disable Ghostscript’s security protections and execute shell commands.
This vulnerability has significant implications for web applications and services that use Ghostscript for document preview and conversion, potentially exposing systems to remote attacks through maliciously crafted files.
Artifex fixed CVE-2024-29510 in Ghostscript 10.03.1, released on 2 May 2024, two months before Codean Labs published the details.
Additional research covers abusing Ghostscript’s OCR device and a comprehensive wrap-up on buffer overflows in the software.
