CVE-2024-46953
Published: 10 November 2024
Summary
CVE-2024-46953 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Suse Linux Enterprise Server. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 28.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42156
Vulnerability details
An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format string (for the output filename) results in path truncation, and possible path traversal and code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2024-46953 enables arbitrary code execution via integer overflow in Ghostscript's filename parsing, facilitating exploitation of client-side software when processing malicious PostScript/PDF files.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.