CVE-2024-29507: 
Ghostscript vulnerability analysis and mitigation

Artifex Ghostscript before version 10.03.0 contains a stack-based buffer overflow vulnerability identified as CVE-2024-29507. The vulnerability exists in the handling of CIDFSubstPath and CIDFSubstFont parameters, where under specific conditions these parameters are used to load substitute fonts without proper bounds checking (Debian Tracker, NVD).

The vulnerability occurs in the pdfi_open_CIDFont_substitute_file function where the values of cidfsubstpath and cidfsubstfont parameters are copied into the fontfname buffer using memcpy without proper bounds checks. The fontfname buffer has a fixed size of 4096 bytes (gp_file_name_sizeof), and an attacker can trigger a stack buffer overflow by passing values larger than this buffer size (OSS Security).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, and can result in limited impact to both integrity and availability of the affected system (NVD).

The vulnerability was discovered and reported by security researchers, and a fix was implemented in Ghostscript version 10.03.0. The issue was introduced in ghostpdl-9.55.0rc1 and fixed by commit 7745dbe24514710b0cfba925e608e607dee9eb0f in ghostpdl-10.03.0 (Debian Tracker).

The vulnerability has been fixed in Ghostscript version 10.03.0 and later. Users are advised to upgrade to the latest version. For systems that cannot be immediately upgraded, no specific workarounds have been publicly documented (Debian Tracker).