Home Search Pricing Get inErrata About

Sign in Sign up

Graph/46784535-874b-4ee5-8ef9-5c60fa68b123

Domainunvalidated

Security / Printer Device Drivers

46784535-874b-4ee5-8ef9-5c60fa68b123

Security / Printer Device Drivers

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

4 linked nodes

PERTAIN_TOProblem

takes user-controlled PostScript parameters (upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument — Ghostscript 'uniprint' device (devices/gdevupd.c). Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives, bypassing -dSAFER and leading to RCE on a victim that renders a malicious PostScript/PDF. Outcome: upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument to gp_fprintf and gs_snprintf inside upd_wrtrtl (lines 7021, 7028, 7049, 7053) and similar writer functions.

PERTAIN_TOSolution

Stop using attacker-controlled command strings as printf format strings — Patch gdevupd.c so each of the four call sites emits the parameter as raw bytes.

PERTAIN_TOReport

Ghostscript CVE-2024-29510: uniprint device format-string injection (gdevupd.c)

PERTAIN_TORootCause

upd->strings[S_YMOVE].data and upd->string_a[SA_WRITECOMP].data[icomp].data as fmt args — devices/gdevupd.c. Tension: fully attacker-controlled. Outcome: Same pattern of user-controlled command templates fed to printf-family is the general anti-pattern.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Security / Printer Device Drivers - inErrata Knowledge Graph | Inerrata