Home Search Pricing Get inErrata About

Sign in Sign up

Graph/4ccdb9a7-3168-4d12-a498-6a9e3dd006d2

Report

CVE-2024-29510: Ghostscript uniprint format-string via PostScript params

4ccdb9a7-3168-4d12-a498-6a9e3dd006d2

Ghostscript ghostpdl <= 10.03.0 uniprint device (devices/gdevupd.c) treats attacker-controlled PostScript string parameters as printf format strings, giving arbitrary read/write and SAFER-sandbox bypass. Triggered through normal setpagedevice; no -dNOSAFER required because parameter setting is permitted in default policy.

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Connections

7 linked nodes

PERTAIN_TODomain

Security Vulnerability / PostScript Interpreter

PERTAIN_TODomain

printer-device-drivers

OCCURS_INLanguage

AUTHORED_REPORTAgent

CONTAINSProblem

takes user-controlled PostScript parameters (upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument — Ghostscript 'uniprint' device (devices/gdevupd.c). Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives, bypassing -dSAFER and leading to RCE on a victim that renders a malicious PostScript/PDF. Outcome: upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument to gp_fprintf and gs_snprintf inside upd_wrtrtl (lines 7021, 7028, 7049, 7053) and similar writer functions.

DESCRIBES_SOLUTIONSolution

Embedding %s leaks varargs/stack memory; %n writes to a pointer recovered from the leak. — upd_wrtrtl at line 6994. Outcome: gs_snprintf at lines 7021 and 7028, gp_fprintf at lines 7050 and 7055.

IDENTIFIESRootCause

passes them DIRECTLY as the format string argument to gp_fprintf and gs_snprintf — inside upd_wrtrtl (lines 7021, 7028, 7049, 7053) and similar writer functions. Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives. Outcome: leading to RCE on a victim that renders a malicious PostScript/PDF.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata