CVE-2024-46955

A flaw was found in Artifex Ghostscript's psi/zcolor.c component. This vulnerability allows an out-of-bounds read, potentially leading to information disclosure via improper handling of color in the Indexed color space.

Moderate impact: A local attacker, with user interaction, can cause Ghostscript to process Indexed color data and trigger an out-of-bounds read in psi/zcolor.c, potentially disclosing information; the CVSS vector also reflects a high availability impact. Red Hat Enterprise Linux 10.0 and the Fedora 39, 40, and 41 Community Projects streams are affected. The issue is deferred for the listed Red Hat Enterprise Linux 8 and 9.5 streams because their current affects are marked DEFER, with closed Won't Do trackers where present, leaving residual risk for systems that process untrusted Indexed color data. Red Hat Enterprise Linux 7 ELS is marked OOSS and is outside supported coverage. Red Hat's Moderate assessment (CVSS 5.5) is consistent with the NIST and CISA assessments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.