CVE-2024-46954

What it actually does

Overlong UTF-8 encoding in decode_utf8 allows ../ directory traversal, enabling access to files outside intended directories.

Why it matters to the business

Attackers could read or manipulate files on systems processing untrusted input, leading to data exposure or system compromise in environments using the affected software.

How an attack unfolds

An attacker supplies input containing overlong UTF-8 sequences that decode to path traversal sequences, bypassing intended restrictions in the affected component.

How to fix it

Upgrade flashplugin-nonfree on Ubuntu 14.04 LTS to version 11.2.202.548ubuntu0.14.04.1 or later; for Ghostscript installations ensure version 10.04.0 or newer is deployed.

How to confirm the fix worked

Verify installed package versions match the fixed releases; test decode_utf8 behavior with sample overlong UTF-8 inputs to confirm traversal is blocked.

Typical attack path

1. Identify a vector that invokes decode_utf8 on attacker-controlled data
2. Craft input using overlong UTF-8 encodings for ../ sequences
3. Submit the input to trigger traversal and access restricted paths

How to detect it

Review application and system logs for unusual file path references containing repeated ../ patterns or anomalous UTF-8 sequences around the time of processing untrusted input.

What your security team should do

• Apply the listed fixed package versions immediately across all affected Ubuntu 14.04 systems
• Scan for any custom or third-party integrations that invoke the vulnerable decode function
• Monitor for path traversal attempts in application logs until patches are complete