In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libgs-develUpgrade ghostscript-tools-printingUpgrade libgsUpgrade ghostscript-tools-fontsUpgrade ghostscriptUpgrade ghostscript-docUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-x11 | Nov 6, 2023 | Sep 18, 2023 |
| Alpine Linux | — | Upgrade ghostscript | Mar 26, 2024 | Sep 18, 2023 |
| Amazon_linux_2023 | — | Upgrade ghostscript-docUpgrade libgs-develUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-dvipdfUpgrade libgsUpgrade ghostscript-x11Upgrade libgs-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-debugsourceUpgrade ghostscriptUpgrade ghostscript-gtkUpgrade ghostscript-tools-printingUpgrade ghostscript-debuginfo | Feb 17, 2025 | Sep 18, 2023 |
| Centos_linux | — | Upgrade ghostscript-tools-dvipdfUpgrade ghostscript-debuginfoUpgrade libgsUpgrade ghostscript-tools-fontsUpgrade ghostscript-x11Upgrade libgs-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-tools-printingUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-docUpgrade ghostscript-debugsourceUpgrade ghostscript | Nov 3, 2023 | Sep 18, 2023 |
| Debian | — | Upgrade ghostscript | Jul 30, 2024 | Sep 18, 2023 |
| Ghostscript | — | Upgrade to Ghostscript version 10.02.0 | Jan 24, 2024 | Sep 18, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscriptUpgrade ghostscript-help | Jan 10, 2024 | Sep 18, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscriptUpgrade ghostscript-help | Jan 10, 2024 | Sep 18, 2023 |
| Oracle_linux | — | Upgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-dvipdfUpgrade ghostscriptUpgrade libgsUpgrade ghostscript-x11Upgrade ghostscript-docUpgrade libgs-devel | Nov 3, 2023 | Sep 18, 2023 |
| Redhat_linux | — | Upgrade ghostscript-tools-fontsUpgrade libgs-develUpgrade libgs-debuginfoUpgrade ghostscript-docUpgrade ghostscript-gtk-debuginfoUpgrade libgsUpgrade ghostscript-x11Upgrade ghostscript-tools-dvipdfUpgrade ghostscript-tools-printingUpgrade ghostscriptUpgrade ghostscript-debugsourceUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-debuginfoNo solution exists | Nov 1, 2023 | Sep 18, 2023 |
| Suse | — | Upgrade ghostscript-x11Upgrade ghostscriptUpgrade ghostscript-devel | Oct 4, 2023 | Sep 18, 2023 |
| Ubuntu | — | Upgrade ghostscript | Oct 18, 2023 | Sep 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub