An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ghostscriptUpgrade ghostscript-x11Upgrade libgsUpgrade libgs-develUpgrade ghostscript-docUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-fonts | Sep 5, 2024 | Jul 3, 2024 |
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Jul 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade libgsUpgrade ghostscript-debuginfoUpgrade libgs-develUpgrade ghostscriptUpgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscript-doc | Aug 14, 2024 | Jul 3, 2024 |
| Amazon_linux_2023 | — | Upgrade ghostscript-debuginfoUpgrade libgsUpgrade ghostscript-x11Upgrade libgs-develUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-tools-fontsUpgrade ghostscriptUpgrade ghostscript-debugsourceUpgrade ghostscript-x11-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-tools-printingUpgrade ghostscript-docUpgrade ghostscript-gtk | Feb 17, 2025 | May 16, 2024 |
| Debian | — | Upgrade ghostscript | May 17, 2024 | May 17, 2024 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 23, 2024 | Jul 3, 2024 |
| Ghostscript | — | Upgrade to Ghostscript version 10.03.1 | Nov 19, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscriptUpgrade ghostscript-help | Oct 8, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscriptUpgrade ghostscript-help | Oct 8, 2024 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade ghostscript-docUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-dvipdfUpgrade ghostscriptUpgrade libgsUpgrade ghostscript-tools-fontsUpgrade ghostscript-x11Upgrade libgs-devel | Oct 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade libgs-develUpgrade ghostscript-x11Upgrade ghostscript-docUpgrade ghostscript-debugsourceUpgrade ghostscriptNo solution existsUpgrade ghostscript-x11-debuginfoUpgrade libgsUpgrade libgs-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-debuginfoUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printing | Sep 10, 2024 | Jul 3, 2024 |
| Rocky_linux | — | Upgrade ghostscript-debugsourceUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-fontsUpgrade ghostscript-x11-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-tools-dvipdfUpgrade libgs-develUpgrade ghostscript-x11Upgrade ghostscriptUpgrade ghostscript-debuginfoUpgrade libgs | May 8, 2025 | Jul 3, 2024 |
| Suse | — | Upgrade ghostscriptUpgrade ghostscript-develUpgrade ghostscript-x11 | Jul 3, 2024 | Jul 2, 2024 |
| Ubuntu | — | Upgrade ghostscript-docUpgrade libgs-commonUpgrade libgs10-commonUpgrade ghostscriptUpgrade libgs9-commonUpgrade ghostscript-xUpgrade libgs9Upgrade libgs10Upgrade libgs-dev | Jun 21, 2024 | Jun 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub