An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted.
CVSS Details
- CVSS 3.1 Base Score: 6.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ghostscript-tools-dvipdfUpgrade libgs-develUpgrade ghostscriptUpgrade ghostscript-x11Upgrade libgsUpgrade ghostscript-tools-printingUpgrade ghostscript-docUpgrade ghostscript-tools-fonts | Sep 5, 2024 | Jul 3, 2024 |
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Jul 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ghostscript-docUpgrade ghostscriptUpgrade libgsUpgrade libgs-develUpgrade ghostscript-cupsUpgrade ghostscript-gtkUpgrade ghostscript-debuginfo | Aug 14, 2024 | Jul 3, 2024 |
| Amazon_linux_2023 | — | Upgrade libgs-develUpgrade ghostscript-docUpgrade ghostscript-debugsourceUpgrade ghostscript-gtkUpgrade ghostscriptUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-x11Upgrade ghostscript-tools-printingUpgrade ghostscript-tools-dvipdfUpgrade libgsUpgrade ghostscript-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-tools-fontsUpgrade ghostscript-x11-debuginfo | Feb 17, 2025 | May 16, 2024 |
| Debian | — | Upgrade ghostscript | May 17, 2024 | May 17, 2024 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 23, 2024 | Jul 3, 2024 |
| Ghostscript | — | Upgrade to Ghostscript version 10.03.1 | Nov 19, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscriptUpgrade ghostscript-help | Oct 8, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscript-helpUpgrade ghostscript | Oct 8, 2024 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade libgsUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-fontsUpgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-tools-dvipdfUpgrade libgs-devel | Oct 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade ghostscript-docUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printingUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-debugsourceUpgrade libgs-develNo solution existsUpgrade ghostscript-gtk-debuginfoUpgrade ghostscriptUpgrade ghostscript-debuginfoUpgrade libgs-debuginfoUpgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-x11 | Sep 10, 2024 | Jul 3, 2024 |
| Rocky_linux | — | Upgrade ghostscript-tools-printingUpgrade ghostscript-debuginfoUpgrade ghostscript-debugsourceUpgrade ghostscript-tools-fontsUpgrade libgs-debuginfoUpgrade ghostscript-x11Upgrade libgs-develUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-x11-debuginfoUpgrade libgsUpgrade ghostscript | May 8, 2025 | Jul 3, 2024 |
| Suse | — | Upgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-devel | Jul 3, 2024 | Jul 2, 2024 |
| Ubuntu | — | Upgrade ghostscript-docUpgrade libgs9-commonUpgrade ghostscript-xUpgrade ghostscriptUpgrade libgs10-commonUpgrade libgs-devUpgrade libgs-commonUpgrade libgs9Upgrade libgs10 | Jun 21, 2024 | Jun 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub