It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
- CVSS 3.0 Base Score: 7.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Mar 25, 2019 |
| Amazon Linux Ami 2 | — | Upgrade ghostscript-cupsUpgrade ghostscript-gtkUpgrade ghostscript-debuginfoUpgrade libgs-develUpgrade ghostscript-docUpgrade libgsUpgrade ghostscript | Feb 22, 2021 | Mar 25, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Mar 25, 2019 |
| Centos_linux | — | Upgrade libgs-debuginfoUpgrade ghostscript-debuginfoUpgrade libgsUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-develUpgrade ghostscript-debugsourceUpgrade ghostscript-gtkUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-cupsUpgrade ghostscript-docUpgrade ghostscript | Apr 1, 2019 | Mar 22, 2019 |
| Debian | — | Upgrade ghostscript | Apr 18, 2019 | Mar 25, 2019 |
| Freebsd | — | Upgrade ghostscript9-agpl-baseUpgrade ghostscript9-agpl-x11 | Apr 22, 2019 | Apr 21, 2019 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Apr 2, 2020 | Mar 25, 2019 |
| Ghostscript | — | Upgrade to Ghostscript version 9.27 | Apr 8, 2019 | Mar 25, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ghostscript-cupsUpgrade ghostscript | May 1, 2019 | Mar 25, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ghostscript-cupsUpgrade ghostscript | May 1, 2019 | Mar 25, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ghostscript-cupsUpgrade ghostscript | May 1, 2019 | Mar 25, 2019 |
| Oracle Solaris | — | Upgrade print/filter/ghostscript-core to version 9.27-11.4.13.0.1.3.0 on Solaris 11.4Upgrade print/filter/ghostscript to version 9.27-11.4.13.0.1.3.0 on Solaris 11.4 | Sep 17, 2019 | Mar 25, 2019 |
| Oracle_linux | — | Upgrade libgs-develUpgrade ghostscript-gtkUpgrade ghostscript-x11Upgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-cupsUpgrade ghostscript-develUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-fontsUpgrade libgs | Jul 21, 2020 | Mar 21, 2019 |
| Redhat_linux | — | Upgrade ghostscript-docUpgrade ghostscriptUpgrade libgs-debuginfoUpgrade ghostscript-tools-printingUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-debuginfoUpgrade ghostscript-x11-debuginfoUpgrade libgsUpgrade ghostscript-tools-fontsUpgrade libgs-develNo solution existsUpgrade ghostscript-x11Upgrade ghostscript-debugsourceUpgrade ghostscript-tools-dvipdf | Mar 22, 2019 | Mar 21, 2019 |
| Suse | — | Upgrade ghostscript-fonts-rusUpgrade ghostscript-mini-develUpgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-fonts-stdUpgrade libgimpprintUpgrade ghostscript-omniUpgrade ghostscript-libraryUpgrade ghostscript-fonts-otherUpgrade ghostscript-miniUpgrade ghostscript-devel | Apr 1, 2019 | Mar 22, 2019 |
| Ubuntu | — | Upgrade ghostscriptUpgrade libgs9 | Apr 1, 2019 | Mar 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub