In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-ghostscriptalma-upgrade-ghostscript-docalma-upgrade-ghostscript-tools-dvipdfalma-upgrade-ghostscript-tools-fontsalma-upgrade-ghostscript-tools-printingalma-upgrade-ghostscript-x11alma-upgrade-libgsalma-upgrade-libgs-devel | Nov 6, 2023 | Sep 18, 2023 | |
| Alpine Linux | alpine-linux-upgrade-ghostscript | Mar 26, 2024 | Sep 18, 2023 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-ghostscriptamazon-linux-2023-upgrade-ghostscript-debuginfoamazon-linux-2023-upgrade-ghostscript-debugsourceamazon-linux-2023-upgrade-ghostscript-docamazon-linux-2023-upgrade-ghostscript-gtkamazon-linux-2023-upgrade-ghostscript-gtk-debuginfoamazon-linux-2023-upgrade-ghostscript-tools-dvipdfamazon-linux-2023-upgrade-ghostscript-tools-fontsamazon-linux-2023-upgrade-ghostscript-tools-printingamazon-linux-2023-upgrade-ghostscript-x11amazon-linux-2023-upgrade-ghostscript-x11-debuginfoamazon-linux-2023-upgrade-libgsamazon-linux-2023-upgrade-libgs-debuginfoamazon-linux-2023-upgrade-libgs-devel | Feb 17, 2025 | Sep 18, 2023 | |
| Centos_linux | — | centos-upgrade-ghostscriptcentos-upgrade-ghostscript-debuginfocentos-upgrade-ghostscript-debugsourcecentos-upgrade-ghostscript-doccentos-upgrade-ghostscript-gtk-debuginfocentos-upgrade-ghostscript-tools-dvipdfcentos-upgrade-ghostscript-tools-fontscentos-upgrade-ghostscript-tools-printingcentos-upgrade-ghostscript-x11centos-upgrade-ghostscript-x11-debuginfocentos-upgrade-libgscentos-upgrade-libgs-debuginfo | Nov 3, 2023 | Sep 18, 2023 |
| Debian | debian-upgrade-ghostscript | Jul 30, 2024 | Sep 18, 2023 | |
| Ghostscript | ghostscript-upgrade-latest | Jan 24, 2024 | Sep 18, 2023 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-ghostscripthuawei-euleros-2_0_sp10-upgrade-ghostscript-help | Jan 10, 2024 | Sep 18, 2023 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-ghostscripthuawei-euleros-2_0_sp9-upgrade-ghostscript-help | Jan 10, 2024 | Sep 18, 2023 | |
| Oracle_linux | — | oracle-linux-upgrade-ghostscriptoracle-linux-upgrade-ghostscript-docoracle-linux-upgrade-ghostscript-tools-dvipdforacle-linux-upgrade-ghostscript-tools-fontsoracle-linux-upgrade-ghostscript-tools-printingoracle-linux-upgrade-ghostscript-x11oracle-linux-upgrade-libgsoracle-linux-upgrade-libgs-devel | Nov 3, 2023 | Sep 18, 2023 |
| Redhat_linux | redhat-upgrade-ghostscriptredhat-upgrade-ghostscript-debuginforedhat-upgrade-ghostscript-debugsourceredhat-upgrade-ghostscript-docredhat-upgrade-ghostscript-gtk-debuginforedhat-upgrade-ghostscript-tools-dvipdfredhat-upgrade-ghostscript-tools-fontsredhat-upgrade-ghostscript-tools-printingredhat-upgrade-ghostscript-x11redhat-upgrade-ghostscript-x11-debuginforedhat-upgrade-libgsredhat-upgrade-libgs-debuginforedhat-upgrade-libgs-devel | Nov 1, 2023 | Sep 18, 2023 | |
| Suse | — | suse-upgrade-ghostscriptsuse-upgrade-ghostscript-develsuse-upgrade-ghostscript-x11 | Oct 4, 2023 | Sep 18, 2023 |
| Ubuntu | ubuntu-upgrade-ghostscript | Oct 18, 2023 | Sep 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub