An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ghostscript-tools-printingUpgrade ghostscript-tools-fontsUpgrade ghostscriptUpgrade ghostscript-x11Upgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade libgs-develUpgrade ghostscript-doc | Sep 5, 2024 | Jul 3, 2024 |
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Jul 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ghostscript-gtkUpgrade ghostscript-docUpgrade ghostscript-cupsUpgrade ghostscriptUpgrade libgsUpgrade ghostscript-debuginfoUpgrade libgs-devel | Aug 14, 2024 | Jul 3, 2024 |
| Amazon_linux_2023 | — | Upgrade ghostscript-tools-dvipdfUpgrade ghostscript-debuginfoUpgrade libgsUpgrade ghostscript-x11Upgrade libgs-develUpgrade ghostscriptUpgrade ghostscript-tools-fontsUpgrade ghostscript-debugsourceUpgrade ghostscript-tools-printingUpgrade ghostscript-gtkUpgrade ghostscript-docUpgrade ghostscript-gtk-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-x11-debuginfo | Feb 17, 2025 | May 16, 2024 |
| Debian | — | Upgrade ghostscript | May 17, 2024 | May 17, 2024 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 23, 2024 | Jul 3, 2024 |
| Ghostscript | — | Upgrade to Ghostscript version 10.03.1 | Nov 19, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscriptUpgrade ghostscript-help | Oct 8, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscriptUpgrade ghostscript-help | Oct 8, 2024 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade libgs-develUpgrade ghostscript-x11Upgrade ghostscript-tools-dvipdfUpgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-tools-fontsUpgrade libgsUpgrade ghostscript-tools-printing | Oct 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade ghostscript-tools-fontsUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-gtk-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-tools-printingUpgrade libgsUpgrade ghostscript-debuginfoUpgrade ghostscriptNo solution existsUpgrade ghostscript-x11Upgrade libgs-develUpgrade ghostscript-docUpgrade ghostscript-debugsource | Sep 10, 2024 | Jul 3, 2024 |
| Rocky_linux | — | Upgrade ghostscript-tools-printingUpgrade ghostscript-debugsourceUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-tools-fontsUpgrade libgs-debuginfoUpgrade ghostscript-x11Upgrade ghostscriptUpgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-debuginfoUpgrade libgs-devel | May 8, 2025 | Jul 3, 2024 |
| Suse | — | Upgrade ghostscript-x11Upgrade ghostscript-develUpgrade ghostscript | Jul 3, 2024 | Jul 2, 2024 |
| Ubuntu | — | Upgrade ghostscript-xUpgrade libgs9-commonUpgrade ghostscriptUpgrade ghostscript-docUpgrade libgs9Upgrade libgs10-commonUpgrade libgs-commonUpgrade libgs-devUpgrade libgs10 | Jun 21, 2024 | Jun 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub