An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printingUpgrade libgs-develUpgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-docUpgrade ghostscript-tools-dvipdfUpgrade libgs | Sep 5, 2024 | Jul 3, 2024 |
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Jul 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ghostscriptUpgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscript-docUpgrade ghostscript-debuginfoUpgrade libgs-develUpgrade libgs | Aug 14, 2024 | Jul 3, 2024 |
| Amazon_linux_2023 | — | Upgrade ghostscript-gtkUpgrade ghostscript-tools-printingUpgrade ghostscript-debugsourceUpgrade ghostscript-gtk-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-docUpgrade ghostscript-debuginfoUpgrade libgsUpgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-tools-fontsUpgrade ghostscript-tools-dvipdfUpgrade libgs-devel | Feb 17, 2025 | May 16, 2024 |
| Debian | — | Upgrade ghostscript | May 17, 2024 | May 17, 2024 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 23, 2024 | Jul 3, 2024 |
| Ghostscript | — | Upgrade to Ghostscript version 10.03.1 | Nov 19, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscript-helpUpgrade ghostscript | Oct 8, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscript-helpUpgrade ghostscript | Oct 8, 2024 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade ghostscript-x11Upgrade libgs-develUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-docUpgrade ghostscript-tools-fontsUpgrade ghostscriptUpgrade libgsUpgrade ghostscript-tools-printing | Oct 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade ghostscript-docNo solution existsUpgrade ghostscript-x11Upgrade ghostscript-debugsourceUpgrade ghostscriptUpgrade libgs-develUpgrade ghostscript-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade libgsUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-tools-printingUpgrade libgs-debuginfoUpgrade ghostscript-x11-debuginfo | Sep 10, 2024 | Jul 3, 2024 |
| Rocky_linux | — | Upgrade ghostscript-x11Upgrade ghostscriptUpgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-debuginfoUpgrade libgs-develUpgrade ghostscript-debugsourceUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-tools-printingUpgrade libgs-debuginfoUpgrade ghostscript-tools-fonts | May 8, 2025 | Jul 3, 2024 |
| Suse | — | Upgrade ghostscript-x11Upgrade ghostscript-develUpgrade ghostscript | Jul 3, 2024 | Jul 2, 2024 |
| Ubuntu | — | Upgrade libgs-devUpgrade libgs10Upgrade ghostscriptUpgrade libgs9-commonUpgrade libgs-commonUpgrade ghostscript-docUpgrade ghostscript-xUpgrade libgs10-commonUpgrade libgs9 | Jun 21, 2024 | Jun 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub