An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ghostscript-x11Upgrade ghostscript-docUpgrade ghostscriptUpgrade libgs-develUpgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printing | Sep 5, 2024 | Jul 3, 2024 |
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Jul 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ghostscript-debuginfoUpgrade libgs-develUpgrade libgsUpgrade ghostscript-gtkUpgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-cups | Aug 14, 2024 | Jul 3, 2024 |
| Amazon_linux_2023 | — | Upgrade ghostscript-x11-debuginfoUpgrade ghostscript-docUpgrade ghostscript-gtkUpgrade ghostscript-debugsourceUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-tools-printingUpgrade libgs-debuginfoUpgrade ghostscriptUpgrade libgs-develUpgrade libgsUpgrade ghostscript-x11Upgrade ghostscript-debuginfoUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-dvipdf | Feb 17, 2025 | May 16, 2024 |
| Debian | — | Upgrade ghostscript | May 17, 2024 | May 17, 2024 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 23, 2024 | Jul 3, 2024 |
| Ghostscript | — | Upgrade to Ghostscript version 10.03.1 | Nov 19, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscript-helpUpgrade ghostscript | Oct 8, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscriptUpgrade ghostscript-help | Oct 8, 2024 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade ghostscript-x11Upgrade libgs-develUpgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-tools-dvipdfUpgrade libgsUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printing | Oct 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade ghostscript-x11-debuginfoUpgrade ghostscript-tools-fontsUpgrade ghostscript-gtk-debuginfoUpgrade libgs-debuginfoUpgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-debuginfoUpgrade ghostscript-tools-printingUpgrade libgs-develUpgrade ghostscript-docUpgrade ghostscript-x11Upgrade ghostscript-debugsourceNo solution existsUpgrade ghostscript | Sep 10, 2024 | Jul 3, 2024 |
| Rocky_linux | — | Upgrade ghostscript-debuginfoUpgrade libgs-develUpgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-tools-fontsUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-debugsourceUpgrade libgs-debuginfoUpgrade ghostscript-tools-printing | May 8, 2025 | Jul 3, 2024 |
| Suse | — | Upgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-devel | Jul 3, 2024 | Jul 2, 2024 |
| Ubuntu | — | Upgrade libgs10Upgrade libgs-devUpgrade ghostscriptUpgrade libgs9-commonUpgrade libgs-commonUpgrade libgs9Upgrade ghostscript-xUpgrade ghostscript-docUpgrade libgs10-common | Jun 21, 2024 | Jun 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub