An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted.
CVSS Details
- CVSS 3.1 Base Score: 6.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ghostscript-tools-fontsUpgrade ghostscript-docUpgrade ghostscript-tools-printingUpgrade ghostscriptUpgrade ghostscript-tools-dvipdfUpgrade libgsUpgrade ghostscript-x11Upgrade libgs-devel | Sep 5, 2024 | Jul 3, 2024 |
| Alpine Linux | — | Upgrade ghostscript | Aug 22, 2024 | Jul 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ghostscript-debuginfoUpgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade libgs-develUpgrade libgsUpgrade ghostscriptUpgrade ghostscript-doc | Aug 14, 2024 | Jul 3, 2024 |
| Amazon_linux_2023 | — | Upgrade ghostscript-x11-debuginfoUpgrade ghostscript-tools-printingUpgrade ghostscript-tools-fontsUpgrade libgs-debuginfoUpgrade ghostscript-tools-dvipdfUpgrade libgsUpgrade ghostscript-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-x11Upgrade ghostscript-gtkUpgrade libgs-develUpgrade ghostscript-debugsourceUpgrade ghostscriptUpgrade ghostscript-doc | Feb 17, 2025 | May 16, 2024 |
| Debian | — | Upgrade ghostscript | May 17, 2024 | May 17, 2024 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 23, 2024 | Jul 3, 2024 |
| Ghostscript | — | Upgrade to Ghostscript version 10.03.1 | Nov 19, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscriptUpgrade ghostscript-help | Oct 8, 2024 | Jul 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscript-helpUpgrade ghostscript | Oct 8, 2024 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade ghostscript-docUpgrade ghostscript-tools-dvipdfUpgrade ghostscriptUpgrade libgs-develUpgrade ghostscript-x11Upgrade libgsUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printing | Oct 16, 2024 | May 16, 2024 |
| Redhat_linux | — | Upgrade ghostscript-x11Upgrade libgs-debuginfoUpgrade ghostscript-debuginfoUpgrade ghostscript-tools-dvipdfUpgrade libgsUpgrade ghostscript-docUpgrade ghostscript-debugsourceNo solution existsUpgrade libgs-develUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printingUpgrade ghostscript | Sep 10, 2024 | Jul 3, 2024 |
| Rocky_linux | — | Upgrade ghostscript-debuginfoUpgrade libgs-develUpgrade ghostscript-tools-fontsUpgrade libgs-debuginfoUpgrade ghostscript-debugsourceUpgrade ghostscript-x11Upgrade ghostscript-tools-printingUpgrade libgsUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-x11-debuginfoUpgrade ghostscript | May 8, 2025 | Jul 3, 2024 |
| Suse | — | Upgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-devel | Jul 3, 2024 | Jul 2, 2024 |
| Ubuntu | — | Upgrade libgs-commonUpgrade libgs10Upgrade libgs9Upgrade libgs-devUpgrade libgs10-commonUpgrade ghostscript-xUpgrade ghostscriptUpgrade ghostscript-docUpgrade libgs9-common | Jun 21, 2024 | Jun 17, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub