Critical Vulnerability in Ghostscript: Eexec Seed Manipulation in SAFER Mode
Summary
ALPINE-CVE-2023-52722: An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard. Affects ghostscript versions < 10.04.0-r0. Fixed in 10.04.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is essential for applications that require document manipulation, conversion, and printing. However, it has been found to have a vulnerability that affects its SAFER mode, which is designed to enhance security by restricting file access.
Vulnerability Detail
An issue was discovered in Artifex Ghostscript before version 10.03.1, specifically in the psi/zmisc1.c file. When SAFER mode is enabled, the software allows eexec seeds that deviate from the Type 1 standard. This could potentially lead to unauthorized access or manipulation of files, posing a significant security risk to systems relying on Ghostscript for document processing.
How To Fix
Minimum fixed version
10.04.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable SAFER mode in Ghostscript if it is not critical for their operations. However, this is not a recommended long-term solution as it may expose the system to other vulnerabilities.
Conclusion
The vulnerability in Ghostscript poses a serious risk to users relying on its SAFER mode for security. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, users can leverage tools like Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability allows for manipulation of eexec seeds, which could lead to unauthorized access to files when SAFER mode is enabled.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Ghostscript versions before 10.03.1 are affected, specifically in Alpine Linux distributions v3.18, v3.19, v3.20, v3.21, and v3.22.
Yes, updating to the patched versions of Ghostscript will permanently fix the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, helping you maintain security without needing access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
