Missing input sanitizing in pstotext package
Summary
DSA-792-1: pstotext - missing input sanitising. Affects pstotext versions < 1.8g-5woody1. Fixed in 1.8g-5woody1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The pstotext package is a utility used to extract text from PostScript and PDF files. It is commonly used to convert these file formats into plain text for further processing or analysis. The package relies on the Ghostscript software to handle the conversion process. However, a vulnerability has been discovered in pstotext where it fails to execute Ghostscript with the -dSAFER argument. This argument is crucial as it prevents potential malicious operations from occurring during the conversion process.
Vulnerability Detail
The missing input sanitizing vulnerability in pstotext exposes the system to potential malicious operations during the conversion of PostScript and PDF files. Without the -dSAFER argument, an attacker could craft a malicious file that could execute arbitrary commands or perform unauthorized actions on the system. This could lead to remote code execution, information disclosure, or other security breaches depending on the attacker's intentions. It is important to note that this vulnerability only affects versions prior to the fixed versions mentioned in the vulnerability details.
How To Fix
Minimum fixed version
1.8g-5woody1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pstotextTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The missing input sanitizing vulnerability in the pstotext package exposes systems to potential malicious operations during the conversion of PostScript and PDF files. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions mentioned in the vulnerability details. Upgrading ensures that Ghostscript is executed with the necessary argument to prevent potential security breaches. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pstotext →
FAQ
pstotext is a utility used to extract text from PostScript and PDF files. It converts these file formats into plain text for further processing or analysis.
The vulnerability exposes the system to potential malicious operations during the conversion process. An attacker could craft a malicious file that executes arbitrary commands or performs unauthorized actions on the system.
Versions prior to 1.8g-5woody1 for the old stable distribution (woody), versions prior to 1.9-1sarge1 for the stable distribution (sarge), and versions prior to 1.9-2 for the unstable distribution (sid) are affected.
To fix this vulnerability, you should upgrade the pstotext package to the fixed versions mentioned in the vulnerability details.
No workaround is available for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for pstotext.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
