Important: Ghostscript OS Command Injection Vulnerability
Summary
RLSA-2023:5459: Important: ghostscript security update. Affects ghostscript versions < 0:9.54.0-10.el9_2. Fixed in 0:9.54.0-10.el9_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code to common bitmap formats for display or printing purposes. The vulnerability in Ghostscript allows for OS command injection due to mishandled permission validation for pipe devices.
Vulnerability Detail
The vulnerability (CVE-2023-36664) in Ghostscript arises from improper permission validation for pipe devices. This flaw enables an attacker to inject arbitrary OS commands, potentially leading to unauthorized access, data manipulation, or system compromise. The vulnerability has a CVSS score of 8.4, indicating a high severity level.
How To Fix
Minimum fixed version
0:9.54.0-10.el9_2
This is the first release that contains the fix.
sudo dnf update ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Ghostscript OS command injection vulnerability (CVE-2023-36664) poses a significant risk to systems utilizing Ghostscript for rendering PostScript and PDF documents. It is crucial to update Ghostscript to version 9.54.0-10.el9_2 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is a suite of utilities used for rendering PostScript and PDF documents. It translates PostScript code to common bitmap formats for display or printing purposes.
The vulnerability allows for OS command injection, which can lead to unauthorized access, data manipulation, or system compromise.
The CVSS score of this vulnerability is 8.4, indicating a high severity level.
To fix the vulnerability, update Ghostscript to version 9.54.0-10.el9_2 or later.
No workaround has been provided for this vulnerability. It is recommended to update Ghostscript to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
