PT-2023-5662 · Artifex+7 · Artifex Ghostscript+7
CVE-2023-43115
·
Publicado
2023-09-18
·
Atualizado
2026-06-16
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Artifex Ghostscript versions 10.01.2 and earlier
Description
The issue is related to the
gdevijs.c component in GhostPDL, which can lead to remote code execution via crafted PostScript documents. This is because the documents can switch to the IJS device or change the IjsServer parameter after SAFER has been activated. It is a documented risk that the IJS server can be specified on a gs command line, as the IJS device must execute a command to start the IJS server.Recommendations
For Artifex Ghostscript versions 10.01.2 and earlier, consider disabling the
gdevijs.c component or restricting access to the IJS device to minimize the risk of exploitation. As a temporary workaround, avoid using the IjsServer parameter in crafted PostScript documents until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Artifex Ghostscript
Astra Linux
Linuxmint
Red Hat
Suse
Ubuntu