PT-2023-5662 · Artifex+7 · Artifex Ghostscript+7
Published
2023-09-18
·
Updated
2026-05-24
·
CVE-2023-43115
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Artifex Ghostscript versions 10.01.2 and earlier
Description
The issue is related to the
gdevijs.c component in GhostPDL, which can lead to remote code execution via crafted PostScript documents. This is because the documents can switch to the IJS device or change the IjsServer parameter after SAFER has been activated. It is a documented risk that the IJS server can be specified on a gs command line, as the IJS device must execute a command to start the IJS server.Recommendations
For Artifex Ghostscript versions 10.01.2 and earlier, consider disabling the
gdevijs.c component or restricting access to the IJS device to minimize the risk of exploitation. As a temporary workaround, avoid using the IjsServer parameter in crafted PostScript documents until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Artifex Ghostscript
Astra Linux
Linuxmint
Red Hat
Suse
Ubuntu