CVE-2023-36664CWE-552

CVE-2023-36664

High · published June 26, 2023

CVSS v3.1
7.8
EPSS
4%
Percentile
90.1
In the wild
Unconfirmed
What it is

Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03850 · 90.1th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2023-06-26T02:15Z
Affected products (5)
ProductVersionsFixed in
artifex/ghostscript< 10.01.210.01.2
debian/debian_linuxall versions—
debian/debian_linuxall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
References (17)
https://artifex.com/blog/security-vulnerability-fixed-in-ghostscript-10.01.2 · [email protected]https://bugs.ghostscript.com/show_bug.cgi?id=706761 · [email protected]https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0974e4f2ac0005d3731e0b5c13ebc7e965540f4d · [email protected]https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=505eab7782b429017eb434b2b95120855f2b0e3c · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/2ICXN5VPF3WJCYKMPSYER5KHTPJXSTJZ/ · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/5EWMEK2UPCUU3ZLL7VASE5CEHDQY4VKV/ · [email protected]https://security-tracker.debian.org/tracker/CVE-2023-36664 · [email protected]https://security.gentoo.org/glsa/202309-03 · [email protected]https://www.debian.org/security/2023/dsa-5446 · [email protected]https://www.kroll.com/en/publications/cyber/ghostscript-cve-2023-36664-remote-code-execution-vulnerability · [email protected]https://bugs.ghostscript.com/show_bug.cgi?id=706761 · af854a3a-2127-422b-91ae-364da2661108https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=0974e4f2ac0005d3731e0b5c13ebc7e965540f4d · af854a3a-2127-422b-91ae-364da2661108https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=505eab7782b429017eb434b2b95120855f2b0e3c · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICXN5VPF3WJCYKMPSYER5KHTPJXSTJZ/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EWMEK2UPCUU3ZLL7VASE5CEHDQY4VKV/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202309-03 · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5446 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 JUN 00:00Z
    Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix)
    cvelistv5