Vulnerability · Published Jun 25, 2023 · Assigned by mitre
CVE-2023-36664
High 7.8
In plain English
A high-severity security flaw in the ghostscript package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)3.9%top 9.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | ghostscript | 9.54.0-10.el9_2 | ALSA-2023:5459 |
| AlmaLinux:9 | ghostscript-doc | 9.54.0-10.el9_2 | ALSA-2023:5459 |
| AlmaLinux:9 | ghostscript-tools-dvipdf | 9.54.0-10.el9_2 | ALSA-2023:5459 |
| AlmaLinux:9 | ghostscript-tools-fonts | 9.54.0-10.el9_2 | ALSA-2023:5459 |
| AlmaLinux:9 | ghostscript-tools-printing | 9.54.0-10.el9_2 | ALSA-2023:5459 |
| AlmaLinux:9 | ghostscript-x11 | 9.54.0-10.el9_2 | ALSA-2023:5459 |
| AlmaLinux:9 | libgs | 9.54.0-10.el9_2 | ALSA-2023:5459 |
| AlmaLinux:9 | libgs-devel | 9.54.0-10.el9_2 | ALSA-2023:5459 |
| Debian:12 | ghostscript | 10.0.0~dfsg-11+deb12u1 | DEBIAN-CVE-2023-36664 |
| Debian:12 | ghostscript | 10.0.0~dfsg-11+deb12u1 | DSA-5446-1 |
| Debian:13 | ghostscript | 10.01.2~dfsg-1 | DEBIAN-CVE-2023-36664 |
| Debian:14 | ghostscript | 10.01.2~dfsg-1 | DEBIAN-CVE-2023-36664 |
| Rocky Linux:9 | ghostscript | 0:9.54.0-10.el9_2 | RLSA-2023:5459 |
| Ubuntu:22.04:LTS | ghostscript | 9.55.0~dfsg1-0ubuntu5.3 | USN-6213-1 |
| Ubuntu:22.04:LTS | ghostscript | 9.55.0~dfsg1-0ubuntu5.3 | UBUNTU-CVE-2023-36664 |
Affected products (as reported)
Weakness: CWE-552
References
- https://bugs.ghostscript.com/show_bug.cgi?id=706761
- https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=505eab7782b429017eb434b2b95120855f2b0e3c
- https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=0974e4f2ac0005d3731e0b5c13ebc7e965540f4d
- DSA-5446 vendor-advisory
- FEDORA-2023-d8a1c3e5e2 vendor-advisory
- FEDORA-2023-83c805b441 vendor-advisory
- GLSA-202309-03 vendor-advisory
- https://artifex.com/blog/security-vulnerability-fixed-in-ghostscript-10.01.2
- https://www.kroll.com/en/publications/cyber/ghostscript-cve-2023-36664-remote-code-execution-vulnerability
- https://security-tracker.debian.org/tracker/CVE-2023-36664
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=505eab7782b429017eb434b2b95120855f2b0e3c x_transferred
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=0974e4f2ac0005d3731e0b5c13ebc7e965540f4d x_transferred
- FEDORA-2023-d8a1c3e5e2 vendor-advisory, x_transferred
- FEDORA-2023-83c805b441 vendor-advisory, x_transferred