CVE-2023-36664: OS Command Injection
A vulnerability was found in Ghostscript. This flaw occurs due to a mishandled permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
Other sources
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
— MITRE
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ghostscriptto a version that resolves this vulnerability.Fixed in 0:9.54.0-10.el9_2 - Upgrade
Upgrade
redhat/ghostscriptto a version that resolves this vulnerability.Fixed in 0:9.54.0-7.el9_0.1 - Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 10.0.0~dfsg-11+deb12u8Fixed in 10.05.1~dfsg-1+deb13u1Fixed in 10.07.1~dfsg-1Fixed in 10.08.0~dfsg-1 - Upgrade
Upgrade
Artifex Ghostscriptto a version that resolves this vulnerability.Fixed in 10.01.2 - Compensating control
If you must run an affected Ghostscript version, avoid using pipe devices that use the %pipe% prefix or the | pipe character prefix in Ghostscript inputs to prevent exploitation of the mishandled permission validation.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-36664?
CVE-2023-36664 is a vulnerability in Ghostscript that occurs due to a mishandled permission validation for pipe devices.
What is the severity of CVE-2023-36664?
CVE-2023-36664 has a severity rating of 8.4, which is considered high.
How does CVE-2023-36664 affect Artifex Ghostscript?
CVE-2023-36664 affects Artifex Ghostscript versions up to and including 10.01.2.
How does CVE-2023-36664 affect Debian Debian Linux 11.0?
CVE-2023-36664 affects Debian Debian Linux 11.0.
How can I fix CVE-2023-36664 in Ghostscript?
To fix CVE-2023-36664 in Ghostscript, update to version 9.54.0-7.el9_0.1 or apply the recommended security patches provided by the vendor or maintainers.