CVE-2023-36664: OS Command Injection
A vulnerability was found in Ghostscript. This flaw occurs due to a mishandled permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
Other sources
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ghostscriptto a version that resolves this vulnerability.Fixed in 0:9.54.0-10.el9_2 - Upgrade
Upgrade
redhat/ghostscriptto a version that resolves this vulnerability.Fixed in 0:9.54.0-7.el9_0.1 - Upgrade
Upgrade
debian/ghostscriptto a version that resolves this vulnerability.Fixed in 9.27~dfsg-2+deb10u5Fixed in 9.27~dfsg-2+deb10u9Fixed in 9.53.3~dfsg-7+deb11u6Fixed in 9.53.3~dfsg-7+deb11u5Fixed in 10.0.0~dfsg-11+deb12u2Fixed in 10.0.0~dfsg-11+deb12u1Fixed in 10.02.0~dfsg-2 - Upgrade
Upgrade
ghostscriptto a version that resolves this vulnerability.Fixed in 10.01.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-36664?
CVE-2023-36664 is a vulnerability in Ghostscript that occurs due to a mishandled permission validation for pipe devices.
What is the severity of CVE-2023-36664?
CVE-2023-36664 has a severity rating of 8.4, which is considered high.
How does CVE-2023-36664 affect Artifex Ghostscript?
CVE-2023-36664 affects Artifex Ghostscript versions up to and including 10.01.2.
How does CVE-2023-36664 affect Debian Debian Linux 11.0?
CVE-2023-36664 affects Debian Debian Linux 11.0.
How can I fix CVE-2023-36664 in Ghostscript?
To fix CVE-2023-36664 in Ghostscript, update to version 9.54.0-7.el9_0.1 or apply the recommended security patches provided by the vendor or maintainers.