CVE-2010-2055 Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improp...
HighCVSS 7.2
EPSS 0.51%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| artifex afpl ghostscript | = 6.0 | No fix listed |
| artifex afpl ghostscript | = 6.01 | No fix listed |
| artifex afpl ghostscript | = 6.50 | No fix listed |
| artifex afpl ghostscript | = 7.00 | No fix listed |
| artifex afpl ghostscript | = 7.03 | No fix listed |
| artifex afpl ghostscript | = 7.04 | No fix listed |
| artifex afpl ghostscript | = 8.00 | No fix listed |
| artifex afpl ghostscript | = 8.11 | No fix listed |
| artifex afpl ghostscript | = 8.12 | No fix listed |
| artifex afpl ghostscript | = 8.13 | No fix listed |
| artifex afpl ghostscript | = 8.14 | No fix listed |
| artifex afpl ghostscript | = 8.50 | No fix listed |
| artifex afpl ghostscript | = 8.51 | No fix listed |
| artifex afpl ghostscript | = 8.52 | No fix listed |
| artifex afpl ghostscript | = 8.53 | No fix listed |
| artifex afpl ghostscript | = 8.54 | No fix listed |
| artifex ghostscript fonts | = 6.0 | No fix listed |
| artifex ghostscript fonts | = 8.11 | No fix listed |
| artifex gpl ghostscript | <= 8.71 | No fix listed |
| artifex gpl ghostscript | = 8.01 | No fix listed |
| artifex gpl ghostscript | = 8.15 | No fix listed |
| artifex gpl ghostscript | = 8.50 | No fix listed |
| artifex gpl ghostscript | = 8.51 | No fix listed |
| artifex gpl ghostscript | = 8.54 | No fix listed |
| artifex gpl ghostscript | = 8.56 | No fix listed |
Show 10 more
| Product | Affected versions | Fixed in |
|---|---|---|
| artifex gpl ghostscript | = 8.57 | No fix listed |
| artifex gpl ghostscript | = 8.60 | No fix listed |
| artifex gpl ghostscript | = 8.61 | No fix listed |
| artifex gpl ghostscript | = 8.62 | No fix listed |
| artifex gpl ghostscript | = 8.63 | No fix listed |
| artifex gpl ghostscript | = 8.64 | No fix listed |
| artifex gpl ghostscript | = 8.70 | No fix listed |
| debian/ghostscript(Debian:12) | < 8.71~dfsg2-6.1 | 8.71~dfsg2-6.1 |
| debian/ghostscript(Debian:13) | < 8.71~dfsg2-6.1 | 8.71~dfsg2-6.1 |
| debian/ghostscript(Debian:14) | < 8.71~dfsg2-6.1 | 8.71~dfsg2-6.1 |
References
- bugs.debian.org
- bugs.debian.org
- bugs.ghostscript.com exploit
- bugs.ghostscript.com
- FEDORA-2010-10660 vendor-advisory
- FEDORA-2010-10642 vendor-advisory
- SUSE-SR:2010:014 vendor-advisory
- savannah.gnu.org
- 40452 third-party-advisory vendor-advisory
- 40475 third-party-advisory vendor-advisory
- 40532 third-party-advisory vendor-advisory
- GLSA-201412-17 vendor-advisory
- 66247 vdb-entry
- 20100522 Ghostscript 8.64 executes random code at startup mailing-list
- 20100526 Re: Ghostscript 8.64 executes random code at startup exploit mailing-list
- 20100526 Re: Ghostscript 8.64 executes random code at startup exploit mailing-list
- 20100526 Re: Ghostscript 8.64 executes random code at startup mailing-list
- ADV-2010-1757 vdb-entry vendor-advisory
- bugzilla.novell.com
- bugzilla.redhat.com patch
- RHSA-2012:0095 vendor-advisory
- Debian Security Tracker CVE-2010-2055 vendor-advisory
- bugs.debian.org issue-tracking