CVE-2010-4820 Untrusted search path vulnerability in Ghostscript 8.62 allows local users to execute arbitrary PostScript code via a Trojan horse Postscript library file in Encoding/ under the current working direct...
MediumCVSS 4.4
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Untrusted search path vulnerability in Ghostscript 8.62 allows local users to execute arbitrary PostScript code via a Trojan horse Postscript library file in Encoding/ under the current working directory, a different vulnerability than CVE-2010-2055.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ghostscript(Debian:12) | < 8.71~dfsg2-6.1 | 8.71~dfsg2-6.1 |
| debian/ghostscript(Debian:13) | < 8.71~dfsg2-6.1 | 8.71~dfsg2-6.1 |
| debian/ghostscript(Debian:14) | < 8.71~dfsg2-6.1 | 8.71~dfsg2-6.1 |
| ghostscript | = 8.62 | No fix listed |
References
- Debian Security Tracker CVE-2010-4820 vendor-advisory
- bugs.ghostscript.com
- RHSA-2012:0095 vendor-advisory
- RHSA-2012:0096 vendor-advisory
- [oss-security] 20120104 Re: CVE request: ghostscript: system initialization file uncontrolled search path element mailing-list
- 20100522 Ghostscript 8.64 executes random code at startup mailing-list
- 51847 vdb-entry
- bugzilla.redhat.com
- bugzilla.redhat.com