CVE-2010-2055
Fixed in a distro release EPSS <1%
Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.
Products: artifex afpl_ghostscript, artifex ghostscript_fonts, artifex gpl_ghostscript
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ghostscript | 8.71~dfsg2-6.1 |
| Debian 13 | ghostscript | 8.71~dfsg2-6.1 |
| Debian 14 | ghostscript | 8.71~dfsg2-6.1 |
| Red Hat Enterprise Linux 5 | ghostscript | 0:8.70-6.el5_7.6 |
| Red Hat Enterprise Linux 5 | ghostscript-debuginfo | 0:8.70-6.el5_7.6 |
| Red Hat Enterprise Linux 5 | ghostscript-devel | 0:8.70-6.el5_7.6 |
| Red Hat Enterprise Linux 5 | ghostscript-gtk | 0:8.70-6.el5_7.6 |
| Red Hat Enterprise Linux 6 | ghostscript | 0:8.70-11.el6_2.6 |
| Red Hat Enterprise Linux 6 | ghostscript-debuginfo | 0:8.70-11.el6_2.6 |
| Red Hat Enterprise Linux 6 | ghostscript-devel | 0:8.70-11.el6_2.6 |
| Red Hat Enterprise Linux 6 | ghostscript-doc | 0:8.70-11.el6_2.6 |
| Red Hat Enterprise Linux 6 | ghostscript-gtk | 0:8.70-11.el6_2.6 |