Published: 25/06/2023 Updated: 07/11/2023

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 0

Artifex Ghostscript up to and including 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).

Vulnerable Product	Search on Vulmon	Subscribe to Product
artifex ghostscript
debian debian linux 11.0
debian debian linux 12.0
fedoraproject fedora 37
fedoraproject fedora 38

Synopsis Important: ghostscript security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for ghostscript is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security ...

Synopsis Important: ghostscript security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for ghostscript is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as h ...

It was discovered that Ghostscript, the GPL PostScript/PDF interpreter, does not properly handle permission validation for pipe devices, which could result in the execution of arbitrary commands if malformed document files are processed For the oldstable distribution (bullseye), this problem has been fixed in version 9533~dfsg-7+deb11u5 For the ...

DescriptionThe MITRE CVE dictionary describes this issue as: Artifex Ghostscript through 10012 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix) ...

Menu Log in ...

Critical Infrastructure Sectors: Critical Manufacturing

Scan for GhostScript files affected to CVE-2023-36664

Scan_GhostScript Scan for GhostScript files affected to CVE-2023-36664 PowerShell is self elevating You can run it directely via context menu

Ghostscript command injection vulnerability PoC (CVE-2023-36664)

Ghostscript command injection vulnerability PoC (CVE-2023-36664) Vulnerability disclosed in Ghostscript prior to version 10012 leads to code execution (CVSS score 98) Official vulnerability description: Artifex Ghostscript through 10012 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix) Debian released a security a

Proof of concept developed for the CVE-2023-36664

CVE-2023-36664 : Ghostscript remote code execution Proof of concept for the CVE-2023-36664 Usage To insert a payload into a eps file : python3 pocpy -f "filename" --payload "command" #python3 pocpy -f fileeps --payload firefox To insert a reverse shell payload into a eps file : python3 pocpy -f "filename&quo

Hospital GUI shell：githubcom/flozz/p0wny-shell/blob/master/shellphp Ubuntu提权：githubcom/briskets/CVE-2021-3493 GhostScript命令注入：githubcom/jakabakos/CVE-2023-36664-Ghostscript-command-injection

Ghostscript command injection vulnerability PoC (CVE-2023-36664) Vulnerability disclosed in Ghostscript prior to version 10012 leads to code execution (CVSS score 98) Official vulnerability description: Artifex Ghostscript through 10012 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix) Debian released a security a

NVD-CWE-Other https://bugs.ghostscript.com/show_bug.cgi?id=706761 https://www.debian.org/security/2023/dsa-5446 https://security.gentoo.org/glsa/202309-03 https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=505eab7782b429017eb434b2b95120855f2b0e3c https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=0974e4f2ac0005d3731e0b5c13ebc7e965540f4d https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EWMEK2UPCUU3ZLL7VASE5CEHDQY4VKV/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICXN5VPF3WJCYKMPSYER5KHTPJXSTJZ/https://access.redhat.com/errata/RHSA-2023:4324 https://nvd.nist.gov https://github.com/winkler-winsen/Scan_GhostScript https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-11 https://www.debian.org/security/2023/dsa-5446

CVE-2023-36664

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect