Logo
›
›vulnerability›CVE-2023-36664
Name
CVE-2023-36664
Source
NVD ( link)Debian ( link)
Description
Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).
CWEs
CWE-552
Published Date
Updated Date
Workaround
-
Advisories
https://bugs.ghostscript.com/show_bug.cgi?id=706761Issue Tracking
https://security.gentoo.org/glsa/202309-03Third Party Advisory
https://www.debian.org/security/2023/dsa-5446Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=706761Issue Tracking
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=0974e4f2ac0005d3731e0b5c13ebc7e965540f4dPermissions Required
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=505eab7782b429017eb434b2b95120855f2b0e3cPermissions Required
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICXN5VPF3WJCYKMPSYER5KHTPJXSTJZ/Broken Link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EWMEK2UPCUU3ZLL7VASE5CEHDQY4VKV/Broken Link
https://security.gentoo.org/glsa/202309-03Third Party Advisory
https://www.debian.org/security/2023/dsa-5446Third Party Advisory

Analysis#

Affected Component
Analysis
ghostscript
Patched

Vulnerability Ratings#

7.8
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
ghostscript
buildroot
2025.02.x
10.08.0
Not Affected
ghostscript
buildroot
master
10.08.0
Not Affected
ghostscript
yocto
master
10.07.1
Not Affected
ghostscript
yocto
scarthgap
10.05.1
Not Affected

Resolved with patches#

ghostscript (yocto:kirkstone)

#
Title
Author
Resolve
1
Bug 706778: 706761 revisit
Chris Liddell <chris.liddell@artifex.com>
CVE-2023-36664
2
Bug 706761: Don't "reduce" %pipe% file names for
Chris Liddell <chris.liddell@artifex.com>
CVE-2023-36664