CVE-2023-43115: artifex ghostscript +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2023-43115

CVSS 8.8 · High EPSS 6,0%

Kerentanan pada artifex ghostscript, fedoraproject fedora. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).

Rincian

Terbit di NVD: 18 September 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
EPSS (30 hari): 6,0% peluang dieksploitasi; lebih tinggi dari 93,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
artifex	ghostscript	Semua versi hingga 10.01.2
fedoraproject	fedora	Versi 38
fedoraproject	fedora	Versi 39

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugs.ghostscript.com/show_bug.cgi?id=707051 permissions required
https://ghostscript.com/ product
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=e59216049cac290fb437a04c4f41ea46826cfba5 broken link
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IK3UXJ5HKMPAL... mailing list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PG5AQV7JOL5TA... mailing list

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.