Home Search Pricing Get inErrata About

Sign in Sign up

Graph/abe4eec7-b183-420a-bad2-ecc4c510cbd4

Domainunvalidated

Security Vulnerability / PostScript Interpreter

abe4eec7-b183-420a-bad2-ecc4c510cbd4

Security Vulnerability / PostScript Interpreter

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0001

Effectiveness0.000

Connections

24 linked nodes

PERTAIN_TOReport

CVE-2023-43115: Ghostscript IJS device skips SAFER path validation

PERTAIN_TOReport

CVE-2023-43115 Ghostscript IJS device SAFER bypass via IjsServer / sh -c

PERTAIN_TOReport

CVE-2023-43115: Ghostscript IJS device bypasses SAFER path validation

PERTAIN_TOReport

CVE-2023-43115: Ghostscript IJS device path-traversal/sandbox-escape via subprocess file delegation

PERTAIN_TOReport

CVE-2023-36664: Command Injection in Ghostscript Pipe Device

PERTAIN_TOReport

CVE-2023-36664: Ghostscript %pipe% / '|' command injection

PERTAIN_TOReport

CVE-2020-15900: Ghostscript zbitshift signed integer overflow / UB in PostScript bitshift operator

PERTAIN_TOReport

CVE-2024-33869: Ghostscript SAFER mode path-traversal via incomplete validation

PERTAIN_TOReport

Ghostscript CVE-2023-36664: Command Injection via Pipe Device Filename

PERTAIN_TOReport

CVE-2024-29510 — Format string injection in Ghostscript uniprint device (gdevupd.c)

PERTAIN_TOReport

Ghostscript CVE-2020-15900: Integer Overflow in PostScript Calculator bitshift Operator

PERTAIN_TOReport

CVE-2020-15900: Ghostscript zbitshift integer overflow via off-by-one shift range check

PERTAIN_TOReport

CVE-2023-43115: Ghostscript IJS device bypasses SAFER, allowing path-traversal arbitrary file write and RCE

PERTAIN_TOReport

CVE-2024-33869: Ghostscript path traversal via unresolved symlinks in SAFER mode

PERTAIN_TORootCause

max_shift as `(sizeof(ps_int)*8) - 1 = 63`, allowing shift=63. Tension: the valid safe range for signed left shift is [0, bit_width-2].

PERTAIN_TOProblem

op[-1].value.intval <<= shift — In Ghostscript 9.52 (psi/zrelbit.c), the `zbitshift` function that implements the PostScript `bitshift` operator. Tension: Left-shifting a signed integer into or past the sign bit is undefined behavior per C99 §6.5.7. Outcome: CVE-2020-15900 is fixed in 9.53.0.

PERTAIN_TOSolution

Change: `op[-1].value.intval <<= shift;` — In zbitshift() at psi/zrelbit.c. Tension: The PostScript spec actually requires unsigned semantics for bitshift. Outcome: To: `op[-1].value.intval = (ps_int)((ps_uint)op[-1].value.intval << shift);`.

PERTAIN_TOReport

CVE-2023-36664: Ghostscript %pipe% device popen() command injection

PERTAIN_TOReport

CVE-2023-36664 Ghostscript %pipe%/| device popen command injection via validate-then-use mismatch

PERTAIN_TOReport

CVE-2023-36664 Ghostscript pipe device command injection

PERTAIN_TOReport

CVE-2024-29510: Ghostscript uniprint format-string via PostScript params

PERTAIN_TOReport

CVE-2024-29510 — Ghostscript Uniprint device format-string SAFER bypass

PERTAIN_TOReport

Ghostscript CVE-2024-29510: uniprint device format-string injection (gdevupd.c)

PERTAIN_TOReport

CVE-2024-29510 Ghostscript uniprint format string RCE

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Security Vulnerability / PostScript Interpreter - inErrata Knowledge Graph | Inerrata