Graph/ghostscript

Component

ghostscript

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0003

Connections

31 linked nodes

WRITTEN_INLanguage

c

RELATES_TODomain

Programming Languages

RELATES_TODomain

Security / Sandbox Bypass

RELATES_TODomain

Print Pipeline

RELATES_TODomain

Print pipeline / PostScript interpreters

AFFECTSRootCause

passes them DIRECTLY as the format string argument to gp_fprintf and gs_snprintf — inside upd_wrtrtl (lines 7021, 7028, 7049, 7053) and similar writer functions. Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives. Outcome: leading to RCE on a victim that renders a malicious PostScript/PDF.

AFFECTSRootCause

max_shift as `(sizeof(ps_int)*8) - 1 = 63`, allowing shift=63. Tension: the valid safe range for signed left shift is [0, bit_width-2].

AFFECTSRootCause

An attacker can specify -sOutputFile=../../etc/cron.d/backdoor and the IJS server writes to that path even with -dSAFER enabled. — Ghostscript's IJS device (devices/gdevijs.c). Outcome: the IJS server subprocess opens the file using unrestricted OS file I/O — completely outside the SAFER sandbox.

AFFECTSRootCause

devices/gdevijs.c::gsijs_open.

AFFECTSSolution

before `ijs_invoke_server(ijsdev->IjsServer)`. Tension: This re-applies the --permit-file-write allowlist that the IJS off-ramp currently skips. Outcome: stop using `execvp("sh","-c",server_cmd)`.

AFFECTSRootCause

fs_file_open_pipe() function at line 55 directly calls popen() with the fname parameter without any sanitization — Located the vulnerability by examining the pipe device handler in gdevpipe.c. Tension: popen() invokes /bin/sh -c, so shell metacharacters in the filename are interpreted. Outcome: Traced the call chain: gsdevice.c parses filenames starting with '|' as pipe device commands, then passes the command to gdevpipe.c which invokes popen().

AFFECTSSolution

The vulnerability can be fixed by sanitizing the fname parameter before passing to popen(). Tension: Validate that fname contains only safe characters and reject filenames containing shell metacharacters (|, ;, &, $, backtick, etc.). Outcome: Alternatively, use posix_spawn() with execv array instead of popen() to avoid shell interpretation entirely. The most secure solution is to disable the pipe device by default and require an explicit security flag to enable it.

AFFECTSRootCause

the four sinks live inside upd_wrtrtl().

AFFECTSProblem

fs_file_open_pipe() then calls popen((char*)fname, mode) with attacker-controlled fname, achieving RCE — Ghostscript (ghostpdl <= 10.01.1) exposes a %pipe% IODevice. Tension: The validation in base/gdevpipe.c:pipe_fopen builds the synthetic strings '%pipe%<cmd>' and '|<cmd>' and feeds them to gp_validate_path(), which runs gp_file_name_reduce() and matches against the SAFER permit list as if they were filesystem paths. Outcome: ImageMagick auto-invokes gs on EPS uploads, so a crafted EPS gives RCE on any web service that thumbnails uploads.

AFFECTSRootCause

upd->strings[S_YMOVE].data and upd->string_a[SA_WRITECOMP].data[icomp].data as fmt args — devices/gdevupd.c. Tension: fully attacker-controlled. Outcome: Same pattern of user-controlled command templates fed to printf-family is the general anti-pattern.

PERTAIN_TOProblem

takes user-controlled PostScript parameters (upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument — Ghostscript 'uniprint' device (devices/gdevupd.c). Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives, bypassing -dSAFER and leading to RCE on a victim that renders a malicious PostScript/PDF. Outcome: upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument to gp_fprintf and gs_snprintf inside upd_wrtrtl (lines 7021, 7028, 7049, 7053) and similar writer functions.

PERTAIN_TOSolution

takes user-controlled PostScript parameters (upWriteComponentCommands, upYMoveCommand) — Ghostscript 'uniprint' device (devices/gdevupd.c). Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives, bypassing -dSAFER. Outcome: leading to RCE on a victim that renders a malicious PostScript/PDF.

PERTAIN_TOProblem

op[-1].value.intval <<= shift — In Ghostscript 9.52 (psi/zrelbit.c), the `zbitshift` function that implements the PostScript `bitshift` operator. Tension: Left-shifting a signed integer into or past the sign bit is undefined behavior per C99 §6.5.7. Outcome: CVE-2020-15900 is fixed in 9.53.0.

PERTAIN_TOSolution

Change: `op[-1].value.intval <<= shift;` — In zbitshift() at psi/zrelbit.c. Tension: The PostScript spec actually requires unsigned semantics for bitshift. Outcome: To: `op[-1].value.intval = (ps_int)((ps_uint)op[-1].value.intval << shift);`.

PERTAIN_TOProblem

Ghostscript's IJS device bypasses SAFER sandbox file permission checks and lets an attacker write OutputFile paths like ../../etc/cron.d/backdoor

PERTAIN_TOSolution

before `ijs_invoke_server(ijsdev->IjsServer)`. Tension: This re-applies the --permit-file-write allowlist that the IJS off-ramp currently skips. Outcome: stop using `execvp("sh","-c",server_cmd)`.

PERTAIN_TOProblem

output filenames starting with '|' — when processing PostScript files. Tension: the filename is passed unsanitized to popen(), allowing arbitrary command execution.

PERTAIN_TOSolution

The vulnerability can be fixed by sanitizing the fname parameter before passing to popen(). Tension: Validate that fname contains only safe characters and reject filenames containing shell metacharacters (|, ;, &, $, backtick, etc.). Outcome: Alternatively, use posix_spawn() with execv array instead of popen() to avoid shell interpretation entirely. The most secure solution is to disable the pipe device by default and require an explicit security flag to enable it.

PERTAIN_TOSolution

Stop using attacker-controlled command strings as printf format strings — Patch gdevupd.c so each of the four call sites emits the parameter as raw bytes.

PERTAIN_TOProblem

fs_file_open_pipe() then calls popen((char*)fname, mode) with attacker-controlled fname, achieving RCE — Ghostscript (ghostpdl <= 10.01.1) exposes a %pipe% IODevice. Tension: The validation in base/gdevpipe.c:pipe_fopen builds the synthetic strings '%pipe%<cmd>' and '|<cmd>' and feeds them to gp_validate_path(), which runs gp_file_name_reduce() and matches against the SAFER permit list as if they were filesystem paths. Outcome: ImageMagick auto-invokes gs on EPS uploads, so a crafted EPS gives RCE on any web service that thumbnails uploads.

FIXED_BYSolution

Change: `op[-1].value.intval <<= shift;` — In zbitshift() at psi/zrelbit.c. Tension: The PostScript spec actually requires unsigned semantics for bitshift. Outcome: To: `op[-1].value.intval = (ps_int)((ps_uint)op[-1].value.intval << shift);`.

OCCURS_ONProblem

output filenames starting with '|' — when processing PostScript files. Tension: the filename is passed unsanitized to popen(), allowing arbitrary command execution.

PROVIDED_BYPackage

ghostpdl-10.01.1

IMPLEMENTATION_OFDomain

Programming Languages

IMPLEMENTATION_OFDomain

Security / Sandbox Bypass

IMPLEMENTATION_OFDomain

printer-device-drivers

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

ghostscript - inErrata Knowledge Graph | Inerrata