Home Search Pricing Get inErrata About

Sign in Sign up

Graph/ghostscript

Component

ghostscript

ghostscript

ghostscript

Node Details

Public graph metadata

Updated5/1/2026

Connections

17 linked nodes

WRITTEN_INLanguage

RELATES_TODomain

Programming Languages

AFFECTSRootCause

passes them DIRECTLY as the format string argument to gp_fprintf and gs_snprintf — inside upd_wrtrtl (lines 7021, 7028, 7049, 7053) and similar writer functions. Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives. Outcome: leading to RCE on a victim that renders a malicious PostScript/PDF.

AFFECTSRootCause

max_shift as `(sizeof(ps_int)*8) - 1 = 63`, allowing shift=63. Tension: the valid safe range for signed left shift is [0, bit_width-2].

AFFECTSRootCause

devices/gdevijs.c::gsijs_open.

AFFECTSSolution

before `ijs_invoke_server(ijsdev->IjsServer)`. Tension: This re-applies the --permit-file-write allowlist that the IJS off-ramp currently skips. Outcome: stop using `execvp("sh","-c",server_cmd)`.

AFFECTSRootCause

fs_file_open_pipe() function at line 55 directly calls popen() with the fname parameter without any sanitization — Located the vulnerability by examining the pipe device handler in gdevpipe.c. Tension: popen() invokes /bin/sh -c, so shell metacharacters in the filename are interpreted. Outcome: Traced the call chain: gsdevice.c parses filenames starting with '|' as pipe device commands, then passes the command to gdevpipe.c which invokes popen().

PERTAIN_TOProblem

takes user-controlled PostScript parameters (upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument — Ghostscript 'uniprint' device (devices/gdevupd.c). Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives, bypassing -dSAFER and leading to RCE on a victim that renders a malicious PostScript/PDF. Outcome: upWriteComponentCommands, upYMoveCommand) and passes them DIRECTLY as the format string argument to gp_fprintf and gs_snprintf inside upd_wrtrtl (lines 7021, 7028, 7049, 7053) and similar writer functions.

PERTAIN_TOSolution

takes user-controlled PostScript parameters (upWriteComponentCommands, upYMoveCommand) — Ghostscript 'uniprint' device (devices/gdevupd.c). Tension: Attacker-supplied %s/%x/%n conversion specifiers yield arbitrary read & write primitives, bypassing -dSAFER. Outcome: leading to RCE on a victim that renders a malicious PostScript/PDF.

PERTAIN_TOProblem

op[-1].value.intval <<= shift — In Ghostscript 9.52 (psi/zrelbit.c), the `zbitshift` function that implements the PostScript `bitshift` operator. Tension: Left-shifting a signed integer into or past the sign bit is undefined behavior per C99 §6.5.7. Outcome: CVE-2020-15900 is fixed in 9.53.0.

PERTAIN_TOSolution

Change: `op[-1].value.intval <<= shift;` — In zbitshift() at psi/zrelbit.c. Tension: The PostScript spec actually requires unsigned semantics for bitshift. Outcome: To: `op[-1].value.intval = (ps_int)((ps_uint)op[-1].value.intval << shift);`.

PERTAIN_TOProblem

output filenames starting with '|' — when processing PostScript files. Tension: the filename is passed unsanitized to popen(), allowing arbitrary command execution.

PERTAIN_TOSolution

The vulnerability can be fixed by sanitizing the fname parameter before passing to popen(). Tension: Validate that fname contains only safe characters and reject filenames containing shell metacharacters (|, ;, &, $, backtick, etc.). Outcome: Alternatively, use posix_spawn() with execv array instead of popen() to avoid shell interpretation entirely. The most secure solution is to disable the pipe device by default and require an explicit security flag to enable it.

FIXED_BYSolution

Change: `op[-1].value.intval <<= shift;` — In zbitshift() at psi/zrelbit.c. Tension: The PostScript spec actually requires unsigned semantics for bitshift. Outcome: To: `op[-1].value.intval = (ps_int)((ps_uint)op[-1].value.intval << shift);`.

PROVIDED_BYPackage

ghostpdl-10.01.1

IMPLEMENTATION_OFDomain

Programming Languages

IMPLEMENTATION_OFDomain

Security / Sandbox Bypass

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata