CVE-2023-43115

HIGH 8.8CVE-2023-43115 · Published 18/09/2023 · updated 17/06/2026

In short

CVE-2023-43115 is a HIGH (CVSS 8.8) vulnerability affecting ghostscript (artifex).
Chance of exploitation in the next 30 days (EPSS): 6.0%, higher than 93.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ghostscript artifex	`≤ 10.01.2`	No fix yet

Description

In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).

References

bugs.ghostscript.com/show_bug.cgi · Permissions Required
ghostscript.com · Product
git.ghostscript.com · Broken Link
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IK3UXJ5HKMPAL5EQELJAWSRPA2AUOJJO · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PG5AQV7JOL5TAU76FWPJCMSKO5DREKV5 · Mailing List

More vulnerabilities in ghostscript

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ghostscript

artifex

≤ 10.01.2

No fix yet

Description

More vulnerabilities in ghostscript

See all →