CVE-2023-43115

Deeper analysis

In Artifex Ghostscript through version 10.01.2, the gdevijs.c component of GhostPDL permits remote code execution when processing crafted PostScript documents. The flaw arises because a document can activate the IJS device or modify the IjsServer parameter even after the SAFER sandbox has been enabled, bypassing its intended restrictions on external command execution.

An unauthenticated remote attacker can deliver a malicious PostScript file that triggers the vulnerability when opened or processed by a vulnerable Ghostscript installation. Successful exploitation grants the ability to execute arbitrary commands on the target system with the privileges of the Ghostscript process, corresponding to the CVSS 8.8 rating that reflects network attack vector, low complexity, and impacts on confidentiality, integrity, and availability.

Public references point to a corrective commit in the GhostPDL repository and subsequent package updates distributed by Fedora, indicating that mitigation consists of upgrading to a patched Ghostscript release that prevents post-SAFER changes to the IJS configuration. The associated EPSS score has remained at 0.2168 with no material increase observed after disclosure.