CVE-2013-5653

Published: Mar 7, 2017Modified: May 13, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.

Affected (2)

Products: Artifex: Afpl Ghostscript · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Artifex Afpl Ghostscript	Version 9.10

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (18)

http://rhn.redhat.com/errata/RHSA-2017-0013.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2017-0014.html

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3691

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/09/29/28

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/09/29/5

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/bid/96497

Source: cve@mitre.org

https://bugs.ghostscript.com/show_bug.cgi?id=694724

Source: cve@mitre.org

Issue TrackingPatch

https://bugs.ghostscript.com/show_bug.cgi?id=697169

Source: cve@mitre.org

Issue TrackingPatch

https://bugzilla.redhat.com/show_bug.cgi?id=1380327

Source: cve@mitre.org

Issue TrackingPatch

http://rhn.redhat.com/errata/RHSA-2017-0013.html