Skip to content
Fencer Vulns
high 8.8

CVE-2023-43115 json

In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because th…

published 2023-09-18 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-47536

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.4%
EPSS 6.4% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).

Patch / fix

  • ghostscript Debian 12 10.0.0~dfsg-11+deb12u2
  • ghostscript Debian 14, Debian 13 10.02.0~dfsg-1

debian advisories DEBIAN-CVE-2023-43115

  • ghostscript Ubuntu 20.04 LTS 9.50~dfsg-5ubuntu4.11
  • ghostscript Ubuntu 22.04 LTS 9.55.0~dfsg1-0ubuntu5.5

ubuntu advisories UBUNTU-CVE-2023-43115

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ghostscript RHEL 9 9.54.0-14.el9_3
  • libgs RHEL 9 9.54.0-14.el9_3
  • ghostscript-x11 RHEL 9 9.54.0-14.el9_3
  • ghostscript-tools-fonts RHEL 9 9.54.0-14.el9_3
  • ghostscript-tools-dvipdf RHEL 9 9.54.0-14.el9_3
  • ghostscript-tools-printing RHEL 9 9.54.0-14.el9_3
  • ghostscript RHEL 9 9.54.0-11.el9_2
  • libgs RHEL 9 9.54.0-11.el9_2

red hat advisories RHSA-2023:6732RHSA-2023:6265RHSA-2023:5868

  • ghostscript SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +14 more 9.52-150000.173.2
  • ghostscript SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 9.52-23.60.1

suse advisories SUSE-SU-2023:3984-1SUSE-SU-2023:3938-1

  • python-ocrmypdf openSUSE Tumbleweed 17.4.2-1.1
  • ghostscript openSUSE Tumbleweed 9.56.1-6.1

opensuse advisories openSUSE-SU-2026:10855-1openSUSE-SU-2024:13247-1

  • ghostscript AlmaLinux 9 9.54.0-14.el9_3
  • libgs AlmaLinux 9 9.54.0-14.el9_3
  • ghostscript-x11 AlmaLinux 9 9.54.0-14.el9_3
  • ghostscript-tools-fonts AlmaLinux 9 9.54.0-14.el9_3
  • ghostscript-tools-dvipdf AlmaLinux 9 9.54.0-14.el9_3
  • ghostscript-tools-printing AlmaLinux 9 9.54.0-14.el9_3
  • ghostscript AlmaLinux 9 9.54.0-11.el9_2
  • libgs AlmaLinux 9 9.54.0-11.el9_2

almalinux advisories ALSA-2023:6732ALSA-2023:6265

  • ghostscript Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 10.02.0-r0

alpine advisories ALPINE-CVE-2023-43115

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-43115 updated cvss 8.8

Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents

  • Red Hat Enterprise Linux 6 ghostscript, ghostscript-gtk
    affected: no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder (v. 9) ghostscript 9.54.0-14.el9_3, ghostscript-tools-fonts 9.54.0-14.el9_3, ghostscript-tools-printing 9.54.0-14.el9_3
    fixed: vendor fix RHSA-2023:6732
  • Red Hat CodeReady Linux Builder EUS (v.9.0) ghostscript 9.54.0-7.el9_0.2, ghostscript-tools-fonts 9.54.0-7.el9_0.2, ghostscript-tools-printing 9.54.0-7.el9_0.2
    fixed: vendor fix RHSA-2023:5868
  • Red Hat Enterprise Linux AppStream (v. 9) libgs 9.54.0-11.el9_2, libgs 9.54.0-14.el9_3, ghostscript 9.54.0-11.el9_2, ghostscript 9.54.0-14.el9_3, ghostscript-x11 9.54.0-11.el9_2, ghostscript-x11 9.54.0-14.el9_3, +6 more
    fixed: vendor fix RHSA-2023:6265
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) libgs 9.54.0-7.el9_0.2, ghostscript 9.54.0-7.el9_0.2, ghostscript-x11 9.54.0-7.el9_0.2, ghostscript-tools-fonts 9.54.0-7.el9_0.2, ghostscript-tools-dvipdf 9.54.0-7.el9_0.2, ghostscript-tools-printing 9.54.0-7.el9_0.2
    fixed: vendor fix RHSA-2023:5868
  • Red Hat Enterprise Linux CRB (v. 9) ghostscript 9.54.0-11.el9_2, ghostscript-tools-fonts 9.54.0-11.el9_2, ghostscript-tools-printing 9.54.0-11.el9_2
    fixed: vendor fix RHSA-2023:6265
  • Red Hat Enterprise Linux 7 libgs, ghostscript, ghostscript-gtk, ghostscript-cups Red Hat Enterprise Linux 8 libgs, ghostscript, ghostscript-x11, ghostscript-tools-fonts, ghostscript-tools-dvipdf, ghostscript-tools-printing
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

6.37% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.