CVE-2013-5653

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-07 · updated 2026-06-16
Weakness: CWE-200

Description

The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.

Affected products

Artifex Afpl Ghostscript: 9.10
Debian Linux: 8.0

References

http://rhn.redhat.com/errata/RHSA-2017-0013.html
http://rhn.redhat.com/errata/RHSA-2017-0014.html
http://www.debian.org/security/2016/dsa-3691
http://www.openwall.com/lists/oss-security/2016/09/29/28
http://www.openwall.com/lists/oss-security/2016/09/29/5
http://www.securityfocus.com/bid/96497
https://bugs.ghostscript.com/show_bug.cgi?id=694724
https://bugs.ghostscript.com/show_bug.cgi?id=697169
https://bugzilla.redhat.com/show_bug.cgi?id=1380327
http://rhn.redhat.com/errata/RHSA-2017-0013.html
http://rhn.redhat.com/errata/RHSA-2017-0014.html
http://www.debian.org/security/2016/dsa-3691

Get alerted when CVE-2013-5653 or the next vulnerability affects your stack