CVSS: 9.9EPSS: 12%CPEs: 5EXPL: 0CVE-2021-3781 – Debian Security Advisory 4972-1
https://notcve.org/view.php?id=CVE-2021-3781
12 Sep 2021 — A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se ha encontrado un fallo de escape trivial del sandbox (habilitado con la opción "-dSAFER") en el intérprete de... • https://bugzilla.redhat.com/show_bug.cgi?id=2002271 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 10%CPEs: 5EXPL: 0CVE-2020-15900 – Ubuntu Security Notice USN-4445-1
https://notcve.org/view.php?id=CVE-2020-15900
28 Jul 2020 — A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b. Se encontró un problema de corrupción de memoria en Artifex Ghostscript versiones 9.50 y 9.52. • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=log • CWE-191: Integer Underflow (Wrap or Wraparound) CWE-787: Out-of-bounds Write •