Description
pstotext before 1.8g does not properly use the "-dSAFER" option when calling Ghostscript to extract plain text from PostScript and PDF files, which allows remote attackers to execute arbitrary commands via a malicious PostScript file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 1
- DSA-792-1 pstotext - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200507-29 vendor-advisory
- 16305 third-party-advisory
- DSA-792 vendor-advisory
- 16624 third-party-advisory
- 16183 third-party-advisory
- pstotext-dsafer-command-execution(21498) vdb-entry
- 14378 vdb-entry