Description
iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libitext5-java | 5.5.13.3-1 | — |
| Debian 13 | libitext5-java | 5.5.13.3-1 | — |
| Debian 12 | libitext5-java | 5.5.13.3-1 | — |
| Debian 11 | libitext5-java | 5.5.13.2-1+deb11u1 | DSA-5323-1 |
| Debian 10 | libitext5-java | 5.5.13-1+deb10u1 | DLA-3273-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libitext5-java | No fix yet | — |
| Ubuntu 26.04 LTS | libitext5-java | No fix yet | — |
| Ubuntu 25.10 | libitext5-java | No fix yet | — |
| Ubuntu 24.04 LTS | libitext5-java | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.itextpdf:itext7-core | < 7.1.17 | 7.1.17 | GHSA-gv87-q66h-4277 |
| Maven | com.itextpdf:itextpdf | < 5.5.13.3 | 5.5.13.3 | GHSA-gv87-q66h-4277 |
Advisories 6
- DSA-5323-1 libitext5-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3273-1 libitext5-java - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0160 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2024-1689 Dell Data Protection Advisor: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Jul 22, 2024
- WID-SEC-2024-0896 Oracle Insurance Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2023-1807 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 26, 2023