Description
An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ghostscript | 10.05.0-1.1 | openSUSE-SU-2025:14953-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ghostscript | 10.05.0-r0 | — |
| Alpine v3.23 | ghostscript | 10.05.0-r0 | — |
| Alpine v3.22 | ghostscript | 10.05.0-r0 | — |
| Alpine v3.21 | ghostscript | 10.05.0-r0 | — |
| Alpine v3.20 | ghostscript | 10.05.0-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | ghostscript | 10.05.0-r0 | — |
| Alpine v3.18 | ghostscript | 10.05.0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libgs +8 | 9.56.1-7.amzn2023.0.16 | ALAS2023-2025-927 |
| Amazon Linux 2 | libgs +5 | 9.54.0-9.amzn2.0.10 | ALAS2-2025-2820 |
Advisories 4
- openSUSE-SU-2025:14953-1 ghostscript-10.05.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0556 Ghostscript: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Dec 14, 2025
- ALAS2-2025-2820 Important: ghostscript security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 16, 2025
- ALAS2023-2025-927 Important: ghostscript security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 14, 2025