Vulnerability Name:

CVE-2010-2055 (CCN-60276)

Assigned:2010-05-26
Published:2010-05-26
Updated:2015-01-09
Summary:Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.
CVSS v3 Severity:5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.3 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
3.4 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.4 Medium (REDHAT CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)
3.2 Low (REDHAT Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-17
Vulnerability Consequences:Gain Privileges
References:Source: CONFIRM
Type: UNKNOWN
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583183

Source: CONFIRM
Type: UNKNOWN
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583316

Source: CONFIRM
Type: Exploit
http://bugs.ghostscript.com/show_bug.cgi?id=691339

Source: CONFIRM
Type: UNKNOWN
http://bugs.ghostscript.com/show_bug.cgi?id=691350

Source: MITRE
Type: CNA
CVE-2010-2055

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-10660

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-10642

Source: SUSE
Type: UNKNOWN
SUSE-SR:2010:014

Source: CCN
Type: RHSA-2012-0095
Moderate: ghostscript security update

Source: CCN
Type: GNU gv Web page
GNU gv - News: gv 3.7.0 released (Security Fix) & Translators wanted [Savannah]

Source: CONFIRM
Type: UNKNOWN
http://savannah.gnu.org/forum/forum.php?forum_id=6368

Source: CCN
Type: SA40452
Ghostscript -P- Command Line Option Security Issue

Source: SECUNIA
Type: Vendor Advisory
40452

Source: CCN
Type: SA40475
GNU gv Two Security Issues

Source: SECUNIA
Type: Vendor Advisory
40475

Source: SECUNIA
Type: Vendor Advisory
40532

Source: GENTOO
Type: UNKNOWN
GLSA-201412-17

Source: CCN
Type: GNU gv Web site
GNU gv

Source: OSVDB
Type: UNKNOWN
66247

Source: CCN
Type: OSVDB ID: 66247
Ghostscript -P- Command Line Option Arbitrary Postscript Command Execution

Source: BUGTRAQ
Type: UNKNOWN
20100522 Ghostscript 8.64 executes random code at startup

Source: BUGTRAQ
Type: Exploit
20100526 Re: Ghostscript 8.64 executes random code at startup

Source: BUGTRAQ
Type: Exploit
20100526 Re: Ghostscript 8.64 executes random code at startup

Source: BUGTRAQ
Type: UNKNOWN
20100526 Re: Ghostscript 8.64 executes random code at startup

Source: VUPEN
Type: Vendor Advisory
ADV-2010-1757

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.novell.com/show_bug.cgi?id=608071

Source: CONFIRM
Type: Patch
https://bugzilla.redhat.com/show_bug.cgi?id=599564

Source: XF
Type: UNKNOWN
gnugv-gs-command-execution(60276)

Source: REDHAT
Type: UNKNOWN
RHSA-2012:0095

Vulnerable Configuration:Configuration 1:
  • cpe:/a:artifex:afpl_ghostscript:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:6.01:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:6.50:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:7.00:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:7.03:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:7.04:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.00:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.11:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.12:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.13:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.14:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.50:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.51:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.52:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.53:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:afpl_ghostscript:8.54:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:ghostscript_fonts:6.0:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:ghostscript_fonts:8.11:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.01:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.15:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.50:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.51:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.54:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.56:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.57:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.60:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.61:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.62:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.63:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.64:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:8.70:*:*:*:*:*:*:*
  • OR cpe:/a:artifex:gpl_ghostscript:*:*:*:*:*:*:*:* (Version <= 8.71)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnu:gv:3.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:gv:3.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:gv:3.6.2:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20102055
    V
    		CVE-2010-2055
    2022-05-20
    oval:org.mitre.oval:def:23156
    P
    		ELSA-2012:0095: ghostscript security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:20914
    P
    		RHSA-2012:0095: ghostscript security update (Moderate)
    2014-02-24
    oval:com.redhat.rhsa:def:20120095
    P
    		RHSA-2012:0095: ghostscript security update (Moderate)
    2012-02-02
    BACK
    artifex afpl ghostscript 6.0
    artifex afpl ghostscript 6.01
    artifex afpl ghostscript 6.50
    artifex afpl ghostscript 7.00
    artifex afpl ghostscript 7.03
    artifex afpl ghostscript 7.04
    artifex afpl ghostscript 8.00
    artifex afpl ghostscript 8.11
    artifex afpl ghostscript 8.12
    artifex afpl ghostscript 8.13
    artifex afpl ghostscript 8.14
    artifex afpl ghostscript 8.50
    artifex afpl ghostscript 8.51
    artifex afpl ghostscript 8.52
    artifex afpl ghostscript 8.53
    artifex afpl ghostscript 8.54
    artifex ghostscript fonts 6.0
    artifex ghostscript fonts 8.11
    artifex gpl ghostscript 8.01
    artifex gpl ghostscript 8.15
    artifex gpl ghostscript 8.50
    artifex gpl ghostscript 8.51
    artifex gpl ghostscript 8.54
    artifex gpl ghostscript 8.56
    artifex gpl ghostscript 8.57
    artifex gpl ghostscript 8.60
    artifex gpl ghostscript 8.61
    artifex gpl ghostscript 8.62
    artifex gpl ghostscript 8.63
    artifex gpl ghostscript 8.64
    artifex gpl ghostscript 8.70
    artifex gpl ghostscript *
    gnu gv 3.6.0
    gnu gv 3.6.1
    gnu gv 3.6.2
    redhat enterprise linux 5
    redhat enterprise linux 5
    redhat enterprise linux 5
    redhat enterprise linux 6
    redhat enterprise linux 6
    redhat enterprise linux desktop 6
    redhat enterprise linux hpc node 6