CVE-2013-5653

Publication date 31 December 2013

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.5 · Medium

Score breakdown

Description

The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.

Status

Package Ubuntu Release Status
ghostscript 16.10 yakkety
Fixed 9.19~dfsg+1-0ubuntu6.2
16.04 LTS xenial
Fixed 9.18~dfsg~0-0ubuntu2.2
14.04 LTS trusty
Fixed 9.10~dfsg-0ubuntu10.5
12.04 LTS precise
Fixed 9.05~dfsg-0ubuntu4.4

Severity score breakdown

Parameter Value
Base score 5.5 · Medium
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

    • USN-3148-1
    • Ghostscript vulnerabilities
    • 2 December 2016

Other references