Artifex Ghostscript before 10.03.1, when Tesseract is used for OCR, has a directory traversal issue that allows arbitrary file reading (and writing of error messages to arbitrary files) via OCRLanguage. For example, exploitation can use debug_file /tmp/out and user_patterns_file /etc/passwd.
The product is released with debugging code still enabled or active.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ghostscript | Artifex | * | 10.03.1 (excluding) |
| Ghostscript | Ubuntu | devel | * |
| Ghostscript | Ubuntu | jammy | * |
| Ghostscript | Ubuntu | mantic | * |
| Ghostscript | Ubuntu | noble | * |
| Ghostscript | Ubuntu | upstream | * |