Read the docs
TI-2004-00875 Aliases CVE-2004-0967GHSA-jp9f-f85w-rv5v

The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP…

Priority LOW 32CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.

Why it matters now

EPSS 0.00474 41st percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:aladdin_enterprises:ghostscript:4.3:*:*:*:*:*:*:*4.3VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:4.3.2:*:*:*:*:*:*:*4.3.2VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.10:*:*:*:*:*:*:*5.10.10VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.10:*:mdk:*:*:*:*:*5.10.10VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.10_1:*:*:*:*:*:*:*5.10.10_1VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.10_1:*:mdk:*:*:*:*:*5.10.10_1VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.12cl:*:*:*:*:*:*:*5.10.12clVulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.15:*:*:*:*:*:*:*5.10.15VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.16:*:*:*:*:*:*:*5.10.16VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.10cl:*:*:*:*:*:*:*5.10clVulnerableAladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.10:*:*:*:*:*:*:* Versions 5.10.10 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.10:*:mdk:*:*:*:*:* Versions 5.10.10 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.10_1:*:*:*:*:*:*:* Versions 5.10.10_1 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.10_1:*:mdk:*:*:*:*:* Versions 5.10.10_1 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.12cl:*:*:*:*:*:*:* Versions 5.10.12cl Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.15:*:*:*:*:*:*:* Versions 5.10.15 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.10.16:*:*:*:*:*:*:* Versions 5.10.16 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.10cl:*:*:*:*:*:*:* Versions 5.10cl Vulnerable ·Aladdin Enterprises
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:aladdin_enterprises:ghostscript:5.50:*:*:*:*:*:*:*5.50VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.50.8:*:*:*:*:*:*:*5.50.8VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:5.50.8_7:*:*:*:*:*:*:*5.50.8_7VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:6.51:*:*:*:*:*:*:*6.51VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:6.52:*:*:*:*:*:*:*6.52VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:6.53:*:*:*:*:*:*:*6.53VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:7.0.4:*:*:*:*:*:*:*7.0.4VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:7.0.5:*:*:*:*:*:*:*7.0.5VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:7.0.6:*:*:*:*:*:*:*7.0.6VulnerableAladdin Enterprises
cpe:2.3:a:aladdin_enterprises:ghostscript:7.0.7:*:*:*:*:*:*:*7.0.7VulnerableAladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.50:*:*:*:*:*:*:* Versions 5.50 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.50.8:*:*:*:*:*:*:* Versions 5.50.8 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:5.50.8_7:*:*:*:*:*:*:* Versions 5.50.8_7 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:6.51:*:*:*:*:*:*:* Versions 6.51 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:6.52:*:*:*:*:*:*:* Versions 6.52 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:6.53:*:*:*:*:*:*:* Versions 6.53 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:7.0.5:*:*:*:*:*:*:* Versions 7.0.5 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:7.0.6:*:*:*:*:*:*:* Versions 7.0.6 Vulnerable ·Aladdin Enterprises
  • cpe:2.3:a:aladdin_enterprises:ghostscript:7.0.7:*:*:*:*:*:*:* Versions 7.0.7 Vulnerable ·Aladdin Enterprises

Remediation

Red Hat 1 advisory

  • RHSA-2005:081 Released 2005-09-28 · Red Hat rating Low
    ghostscript security update
    • Red Hat Desktop version 3 ghostscript-7.05-32.1.10, ghostscript-7.05-32.1.10.i386, ghostscript-devel-7.05-32.1.10 +3
    • Red Hat Enterprise Linux AS version 3 ghostscript-7.05-32.1.10, ghostscript-7.05-32.1.10.i386, ghostscript-7.05-32.1.10.ia64 +9
    • Red Hat Enterprise Linux ES version 3 ghostscript-7.05-32.1.10, ghostscript-7.05-32.1.10.i386, ghostscript-7.05-32.1.10.ia64 +6
    • Red Hat Enterprise Linux WS version 3 ghostscript-7.05-32.1.10, ghostscript-7.05-32.1.10.i386, ghostscript-7.05-32.1.10.ia64 +6

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2005:081
Red Hat Enterprise Linux AS version 3Fixed RHSA-2005:081
Red Hat Enterprise Linux ES version 3Fixed RHSA-2005:081
Red Hat Enterprise Linux WS version 3Fixed RHSA-2005:081

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-0967
  2. 2026-10-03 Alias added: GHSA-jp9f-f85w-rv5v

References

Advisory 3

Other 2

  • TI-1999-00153 The ghostscript command with the -dSAFER option allows remote attackers to execute commands. CVSS 2.0HIGH 7.5
  • TI-2002-00351 ghostscript before 6.53 allows attackers to execute arbitrary commands by using .locksafe… CVSS 2.0HIGH 7.5
  • TI-2000-01151 ghostscript before 5.10-16 uses an empty LD_RUN_PATH environmental variable to find… CVSS 2.0MEDIUM 4.6
  • TI-2000-01150 ghostscript before 5.10-16 allows local users to overwrite files of other users via a symlink attack. CVSS 2.0LOW 3.7
  • TI-2001-01306 ghostscript before 6.51 allows local users to read and write arbitrary files as the 'lp'… CVSS 2.0LOW 2.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences