CVE-2010-2055

CVE-2010-2055 is a high-severity vulnerability in Artifex Afpl Ghostscript with a CVSS 2.0 base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-17.

Key facts

• Severity: High (CVSS 2.0 base score 7.2)
• EPSS exploit prediction: 1% (39th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-17
• Affected product: Artifex Afpl Ghostscript
• Published: 2010-07-22
• Last modified: 2026-06-16

Description

Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.

Frequently asked questions

What is CVE-2010-2055?

Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.

How severe is CVE-2010-2055?

CVE-2010-2055 has a CVSS 2.0 base score of 7.2, rated high severity.

Is CVE-2010-2055 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (39th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2010-2055?

CVE-2010-2055 primarily affects Artifex Afpl Ghostscript. In total, 32 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2010-2055?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2010-2055 published?

CVE-2010-2055 was published on 2010-07-22 and last updated on 2026-06-16.

References

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583183
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583316
• http://bugs.ghostscript.com/show_bug.cgi?id=691339
• http://bugs.ghostscript.com/show_bug.cgi?id=691350
• http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043913.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043948.html
• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
• http://savannah.gnu.org/forum/forum.php?forum_id=6368
• http://secunia.com/advisories/40452
• http://secunia.com/advisories/40475
• http://secunia.com/advisories/40532
• http://security.gentoo.org/glsa/glsa-201412-17.xml
• http://www.osvdb.org/66247
• http://www.securityfocus.com/archive/1/511433
• http://www.securityfocus.com/archive/1/511472
• http://www.securityfocus.com/archive/1/511474
• http://www.securityfocus.com/archive/1/511476
• http://www.vupen.com/english/advisories/2010/1757
• https://bugzilla.novell.com/show_bug.cgi?id=608071
• https://bugzilla.redhat.com/show_bug.cgi?id=599564
• https://rhn.redhat.com/errata/RHSA-2012-0095.html

Affected products (32)

• cpe:2.3:a:artifex:afpl_ghostscript:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:6.01:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:6.50:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:7.00:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:7.03:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:7.04:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.00:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.11:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.12:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.13:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.14:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.50:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.51:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.52:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.53:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:afpl_ghostscript:8.54:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:ghostscript_fonts:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:ghostscript_fonts:8.11:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:*:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.01:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.15:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.50:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.51:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.54:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.56:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.57:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.60:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.61:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.62:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.63:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.64:*:*:*:*:*:*:*
• cpe:2.3:a:artifex:gpl_ghostscript:8.70:*:*:*:*:*:*:*

More vulnerabilities in Artifex Afpl Ghostscript

• CVE-2009-3743 — Critical (CVSS 9.3): Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows…
• CVE-2009-4897 — Critical (CVSS 9.3): Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or…
• CVE-2017-6196 — High (CVSS 7.8): Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before…
• CVE-2015-3228 — Medium (CVSS 6.8): Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote…
• CVE-2013-5653 — Medium (CVSS 5.5): The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote…
• CVE-2010-4054 — Medium (CVSS 4.3): The gs_type2_interpret function in Ghostscript allows remote attackers to cause a denial of service (incorrect pointer…

All CVEs affecting Artifex Afpl Ghostscript →

Other CWE-17 vulnerabilities

• CVE-2015-5887 — Critical (CVSS 10.0): The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request…
• CVE-2015-2738 — Critical (CVSS 10.0): The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before…
• CVE-2015-2737 — Critical (CVSS 10.0): The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR…
• CVE-2015-2734 — Critical (CVSS 10.0): The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0,…
• CVE-2015-4335 — Critical (CVSS 10.0): Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
• CVE-2015-3292 — Critical (CVSS 10.0): The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging…

Browse all CWE-17 vulnerabilities →