CVE-2010-2055: Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows lo...

Security readout for executives and security teams

Older Ghostscript versions could trust startup files placed in the current working directory. A local user could plant a malicious initialization file so Ghostscript runs attacker-controlled PostScript when another user starts it from that directory. Exposure is most likely on legacy systems still running Ghostscript 8.71 or earlier, particularly shared hosts or document-processing environments where users can influence working directories. The source bundle does not identify modern affected products beyond Ghostscript versions. Treat this as a legacy hygiene issue unless Ghostscript runs in shared or automated document workflows. Prioritize remediation where untrusted local users or writable working directories intersect with Ghostscript execution. Mitigation focus: Inventory Ghostscript versions on servers, workstations, and document-processing jobs.; Upgrade Ghostscript through the operating system or vendor-supported package channel.; Review Red Hat, Gentoo, Fedora, SUSE, Debian, or upstream guidance where applicable..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.