CVE-2013-5653

What it actually does

The getenv and filenameforall functions in the PostScript interpreter bypass the -dSAFER sandbox, permitting a crafted input file to read arbitrary files from the host filesystem.

Why it matters to the business

Attackers can exfiltrate sensitive configuration files, credentials, or proprietary data from any system that processes untrusted PostScript content; the presence in 98 downstream dependents amplifies exposure across the software supply chain.

How an attack unfolds

An attacker crafts a PostScript file that invokes getenv or filenameforall to read target files, embeds the file in a document or job submitted to an affected application, and receives the leaked contents in the resulting output or error stream.

How to fix it

Upgrade tensorflow (Bitnami) to version 2.12.1 or later; ensure any bundled Ghostscript component is also updated to a release that honors -dSAFER.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release; test with a known non-SAFER-violating PostScript sample to verify sandbox behavior.

Typical attack path

1. Identify an entry point that accepts or renders PostScript (e.g., document upload, print job, image conversion).
2. Craft a minimal PostScript payload using getenv or filenameforall to read a chosen file path.
3. Submit the payload through the normal processing channel.
4. Capture the disclosed file contents from the generated output or log artifacts.

How to detect it

Review application and system logs for unexpected file-open operations or error messages containing absolute paths after PostScript jobs; correlate with process execution of the affected binary on systems that recently processed documents.

What your security team should do

• Apply the listed fixed version immediately given the 3502-day exposure window.
• Disable PostScript processing for untrusted input until patches are deployed.
• Add file-type and content filters that block or sanitize PostScript jobs at ingestion points.