In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ghostscript-docUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printingUpgrade ghostscript-x11Upgrade ghostscript-tools-dvipdfUpgrade libgsUpgrade ghostscriptUpgrade libgs-devel | Nov 16, 2023 | Mar 31, 2023 |
| Alpine Linux | — | Upgrade ghostscript | Mar 26, 2024 | Mar 31, 2023 |
| Amazon Linux Ami 2 | — | Upgrade libgs-develUpgrade ghostscriptUpgrade ghostscript-docUpgrade libgsUpgrade ghostscript-gtkUpgrade ghostscript-debuginfoUpgrade ghostscript-cups | May 3, 2023 | Mar 31, 2023 |
| Amazon_linux | — | Upgrade ghostscript | May 4, 2023 | Mar 31, 2023 |
| Amazon_linux_2023 | — | Upgrade ghostscript-gtkUpgrade ghostscript-debuginfoUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-tools-fontsUpgrade ghostscript-tools-printingUpgrade ghostscript-debugsourceUpgrade libgs-develUpgrade libgsUpgrade ghostscript-docUpgrade libgs-debuginfoUpgrade ghostscript-gtk-debuginfoUpgrade ghostscriptUpgrade ghostscript-x11Upgrade ghostscript-tools-dvipdf | Feb 17, 2025 | Mar 31, 2023 |
| Centos_linux | — | Upgrade ghostscript-gtk-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-docUpgrade ghostscript-tools-printingUpgrade libgsUpgrade ghostscriptUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-debuginfoUpgrade ghostscript-debugsourceUpgrade ghostscript-tools-dvipdfUpgrade ghostscript-x11Upgrade ghostscript-tools-fonts | Nov 8, 2023 | Mar 31, 2023 |
| Debian | — | Upgrade ghostscript | Apr 6, 2023 | Mar 31, 2023 |
| Freebsd | — | Upgrade ghostscriptUpgrade ghostscript8-x11Upgrade ghostscript7-baseUpgrade ghostscript7-korfontUpgrade ghostscript7-jpnfontUpgrade ghostscript7-x11Upgrade ghostscript7-commfontUpgrade ghostscript9-agpl-baseUpgrade ghostscript8-base | Apr 14, 2023 | Apr 13, 2023 |
| Gentoo Linux | — | Upgrade app-text/ghostscript-gpl. | Sep 18, 2023 | Mar 31, 2023 |
| Ghostscript | — | Upgrade to Ghostscript version 10.01.0 | May 25, 2023 | Mar 31, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade ghostscript-helpUpgrade ghostscript | May 9, 2023 | Mar 31, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ghostscriptUpgrade ghostscript-cups | Feb 12, 2024 | Mar 31, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libgsUpgrade ghostscript | Jan 10, 2024 | Mar 31, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade ghostscriptUpgrade ghostscript-help | Jul 10, 2023 | Mar 31, 2023 |
| Oracle_linux | — | Upgrade ghostscript-tools-printingUpgrade ghostscript-tools-fontsUpgrade ghostscript-docUpgrade ghostscript-x11Upgrade ghostscriptUpgrade ghostscript-tools-dvipdfUpgrade libgsUpgrade libgs-devel | Nov 16, 2023 | Mar 31, 2023 |
| Redhat_linux | — | Upgrade ghostscriptUpgrade ghostscript-tools-dvipdfNo solution existsUpgrade libgs-develUpgrade ghostscript-x11Upgrade ghostscript-docUpgrade libgsUpgrade ghostscript-gtk-debuginfoUpgrade ghostscript-debuginfoUpgrade libgs-debuginfoUpgrade ghostscript-tools-printingUpgrade ghostscript-debugsourceUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-tools-fonts | Nov 8, 2023 | Mar 31, 2023 |
| Suse | — | Upgrade ghostscriptUpgrade ghostscript-develUpgrade ghostscript-x11 | Apr 10, 2023 | Mar 31, 2023 |
| Ubuntu | — | Upgrade ghostscriptUpgrade libgs9Upgrade libgs10Upgrade libgs9 (Ubuntu Pro)Upgrade ghostscript (Ubuntu Pro) | Apr 17, 2023 | Mar 31, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub