Buffer Overflow in Ghostscript Affects Artifex Products
CVE-2023-28879

9.8CRITICAL

Key Information:

Vendor
Artifex
Status
Ghostscript
Vendor
CVE Published:
31 March 2023

Summary

A buffer overflow vulnerability exists in Artifex Ghostscript versions up to 10.01.0. This issue arises in the PostScript interpreter, specifically within the routines for encoding and decoding (BCPEncode, BCPDecode, TBCPEncode, TBCPDecode) found in base/sbcp.c. The flaw occurs when a write buffer is filled to one byte less than its capacity, resulting in potential data corruption when an escaped character is written. This unexpected data handling can lead to unpredictable behavior within applications using Ghostscript, making prompt attention to this vulnerability essential.

References

https://bugs.ghostscript.com/show_bug.cgi?id=706494
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3B...
https://ghostscript.readthedocs.io/en/latest/News.html

EPSS Score

31% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.