Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 146

Export CSV
CVE-2024-33870

ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths

An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Artifex Redhat
Products
Ghostscript Enterprise Linux Rhel Eus
CVE-2024-33871

ghostscript: OPVP device arbitrary code execution via custom Driver library

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp (and oprp) devices can have an arbitrary name for a dynamic library; this library is then loaded.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Artifex Redhat
Products
Ghostscript Enterprise Linux Rhel Aus and 4 more
CVE-2009-3743

ghostscript: TrueType bytecode intepreter integer overflow or wraparound

Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based buffer overflow.

CVSS 2.0 · 9.3 Critical EPSS 6.8% KEV · Not listed
Vendors
Artifex Redhat
Products
Afpl Ghostscript Ghostscript Fonts Gpl Ghostscript and 1 more
CVE-2009-4897

ghostscript: long name buffer overflow (GS 8.64)

Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document containing a long name.

CVSS 2.0 · 9.3 Critical EPSS 6.6% KEV · Not listed
Vendors
Artifex
Products
Afpl Ghostscript Ghostscript Fonts Gpl Ghostscript
CVE-2010-2055

ghostscript: gs_init.ps searched in current directory despite -P-

Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Artifex Redhat
Products
Afpl Ghostscript Ghostscript Fonts Gpl Ghostscript and 1 more
CVE-2010-4054

ghostscript: glyph data access improper input validation

The gs_type2_interpret function in Ghostscript allows remote attackers to cause a denial of service (incorrect pointer dereference and application crash) via crafted font data in a compressed data stream, aka bug 691043.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed
Vendors
Artifex Redhat
Products
Afpl Ghostscript Ghostscript Fonts Gpl Ghostscript and 1 more
CVE-2025-27833

Ghostscript: Buffer overflow with long TTF font name

An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2025-27834

Ghostscript: Buffer overflow caused by an oversized Type 4 function in a PDF

An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document to pdf/pdf_func.c.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2020-17538

ghostscript: buffer overflow in GetNumSameData() in contrib/lips4/gdevlips.c could result in a DoS

A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 1 more
CVE-2020-16296

ghostscript: buffer overflow in GetNumWrongData() in contrib/lips4/gdevlips.c could result in a DoS

A buffer overflow vulnerability in GetNumWrongData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 1 more
CVE-2024-29509

ghostscript: heap buffer overflow via the PDFPassword parameter

Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \000 byte in the middle.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2024-29508

ghostscript: heap pointer leak in pdf_base_font_alloc()

Artifex Ghostscript before 10.03.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2020-16304

ghostscript: buffer overflow in image_render_color_thresh() in base/gxicolor.c could result in a DoS

A buffer overflow vulnerability in image_render_color_thresh() in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to escalate privileges via a crafted eps file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 1 more
CVE-2020-16297

ghostscript: buffer overflow in FloydSteinbergDitheringC() in contrib/gdevbjca.c could result in a DoS

A buffer overflow vulnerability in FloydSteinbergDitheringC() in contrib/gdevbjca.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 1 more
CVE-2020-16291

ghostscript: buffer overflow in contrib/gdevdj9.c could result in a DoS

A buffer overflow vulnerability in contrib/gdevdj9.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

CVSS 3.1 · 5.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Artifex Canonical Debian and 1 more
Products
Ghostscript Ubuntu Linux Debian Linux and 1 more
CVE-2023-28879

ghostscript: buffer overflow in base/sbcp.c leading to data corruption

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.

CVSS 3.1 · 9.8 Critical EPSS 6.3% KEV · Not listed
Vendors
Artifex Debian Redhat
Products
Ghostscript Debian Linux Enterprise Linux
CVE-2022-2085

ghostscript: Null pointer dereference in gx_default_create_buf_device()

A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an init_device_procs defined for the device that uses it as a prototype that depends upon the number of bits per pixel. For bpp > 64, mem_x_device is used and does not have an init_device_procs defined. This flaw allows an attacker to parse a large number of bits (more than 64 bits per pixel), which triggers a NULL pointer dereference flaw, causing an application to crash.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Artifex Fedoraproject
Products
Ghostscript Fedora
CVE-2024-29506

ghostscript: stack-based buffer overflow in the pdfi_apply_filter()

Artifex Ghostscript before 10.03.0 has a stack-based buffer overflow in the pdfi_apply_filter() function via a long PDF filter name.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Artifex
Products
Ghostscript
CVE-2023-43115

Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents

In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server).

CVSS 3.1 · 8.8 High EPSS 6.4% KEV · Not listed
Vendors
Artifex Fedoraproject Redhat
Products
Ghostscript Fedora Enterprise Linux and 1 more
CVE-2021-45944

ghostscript: use-after-free in sampled_data_sample may lead to DoS

Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp).

CVSS 3.1 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Artifex Debian
Products
Ghostscript Debian Linux