CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-21710 – ghostscript: Divide by zero in eps_print_page in gdevepsn.c
https://notcve.org/view.php?id=CVE-2020-21710
A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50 allows remote attackers to cause a denial of service via opening of crafted PDF file. GhostScript is vulnerable to divide by zero issue in function eps_print_page in gdevepsn.c allows remote attacker to cause a denial of service via crafted PDF file. • https://bugs.ghostscript.com/show_bug.cgi?id=701843 https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=4e713293de84b689c4ab358f3e110ea54aa81925 https://lists.debian.org/debian-lts-announce/2023/09/msg00029.html https://access.redhat.com/security/cve/CVE-2020-21710 https://bugzilla.redhat.com/show_bug.cgi?id=2235001 • CWE-369: Divide By Zero •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38560 – Ghostscript: integer overflow in pcl/pl/plfont.c:418 in pl_glyph_name
https://notcve.org/view.php?id=CVE-2023-38560
An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format. Se ha encontrado un fallo de desbordamiento de enteros en pcl/pl/plfont.c:418 en pl_glyph_name en ghostscript. Este problema puede permitir a un atacante local provocar una denegación de servicio mediante la transformación de un archivo PCL manipulado en formato PDF. • https://access.redhat.com/security/cve/CVE-2023-38560 https://bugs.ghostscript.com/show_bug.cgi?id=706898 https://bugzilla.redhat.com/show_bug.cgi?id=2224368 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b7eb1d0174c • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-38559 – Ghostscript: out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in dos
https://notcve.org/view.php?id=CVE-2023-38559
A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs. Se ha encontrado un fallo de desbordamiento de búfer en base/gdevdevn.c:1973 en devn_pcx_write_rle() en ghostscript. Este problema puede permitir a un atacante local provocar una denegación de servicio mediante la salida de un archivo PDF manipulado para un dispositivo DEVN con gs. • https://access.redhat.com/errata/RHSA-2023:6544 https://access.redhat.com/errata/RHSA-2023:7053 https://access.redhat.com/security/cve/CVE-2023-38559 https://bugs.ghostscript.com/show_bug.cgi?id=706897 https://bugzilla.redhat.com/show_bug.cgi?id=2224367 https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1 https://lists.debian.org/debian-lts-announce/2023/08/msg00006.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-125: Out-of-bounds Read •
CVSS: 8.4EPSS: 0%CPEs: 5EXPL: 3CVE-2023-36664 – ghostscript: vulnerable to OS command injection due to mishandles permission validation for pipe devices
https://notcve.org/view.php?id=CVE-2023-36664
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). Artifex Ghostscript a través de 10.01.2 maneja mal la validación de permisos para dispositivos pipe (con el prefijo %pipe% o el prefijo | pipe character). A vulnerability was found in Ghostscript. This flaw occurs due to a mishandled permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). • https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection https://github.com/jeanchpt/CVE-2023-36664 https://github.com/churamanib/CVE-2023-36664-Ghostscript-command-injection https://bugs.ghostscript.com/show_bug.cgi?id=706761 https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=0974e4f2ac0005d3731e0b5c13ebc7e965540f4d https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=505eab7782b429017eb434b2b95120855f2b0e3c https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/ • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-28879 – ghostscript: buffer overflow in base/sbcp.c leading to data corruption
https://notcve.org/view.php?id=CVE-2023-28879
In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written. En Artifex Ghostscript hasta la versión 10.01.0, hay un desbordamiento de búfer que puede corromper los datos internos del intérprete PostScript, en base/sbcp.c. Esto afecta a BCPEncode, BCPDecode, TBCPEncode y TBCPDecode. • http://www.openwall.com/lists/oss-security/2023/04/12/4 https://bugs.ghostscript.com/show_bug.cgi?id=706494 https://ghostscript.readthedocs.io/en/latest/News.html https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179 https://lists.debian.org/debian-lts-announce/2023/04/msg00003.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CI6UCKM3XMK7PYNIRGAVDJ5VKN6XYZOE https://lists.fedoraproject.org/archives/list/package-announce& • CWE-787: Out-of-bounds Write •