Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-28879

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.

Published

2023-03-31T17:15:06.697

Last Modified

2025-02-14T20:15:33.373

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses

Type: Primary
CWE-787
Type: Secondary
CWE-787

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	artifex	ghostscript	< 10.01.0	Yes
Operating System	debian	debian_linux	10.0	Yes
Operating System	debian	debian_linux	11.0	Yes

References

http://www.openwall.com/lists/oss-security/2023/04/12/4 ([email protected])
https://bugs.ghostscript.com/show_bug.cgi?id=706494 Exploit, Vendor Advisory ([email protected])
https://ghostscript.readthedocs.io/en/latest/News.html Release Notes ([email protected])
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179 ([email protected])
https://lists.debian.org/debian-lts-announce/2023/04/msg00003.html Mailing List, Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CI6UCKM3XMK7PYNIRGAVDJ5VKN6XYZOE/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHJX62KSRIOBZA6FKONMJP7MEFY7LTH2/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MADLP3GWJFLLFVNZGEDNPMDQR6CCXAHN/ ([email protected])
https://security.gentoo.org/glsa/202309-03 ([email protected])
https://www.debian.org/security/2023/dsa-5383 Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2023/04/12/4 (af854a3a-2127-422b-91ae-364da2661108)
https://bugs.ghostscript.com/show_bug.cgi?id=706494 Exploit, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://ghostscript.readthedocs.io/en/latest/News.html Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179 (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2023/04/msg00003.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CI6UCKM3XMK7PYNIRGAVDJ5VKN6XYZOE/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHJX62KSRIOBZA6FKONMJP7MEFY7LTH2/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MADLP3GWJFLLFVNZGEDNPMDQR6CCXAHN/ (af854a3a-2127-422b-91ae-364da2661108)
https://security.gentoo.org/glsa/202309-03 (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2023/dsa-5383 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)