CVE-2024-29506

Artifex Ghostscript is affected by CVE-2024-29506: Ghostscript before 10.03.0 contains a stack-based buffer overflow in pdfi_apply_filter() triggered by a long PDF filter name. Impact, per available references, includes potential memory corruption with high-severity risk; exploitation details are...

CVE-2016-10317

CVE-2016-10317 affects Ghostscript (noted in the Initial and connected docs). The issue is in fill_threshhold_buffer() in base/gxht_thresh.c of Ghostscript 9.20, allowing remote attackers to cause a heap-based buffer overflow and application crash via a crafted PostScript document (denial of serv...

CVE-2018-16585

Artifex Ghostscript prior to 9.24 is affected by CVE-2018-16585 where the .setdistillerkeys PostScript command is accepted despite not being intended for document processing. This leads to memory corruption, enabling remote attackers able to supply crafted PostScript to crash the interpreter or p...

CVE-2024-46953

CVE-2024-46953 concerns Ghostscript before 10.04.0, where an integer overflow while parsing the output filename format string in base/gsdevice.c can cause path truncation, enabling path traversal and potential code execution. Affected: Ghostscript PS/PDF interpreter, notably ghostpdl-10.04.0 and ...

CVE-2017-9835

The CVE-2017-9835 entry refers to Ghostscript 9.21, where the gs_alloc_ref_array path in psi/ialloc.c can be abused via crafted PostScript due to a missing integer overflow check in base/gsalloc.c, causing a heap-based buffer overflow and application crash (remote/denial of service). The connecte...

CVE-2025-27836

CVE-2025-27836 affects Ghostscript prior to 10.05.0, with a print buffer overflow in the BJ10V device (contrib/japanese/gdev10v.c). The issue is confirmed in multiple advisories, and a fix was deployed as part of ghostpdl-10.05.0. Connected documents indicate the vulnerability arises from imprope...

CVE-2025-48708

The CVE-2025-48708 entry is confirmed to affect Artifex Ghostscript and is not a placeholder. The issue is in gs_lib_ctx_stash_sanitized_arg (base/gslibctx.c) before 10.05.1, where argument sanitization for the # case is missing, allowing a created PDF to include its password in cleartext. Affect...

CVE-2025-27837

CVE-2025-27837 affects Artifex Ghostscript prior to 10.05.0. A vulnerability in path handling allows access to arbitrary files via a truncated path containing invalid UTF-8 characters in base/gp_mswin.c and base/winrtsup.cpp. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a CRIT...

CVE-2025-27833

CVE-2025-27833 affects Artifex Ghostscript prior to 10.05.0. A buffer overflow occurs when processing a long TTF font name in pdf/pdf_fmap.c. The CVSS metrics (LOCAL exploit, user interaction required, high impact on confidentiality, integrity, availability) are documented. Remediation is to upgr...

CVE-2016-10219

CVE-2016-10219 is tied to Ghostscript 9.20, where the intersect function in base/gxfill.c can be triggered by a crafted PostScript/PDF document to cause a remote denial of service and application crash via a divide-by-zero error. The linked connected documents corroborate the issue in Ghostscript...

CVE-2020-21710

CVE-2020-21710 is a divide-by-zero in Ghostscript 9.50’s eps_print_page (gdevepsn.c) that enables a remote attacker to cause a denial of service by opening a crafted PDF. The vulnerability is acknowledged and mitigated in vendor advisories: Red Hat RHSA-2024:2966, AlmaLinux ALSA-2024:2966, and ot...

CVE-2018-16513

CVE-2018-16513 affects Artifex Ghostscript prior to 9.24. A crafted PostScript file can trigger a type confusion in the setcolor function, potentially crashing the Ghostscript interpreter or causing unspecified other impact. Mitigation documented across multiple sources is to upgrade Ghostscript ...

CVE-2017-9611

CVE-2017-9611 – Ghostscript GhostXPS 9.21 is affected. The vulnerability is in the Ins_MIRP function of base/ttinterp.c within Artifex Ghostscript GhostXPS 9.21, which allows remote attackers to cause a denial of service via a crafted document. The impact described is a heap-based buffer over-rea...

CVE-2024-46952

CVE-2024-46952 affects Artifex Ghostscript before 10.04.0. The issue is a buffer overflow in the PDF processing path, specifically in pdf/pdf_xref.c during handling of a PDF XRef stream (related to W array values). The vulnerability is triggered when processing certain PDF cross-reference streams...

CVE-2024-46954

Ghostscript before 10.05.0 is affected by decode_utf8() in base/gp_utf8.c mishandling of overlong UTF-8 encoding, enabling a potential directory traversal (CVE-2024-46954). Connected advisories corroborate the issue exists across multiple Linux distributions and note the fix requires upgrading Gh...

CVE-2017-11714

CVE-2017-11714 is a vulnerability in Artifex Ghostscript 9.21 where psi/ztoken.c mishandles references to the scanner state structure, allowing a remote attacker to trigger a denial of service (application crash) or potentially other impact via a crafted PostScript document. The root cause involv...

CVE-2016-7977

Ghostscript before 9.21 could bypass SAFER mode using the .libfile operator in crafted PostScript, allowing reading arbitrary files. This CVE (CVE-2016-7977) affects Ghostscript up to version 9.20/9.21; remediation is to upgrade to Ghostscript 9.21 or newer where fixed. Related entries note simil...

CVE-2016-10220

CVE-2016-10220 affects Artifex Ghostscript, specifically Ghostscript 9.20. The vulnerability is in the function gs_makewordimagedevice (base/gsdevmem.c) and can be triggered by a crafted PDF in the PDF Transparency module, leading to a NULL pointer dereference and an application crash (denial of ...

CVE-2024-29507

CVE-2024-29507 affects Artifex Ghostscript prior to 10.03.0. The vulnerability is described in multiple sources as a heap-based pointer disclosure observable in a constructed BaseFont name within pdf_base_font_alloc, in addition to the already noted stack-based issues (CIDFSubstPath/CIDFSubstFont...

CVE-2016-8602

The CVE-2016-8602 issue affects Ghostscript before 9.21, where the .sethalftone5 function (psi/zht2.c) can be triggered by a crafted PostScript document with an empty operand stack. This could lead to a denial of service (application crash) and, in the worst case, arbitrary code execution. Affect...

CVE-2024-46955

CVE-2024-46955 : Ghostscript contains an out-of-bounds read in psi/zcolor.c when reading color in Indexed color space, before version 10.04.0. Impact is a local issue with user interaction required (per CVSS details: AV:L, UI:R, Availability:A:H). The fix is indicated by the ghostpdl-10.04.0 comm...

CVE-2020-36773

Summary: CVE-2020-36773 affects Artifex Ghostscript up to version 9.52.x (before 9.53.0). The flaw is an out-of-bounds write and use‑after‑free in devices/vector/gdevtxtw.c (txtwrite) caused by a single PDF character code mapping to multiple Unicode code points (e.g., ligatures). Impact (per sour...

CVE-2024-29509

CVE-2024-29509 affects Artifex Ghostscript before 10.03.0, where a heap-based overflow occurs when PDFPassword (e.g., for runpdf) contains a embedded NUL byte in the middle. This can lead to corruption or potential code execution as described in public disclosures. The vulnerability is attributed...

CVE-2016-7979

Ghostscript before 9.21 vulnerable to bypassing SAFER mode protection and executing arbitrary code via type confusion in .initialize_dsc_parser. This CVE (CVE-2016-7979) affects Ghostscript up to version prior to 9.21; exploitation would occur through crafted PostScript documents that trigger typ...

CVE-2025-27834

CVE-2025-27834 affects Artifex Ghostscript prior to 10.05.0. The issue is a buffer overflow triggered by an oversized Type 4 function in a PDF, specifically in pdf/pdf_func.c. Connected sources corroborate the affected component and the root cause (buffer overflow when processing large Type 4 fun...

CVE-2017-8908

CVE-2017-8908 is a Ghostscript vulnerability (affecting Ghostscript 9.21) where the mark_line_tr function in gxscanc.c can be triggered by a crafted PostScript document to cause an out-of-bounds read and denial of service. Public references in connected docs corroborate the issue as a Ghostscript...

CVE-2016-10218

CVE-2016-10218 is a vulnerability in Artifex Ghostscript (Ghostscript 9.20) where the pdf14_pop_transparency_group function (base/gdevp14.c, PDF Transparency module) can be triggered by a crafted file to cause a NULL pointer dereference and application crash, i.e., a denial of service. This is tr...

CVE-2017-15652

CVE-2017-15652 affects Artifex Ghostscript 9.22. The vulnerability is described as an information disclosure risk: attackers can obtain sensitive information through processing a PostScript file. The affected area includes source code files, functions, executables, and libga usage (imagemagick re...

CVE-2017-7948

CVE-2017-7948 describes an integer overflow in Ghostscript 9.21’s mark_curve function, enabling a crafted PostScript document to trigger an out-of-bounds write and crash the application (denial of service) or potentially other impacts. Public advisories and OpenVAS/Gentoo entries confirm Ghostscr...