CVE-2024-33869

Artifex Ghostscript versions before 10.03.1 are vulnerable to path traversal and command execution due to an improper input validation flaw in the base/gpmisc.c file. A crafted PostScript document can exploit the path reduction logic to bypass restrictions on the use of the %pipe% prefix, for exa...

CVE-2017-8291

Summary of CVE-2017-8291 (Ghostscript Type Confusion) : Ghostscript before or on 2017-04-26 allowed bypass of -dSAFER and remote command execution through a type confusion in parsing .eps/.rsdparams, specifically involving the substring "/OutputFile (%pipe%" in a crafted EPS input. In the wild ex...

CVE-2023-38559

CVE-2023-38559 is a Ghostscript vulnerability: a buffer overflow/ out-of-bounds condition in base/gdevdevn.c:1973 (devn_pcx_write_rle()) could allow a local attacker to cause a denial of service by processing a crafted PDF for a DEVN device with gs. The connected advisories confirm the issue and ...

CVE-2024-29510

Artifex Ghostscript versions prior to 10.03.1 are vulnerable to memory corruption and a SAFER sandbox bypass due to a format string injection flaw. This vulnerability is triggered via a uniprint device , potentially allowing an attacker to achieve shell command execution . Practical exploitation ...

CVE-2024-29511

Artifex Ghostscript versions prior to 10.03.1 are vulnerable to a directory traversal issue when Tesseract is utilized for OCR. The flaw exists in the OCRLanguage parameter, which can be exploited to allow arbitrary file reading and the writing of error messages to arbitrary files. For instance, ...

CVE-2023-52722

An improper input validation vulnerability exists in Artifex Ghostscript before version 10.03.1 within the psi/zmisc1.c file. When SAFER mode is active, the software allows eexec seeds other than the Type 1 standard. This flaw could allow a remote attacker to execute arbitrary code . Remediation ...

CVE-2019-10216

CVE-2019-10216 concerns GPL Ghostscript. The vulnerability is in the .buildfont1 procedure, which did not properly secure privileged calls, allowing a crafted PostScript file to bypass -dSAFER and escalate privileges to access restricted files. Affected: Ghostscript prior to 9.50. Impact: potenti...

CVE-2024-33871

Artifex Ghostscript versions prior to 10.03.1 are vulnerable to arbitrary code execution due to a flaw in contrib/opvp/gdevopvp.c. The vulnerability exists because the Driver parameter for opvp (and oprp ) devices allows for an arbitrary name for a dynamic library, which the system then loads. Th...

CVE-2024-33870

Artifex Ghostscript versions prior to 10.03.1 are vulnerable to a path traversal issue. An attacker can use a crafted PostScript document to access arbitrary files if the current directory is within the permitted paths. This occurs because the software may improperly handle path transformations, ...

CVE-2018-16509

A remote code execution vulnerability exists in Artifex Ghostscript (versions before 9.24) due to incorrect privilege restoration checking during the handling of /invalidaccess exceptions. An attacker capable of supplying crafted PostScript code can bypass the -dSAFER protection and execute arbit...

CVE-2019-3839

Ghostscript (Artifex) is affected by CVE-2019-3839: after the CVE-2019-6116 fix, some privileged operators remain accessible from various PostScript contexts, allowing a crafted PostScript file to access the filesystem outside -dSAFER constraints. The issue affects Ghostscript versions before 9.2...

CVE-2023-28879

CVE-2023-28879 affects Ghostscript (through 10.01.0) with a buffer overflow in base/sbcp.c affecting BCPEncode/BCPDecode/TBCPEncode/TBCPDecode. The issue can corrupt internal PostScript interpreter data when the write buffer is near full and an escaped character is written, potentially causing to...

CVE-2019-14811

Summary: Ghostscript before version 9.50 contains sandbox-safety bypasses in multiple procedures, notably the ".pdf_hook_DSC_Creator" path, allowing crafted PostScript to bypass -dSAFER and potentially access the file system or execute commands. Other vulnerable entry points include ".forceput" e...

CVE-2019-14817

Ghostscript before version 9.50 is affected by sandbox escape flaws via multiple PostScript procedures, including .pdfexectoken, .pdf_hook_DSC_Creator, setuserparams, and setsystemparams, allowing bypass of -dSAFER and potential file-system access or command execution. Affected versions are befor...

CVE-2019-3835

CVE-2019-3835 affects Ghostscript prior to 9.27. A specially crafted PostScript file could cause a sandbox escape by abusing the internal superexec operator, allowing access to the filesystem outside -dSAFER. The issue was part of sandbox bypasses tied to various operators and has been fixed upst...

CVE-2019-3838

Ghostscript prior to 9.27 is vulnerable to sandbox escape via crafted PostScript (CVE-2019-3835, CVE-2019-3838). The flaws enable access to the filesystem outside -dSAFER by exploiting the superexec/forceput paths in the internal dictionary. Upstream fixes are in 9.27; Arch Linux advisory recomme...

CVE-2018-16540

Artifex Ghostscript is affected by CVE-2018-16540 (ghostscript before 9.24). The issue is a use-after-free in the PDF14 converter’s copydevice handling that could crash the interpreter or have other unspecified impact when processing crafted PostScript/PDF. Evidence in connected advisories confir...

CVE-2018-19478

Ghostscript (Artifex) vulnerable before 9.26. A carefully crafted PDF can trigger an extremely long-running computation while parsing, potentially causing a denial of service. CVE-2018-19478. The connected sources indicate the issue exists in Ghostscript 9.25 and earlier; remediation is to upgrad...

CVE-2018-19409

Ghostscript advisory CVE-2018-19409 affects Artifex Ghostscript prior to 9.26, where LockSafetyParams is not checked correctly if another device is used. This is part of several post-2018 vulnerabilities in Ghostscript; Red Hat/CentOS and Debian/LTS advisories indicate that fixes were released in...

CVE-2023-36664

CVE-2023-36664 affects Artifex Ghostscript up to version 10.01.2. The issue is a mishandling of permission validation for pipe devices (prefixes %pipe% or the | character), which could allow arbitrary command execution when processing crafted documents. Public advisories confirm the vulnerability...

CVE-2018-19475

CVE-2018-19475 affects Artifex Ghostscript prior to 9.26. The root cause is that psi/zdevice2.c fails to check available stack space when the device remains the same, allowing remote attackers to bypass intended access restrictions. The issue is reported as a remote-access/bypass vulnerability in...

CVE-2020-16287

Ghostscript v9.50 is affected by a buffer overflow in lprn_is_black() (contrib/lips4/gdevlprn.c) that could allow a remote attacker to cause a denial of service via a crafted PDF. The issue is fixed in Ghostscript v9.51. Suggested action: upgrade to 9.51 or later. CVSS data present in the provide...

CVE-2018-17183

CVE-2018-17183 affects Artifex Ghostscript up to version 9.25. Affected component: error handling structures in Ghostscript’s execution path. Root cause: a user-writable error exception table could be abused by remote attackers that supply crafted PostScript, potentially overwriting or replacing ...

CVE-2023-4042

Ghostscript is the affected component. CVE-2023-4042 denotes an incomplete fix for CVE-2020-16305 in Ghostscript as shipped with Red Hat Enterprise Linux 8, with Red Hat advisories noting the fix was not included as claimed. Published connections from AlmaLinux and Amazon Linux advisories frame C...

CVE-2018-15910

Artifex Ghostscript before 9.24 is affected by a type confusion in the LockDistillerParams parameter that can be triggered by crafted PostScript, potentially crashing the interpreter or enabling code execution. This CVE (CVE-2018-15910) is corroborated across multiple sources (vendor advisories a...

CVE-2018-19477

CVE-2018-19477 relates to Artifex Ghostscript prior to 9.26, where a JBIG2Decode type confusion in psi/zfjbig2.c allows remote attackers to bypass access restrictions by sending specially crafted input. Public disclosures in multiple sources (e.g., Debian/Red Hat advisories, IBM PowerKVM bulletin...

CVE-2020-16301

CVE-2020-16301 affects Artifex Software Ghostscript v9.50. A buffer overflow in the function okiibm_print_page1() (devices/gdevokii.c) could allow a remote attacker to cause a denial of service via a crafted PDF file. The vulnerability is explicitly fixed in Ghostscript 9.51. The available connec...

CVE-2020-16298

CVE-2020-16298 is a Ghostscript vulnerability affecting version 9.50 where a buffer overflow in the function mj_color_correct() (contrib/japanese/gdevmjc.c) could allow a remote attacker to cause a denial of service via a crafted PDF file. The issue is addressed in Ghostscript v9.51. Connected do...

CVE-2020-16293

Ghostscript CVE-2020-16293 is a null pointer dereference in compose_group_nonknockout_nonblend_isolated_allmask_common() (base/gxblend.c) in Ghostscript v9.50 that can cause a denial-of-service when processing a crafted PDF. The issue is corrected in Ghostscript v9.51. Affected product: Ghostscri...

CVE-2024-29508

CVE-2024-29508 affects Artifex Ghostscript prior to 10.03.0. The issue is a heap-based pointer disclosure observable in a constructed BaseFont name, in the function pdf_base_font_alloc. Documents consistently describe this Ghostscript vulnerability as enabling information leakage. The CVSSv3.1 ve...

CVE-2018-17961

CVE-2018-17961 affects Artifex Ghostscript 9.25 and earlier. It enables sandbox bypass via vectors involving errorhandler setup, saved execution stacks, or the 1Policy operator, potentially allowing code execution or sandbox escape when processing crafted PostScript. The issue is related to an in...

CVE-2018-19476

Artifex Ghostscript before 9.26 contains a setcolorspace type confusion in psi/zicc.c that lets remote attackers bypass access restrictions. Affected: Ghostscript versions prior to 9.26 (e.g., 9.25 and earlier per advisories). Impact per sources ranges from information disclosure to potential cod...

CVE-2020-16300

Ghostscript 9.50 contains a buffer overflow in tiff12_print_page() (devices/gdevtfnx.c) that can be triggered by a crafted PDF file, allowing a remote attacker to cause denial of service. The issue is fixed in Ghostscript 9.51. Affected product: Artifex Ghostscript. Root cause: a buffer overflow ...

CVE-2020-16295

Ghostscript v9.50 contains a null pointer dereference in clj_media_size() (devices/gdevclj.c) that allows remote attackers to cause a denial of service via crafted PDF files. The issue affects Artifex Ghostscript 9.50 and is fixed in version 9.51. Mitigation: upgrade to 9.51 or newer. The CVE is ...

CVE-2020-16289

CVE-2020-16289 describes a buffer overflow in Ghostscript 9.50, specifically in cif_print_page() within devices/gdevcif.c, which could allow a remote attacker to cause a denial of service by processing a crafted PDF. The issue is fixed in Ghostscript 9.51. Affected product: Artifex Software Ghost...

CVE-2020-16308

CVE-2020-16308 affects Artifex Software Ghostscript v9.50, with a vulnerability in p_print_image() in devices/gdevcdj.c that could allow a remote attacker to cause a denial-of-service via a crafted PDF file. The issue is mitigated by upgrading to Ghostscript v9.51, which contains the fix. Referen...

CVE-2018-16802

Artifex Ghostscript prior to 9.25 is affected by CVE-2018-16802: incorrect “restoration of privilege” checking when stack overflows during exception handling could allow code execution via crafted PostScript using the pipe operator. This stems from an incomplete fix for CVE-2018-16509. The issue ...

CVE-2020-16294

The CVE-2020-16294 vulnerability is a buffer overflow in Ghostscript v9.50 affecting epsc_print_page() in devices/gdevepsc.c, exploitable via a crafted PDF to cause a denial of service. The issue is fixed in Ghostscript v9.51; remediation is to upgrade to at least 9.51. The connected sources (e.g...

CVE-2024-46951

CVE-2024-46951 is an issue in Artifex Ghostscript (Pattern color space) where an unchecked Implementation pointer could lead to arbitrary code execution. Connected advisories confirm this affects Ghostscript’s PostScript/PDF interpreter and note a developer-identified fix in ghostpdl-10.04.0, add...

CVE-2020-16288

Ghostscript (Artifex) CVE-2020-16288 affects the 9.50 release. The vulnerability is a buffer overflow in pj_common_print_page() within devices/gdevpjet.c, exploitable by processing a crafted PDF file and capable of causing a denial of service. The issue is fixed in Ghostscript 9.51 (upgrade recom...

CVE-2025-27832

Artifex Ghostscript versions before 10.05.0 are vulnerable to a compression buffer overflow in the NPDL device (specifically within contrib/japanese/gdevnpdl.c). This flaw allows for a memory corruption condition during the processing of PostScript or PDF documents. Impact includes potential remo...

CVE-2018-16543

CVE-2018-16543 affects Ghostscript. In versions prior to 9.24, the functions gssetresolution and gsgetresolution could be exploited to cause an unspecified impact. Public advisories in the connected set (EulerOS, openSUSE/SUSE/SUSE-like updates) confirm the issue and show a remediation path: upgr...

CVE-2020-16290

CVE-2020-16290 describes a buffer overflow in Artifex Ghostscript (Ghostscript v9.50) specifically in jetp3852_print_page() within devices/gdev3852.c. Exploitation could allow a remote attacker to cause a denial of service by processing a crafted PDF file. The vulnerability was fixed in Ghostscri...

CVE-2020-16292

Ghostscript v9.50 contains a buffer overflow in mj_raster_cmd() (contrib/japanese/gdevmjc.c) that can be triggered by processing a crafted PDF, allowing a remote attacker to cause a denial of service. The issue is fixed in Ghostscript v9.51. Affected product: Artifex Ghostscript; vulnerable compo...

CVE-2020-16299

Ghostscript vulnerability CVE-2020-16299: A Division by Zero in bj10v_print_page() (contrib/japanese/gdev10v.c) of Artifex Ghostscript v9.50 can cause a denial of service via a crafted PDF. Affects Ghostscript 9.50; fixed in v9.51. Remediation is to upgrade to 9.51 or later. No exploit details ar...

CVE-2018-16511

Artifex Ghostscript (pre-9.24) is vulnerable to a type confusion in ztype that remote attackers can exploit via crafted PostScript to crash the interpreter (possible other impact). The CVE entry for CVE-2018-16511 is supported by multiple advisories; remediation is to update Ghostscript to a newe...

CVE-2018-16541

Ghostscript before 9.24 is affected by CVE-2018-16541 due to incorrect free logic in pagedevice replacement when processing crafted PostScript files, which can crash the interpreter. Affected products in public advisories include Ghostscript packages across several distributions (e.g., CentOS 7, ...

CVE-2018-16542

CVE-2018-16542 affects Artifex Ghostscript prior to 9.24. An attacker could craft PostScript to trigger insufficient interpreter stack-size checking during error handling, potentially crashing the Ghostscript interpreter (denial of service). Some connected sources also describe a stack-based out-...

CVE-2024-46956

CVE-2024-46956 affects Artifex Ghostscript (psi/zfile.c) with an out-of-bounds data access in filenameforall that can lead to arbitrary code execution on Ghostscript versions up to 10.04.0. Connected advisories confirm this vulnerability and provide patch guidance; mitigation is to update Ghostsc...

CVE-2025-27835

A buffer overflow vulnerability exists in Artifex Ghostscript before version 10.05.0 . The flaw is located in the psi/zbfont.c file and is caused by a lack of input size validation during the conversion of glyphs to Unicode . This oversight leads to a buffer copy error, which could allow an attac...