Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2023-28879

critical

CVE-2023-28879

ghostscript: buffer overflow in base/sbcp.c leading to data corruption

Published Modified CWE 787
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Amazon (high), Red Hat (medium), AlmaLinux (medium), Oracle (medium), Ubuntu (medium).

Description

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.

Affected packages and fixed versions

SourcePackageFixed in
alma 8ghostscript, ghostscript-doc, ghostscript-tools-dvipdf and 5 more9.27-11.el8
alma 9ghostscript, ghostscript-doc, ghostscript-tools-dvipdf and 5 more9.54.0-13.el9
alpine 3.14ghostscript9.54.0-r2
alpine 3.15ghostscript9.55.0-r1
alpine 3.16ghostscript9.56.1-r1
alpine 3.17ghostscript10.0.0-r1
amazon linux 1ghostscript, ghostscript-debuginfo, ghostscript-devel and 1 more8.70-24.28.amzn1
amazon linux 2ghostscript, ghostscript-cups, ghostscript-debuginfo and 4 more9.25-5.amzn2.0.3
amazon linux 2023ghostscript, ghostscript-debuginfo, ghostscript-debugsource and 11 more9.56.1-7.amzn2023.0.1
debian 10ghostscript9.27~dfsg-2+deb10u7
debian 11ghostscript9.53.3~dfsg-7+deb11u4
debian 12ghostscript10.0.0~dfsg-11
Show all 114 entries from 33 sources
SourcePackageFixed in
alma 8ghostscript9.27-11.el8
alma 8ghostscript-doc9.27-11.el8
alma 8ghostscript-tools-dvipdf9.27-11.el8
alma 8ghostscript-tools-fonts9.27-11.el8
alma 8ghostscript-tools-printing9.27-11.el8
alma 8ghostscript-x119.27-11.el8
alma 8libgs9.27-11.el8
alma 8libgs-devel9.27-11.el8
alma 9ghostscript9.54.0-13.el9
alma 9ghostscript-doc9.54.0-13.el9
alma 9ghostscript-tools-dvipdf9.54.0-13.el9
alma 9ghostscript-tools-fonts9.54.0-13.el9
alma 9ghostscript-tools-printing9.54.0-13.el9
alma 9ghostscript-x119.54.0-13.el9
alma 9libgs9.54.0-13.el9
alma 9libgs-devel9.54.0-13.el9
alpine 3.14ghostscript9.54.0-r2
alpine 3.15ghostscript9.55.0-r1
alpine 3.16ghostscript9.56.1-r1
alpine 3.17ghostscript10.0.0-r1
amazon linux 1ghostscript8.70-24.28.amzn1
amazon linux 1ghostscript-debuginfo8.70-24.28.amzn1
amazon linux 1ghostscript-devel8.70-24.28.amzn1
amazon linux 1ghostscript-doc8.70-24.28.amzn1
amazon linux 2ghostscript9.25-5.amzn2.0.3
amazon linux 2ghostscript-cups9.25-5.amzn2.0.3
amazon linux 2ghostscript-debuginfo9.25-5.amzn2.0.3
amazon linux 2ghostscript-doc9.25-5.amzn2.0.3
amazon linux 2ghostscript-gtk9.25-5.amzn2.0.3
amazon linux 2libgs9.25-5.amzn2.0.3
amazon linux 2libgs-devel9.25-5.amzn2.0.3
amazon linux 2023ghostscript9.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-debuginfo9.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-debugsource9.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-doc9.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-gtk9.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-gtk-debuginfo9.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-tools-dvipdf9.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-tools-fonts9.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-tools-printing9.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-x119.56.1-7.amzn2023.0.1
amazon linux 2023ghostscript-x11-debuginfo9.56.1-7.amzn2023.0.1
amazon linux 2023libgs9.56.1-7.amzn2023.0.1
amazon linux 2023libgs-debuginfo9.56.1-7.amzn2023.0.1
amazon linux 2023libgs-devel9.56.1-7.amzn2023.0.1
debian 10ghostscript9.27~dfsg-2+deb10u7
debian 11ghostscript9.53.3~dfsg-7+deb11u4
debian 12ghostscript10.0.0~dfsg-11
debian 13ghostscript10.0.0~dfsg-11
debian 14ghostscript10.0.0~dfsg-11
echoghostscript10.0.0~dfsg-11
Oracle Linux 8ghostscript9.27-11.el8
Oracle Linux 8ghostscript-doc9.27-11.el8
Oracle Linux 8ghostscript-tools-dvipdf9.27-11.el8
Oracle Linux 8ghostscript-tools-fonts9.27-11.el8
Oracle Linux 8ghostscript-tools-printing9.27-11.el8
Oracle Linux 8ghostscript-x119.27-11.el8
Oracle Linux 8libgs9.27-11.el8
Oracle Linux 8libgs-devel9.27-11.el8
Oracle Linux 9ghostscript9.54.0-13.el9
Oracle Linux 9ghostscript-doc9.54.0-13.el9
Oracle Linux 9ghostscript-tools-dvipdf9.54.0-13.el9
Oracle Linux 9ghostscript-tools-fonts9.54.0-13.el9
Oracle Linux 9ghostscript-tools-printing9.54.0-13.el9
Oracle Linux 9ghostscript-x119.54.0-13.el9
Oracle Linux 9libgs9.54.0-13.el9
Oracle Linux 9libgs-devel9.54.0-13.el9
rapidfort amazon linux 2023ghostscript9.56.1-7.amzn2023.0.1
rapidfort amazon linux 2023ghostscript-doc9.56.1-7.amzn2023.0.1
rapidfort amazon linux 2023ghostscript-gtk9.56.1-7.amzn2023.0.1
rapidfort amazon linux 2023ghostscript-tools-dvipdf9.56.1-7.amzn2023.0.1
rapidfort amazon linux 2023ghostscript-tools-fonts9.56.1-7.amzn2023.0.1
rapidfort amazon linux 2023ghostscript-tools-printing9.56.1-7.amzn2023.0.1
rapidfort amazon linux 2023ghostscript-x119.56.1-7.amzn2023.0.1
rapidfort amazon linux 2023libgs9.56.1-7.amzn2023.0.1
rapidfort amazon linux 2023libgs-devel9.56.1-7.amzn2023.0.1
rapidfort Oracle Linux 9ghostscript0:9.54.0-13.el9
rapidfort Oracle Linux 9ghostscript-doc0:9.54.0-13.el9
rapidfort Oracle Linux 9ghostscript-tools-dvipdf0:9.54.0-13.el9
rapidfort Oracle Linux 9ghostscript-tools-fonts0:9.54.0-13.el9
rapidfort Oracle Linux 9ghostscript-tools-printing0:9.54.0-13.el9
rapidfort Oracle Linux 9ghostscript-x110:9.54.0-13.el9
rapidfort Oracle Linux 9libgs0:9.54.0-13.el9
rapidfort ubuntu 20.04ghostscript0:9.55.0~dfsg1-0ubuntu5.2
rapidfort ubuntu 20.04rf-ghostscript0:9.55.0~dfsg1-0ubuntu5.2
rapidfort ubuntu 22.04ghostscript0:9.55.0~dfsg1-0ubuntu5.2
rapidfort ubuntu 22.04rf-ghostscript0:9.55.0~dfsg1-0ubuntu5.2
rapidfort ubuntu 24.04ghostscript0:9.55.0~dfsg1-0ubuntu5.2
rapidfort ubuntu 24.04rf-ghostscript0:9.55.0~dfsg1-0ubuntu5.2
Red Hatghostscriptno fix listed
Red Hatghostscript-cupsno fix listed
Red Hatghostscript-develno fix listed
Red Hatghostscript-docno fix listed
Red Hatghostscript-gtkno fix listed
Red Hatgimp:flatpak::ghostscriptno fix listed
Red Hatgimp:flatpak::ghostscript-docno fix listed
Red Hatgimp:flatpak::ghostscript-tools-dvipdfno fix listed
Red Hatgimp:flatpak::ghostscript-tools-fontsno fix listed
Red Hatgimp:flatpak::ghostscript-tools-printingno fix listed
Red Hatgimp:flatpak::ghostscript-x11no fix listed
Red Hatgimp:flatpak::libgsno fix listed
Red Hatgimp:flatpak::libgs-develno fix listed
Red Hatlibgsno fix listed
Red Hatlibgs-develno fix listed
root.io alpine 3.17rootio-ghostscript10.0.0-r1
root.io debian 12rootio-ghostscript10.0.0~dfsg-11
ubuntu 16.04-ESMghostscript9.26~dfsg+0-0ubuntu0.16.04.14+esm5
ubuntu 18.04ghostscript9.26~dfsg+0-0ubuntu0.18.04.18
ubuntu 18.04-ESMghostscript9.26~dfsg+0-0ubuntu0.18.04.18
ubuntu 20.04ghostscript9.50~dfsg-5ubuntu4.7
ubuntu 20.04-ESMghostscript9.50~dfsg-5ubuntu4.7
ubuntu 22.04ghostscript9.55.0~dfsg1-0ubuntu5.2
ubuntu 22.10ghostscript9.56.1~dfsg1-0ubuntu3.1
ubuntu 23.04ghostscript10.0.0~dfsg1-0ubuntu1.1

References

All 25 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.