QwikSec

Security Database

CVE

CWE

Training

CVE-2023-28879

Published: Mar 31, 2023

Modified: Feb 14, 2025

PUBLISHED

Description

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://bugs.ghostscript.com/show_bug.cgi?id=706494

https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179

https://ghostscript.readthedocs.io/en/latest/News.html

[debian-lts-announce] 20230404 [SECURITY] [DLA 3381-1] ghostscript security update

mailing-list

vendor-advisory

FEDORA-2023-f51bc947bb

vendor-advisory

[oss-security] 20230412 Ghostscript CVE-2023-28879: "Shell in the Ghost"

mailing-list

FEDORA-2023-fbf86d8916

vendor-advisory

FEDORA-2023-366850fc87

vendor-advisory

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.