Debian Ghostscript vulnerabilities

CVE-2017-9727 [HIGH] CVE-2017-9727: ghostscript - The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS... The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resol

CVE-2017-9612 [HIGH] CVE-2017-9612: ghostscript - The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allo... The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resolved (fixed in 9.22~dfsg

CVE-2017-9618 [HIGH] CVE-2017-9618: ghostscript - The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS... The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resolved (fixed i

CVE-2017-9611 [HIGH] CVE-2017-9611: ghostscript - The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 al... The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resolved (fix

CVE-2018-10194 [HIGH] CVE-2018-10194: ghostscript - The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite comp... The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. Scope: local bookworm: resolved (

CVE-2017-9610 [HIGH] CVE-2017-9610: ghostscript - The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS... The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resol

CVE-2017-9740 [HIGH] CVE-2017-9740: ghostscript - The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript Gh... The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky:

CVE-2017-9620 [HIGH] CVE-2017-9620: ghostscript - The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript Gh... The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document, related to the xps_encode_font_char_imp function. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1

CVE-2018-16513 [HIGH] CVE-2018-16513: ghostscript - In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript ... In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have unspecified other impact. Scope: local bookworm: resolved (fixed in 9.22~dfsg-3) bullseye: resolved (fixed in 9.22~dfsg-3) forky: resolved (fixed in 9.22~dfsg-3) sid: resolved (fixed i

CVE-2019-25059 [HIGH] CVE-2019-25059: ghostscript - Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exis... Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. Scope: local bookworm: resolved (fixed in 9.27~dfsg-1) bullseye: resolved (fixed in 9.27~dfsg-1) forky: resolved (fixed in 9.27~dfsg-1) sid: resolved (fixed in 9.27~dfsg-1) trixie: resolved (fixed in 9.27~dfsg-1)

CVE-2020-21890 [HIGH] CVE-2020-21890: ghostscript - Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in... Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of service or other unspecified impact(s) via opening of crafted PDF document. Scope: local bookworm: resolved (fixed in 9.51~dfsg-1) bullseye: resolved (fixed in 9.51~dfsg-1) forky: resolved (fixed in 9.51~dfsg-1) s

CVE-2018-16543 [HIGH] CVE-2018-16543: ghostscript - In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow at... In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact. Scope: local bookworm: resolved (fixed in 9.25~dfsg-1) bullseye: resolved (fixed in 9.25~dfsg-1) forky: resolved (fixed in 9.25~dfsg-1) sid: resolved (fixed in 9.25~dfsg-1) trixie: resolved (fixed in 9.25~dfsg-1)

CVE-2018-11645 [MEDIUM] CVE-2018-11645: ghostscript - psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command eve... psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977. Scope: local bookworm: resolved (fixed in 9.21~dfsg-1) bullseye: resolved (fixed in 9.21~dfsg-1) forky: resolved (fixed in 9.21~dfsg-1)

CVE-2017-11714 [HIGH] CVE-2017-11714: ghostscript - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner st... psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c. Scope: local bookworm: resolv

CVE-2008-3520 [CRITICAL] CVE-2008-3520: ghostscript - Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attac... Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation. Scope: local bookworm: resolved (fixed in 8.64~dfsg-2) bullseye: resolved (fixed in 8.64~dfsg-2) forky: resolved (fixed in 8.64~dfsg-2) sid: resolved (fixed in 8.64~dfs

CVE-2017-7948 [HIGH] CVE-2017-7948: ghostscript - Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows r... Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resolved (fixed

CVE-2015-3228 [MEDIUM] CVE-2015-3228: ghostscript - Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghost... Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write. Scope: local bookworm: resolved (fixed in 9.15~dfsg-1) bullseye: resolv

CVE-2008-6679 [MEDIUM] CVE-2008-6679: ghostscript - Buffer overflow in the BaseFont writer module in Ghostscript 8.62, and possibly ... Buffer overflow in the BaseFont writer module in Ghostscript 8.62, and possibly other versions, allows remote attackers to cause a denial of service (ps2pdf crash) and possibly execute arbitrary code via a crafted Postscript file. Scope: local bookworm: resolved (fixed in 8.64~dfsg-1) bullseye: resolved (fixed in 8.64~dfsg-1) forky: resolved (fixed in 8.64~dfsg-

CVE-2019-3835 [MEDIUM] CVE-2019-3835: ghostscript - It was found that the superexec operator was available in the internal dictionar... It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Scope: local bookworm: resolved (fixed in 9.27~dfsg-1) bullseye: resolved (fixed in 9.27~dfsg-1

CVE-2019-3838 [MEDIUM] CVE-2019-3838: ghostscript - It was found that the forceput operator could be extracted from the DefineResour... It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Scope: local bookworm: resolved (fixed in 9.27~dfsg-1) bullseye: resolved (fixed in 9.2