Debian Ghostscript vulnerabilities

CVE-2024-33870 [MEDIUM] CVE-2024-33870: ghostscript - An issue was discovered in Artifex Ghostscript before 10.03.1. There is path tra... An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal (via a crafted PostScript document) to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ is permitted. Scope: local bookworm: resolved (fixed in 10.0.0~d

CVE-2017-9739 [HIGH] CVE-2017-9739: ghostscript - The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 al... The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resolved (fix

CVE-2017-9727 [HIGH] CVE-2017-9727: ghostscript - The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS... The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resol

CVE-2017-9612 [HIGH] CVE-2017-9612: ghostscript - The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allo... The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resolved (fixed in 9.22~dfsg

CVE-2017-9618 [HIGH] CVE-2017-9618: ghostscript - The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS... The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resolved (fixed i

CVE-2018-10194 [HIGH] CVE-2018-10194: ghostscript - The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite comp... The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. Scope: local bookworm: resolved (

CVE-2017-9611 [HIGH] CVE-2017-9611: ghostscript - The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 al... The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resolved (fix

CVE-2017-9610 [HIGH] CVE-2017-9610: ghostscript - The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS... The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resol

CVE-2017-9740 [HIGH] CVE-2017-9740: ghostscript - The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript Gh... The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky:

CVE-2017-9620 [HIGH] CVE-2017-9620: ghostscript - The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript Gh... The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document, related to the xps_encode_font_char_imp function. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1

CVE-2020-21890 [HIGH] CVE-2020-21890: ghostscript - Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in... Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of service or other unspecified impact(s) via opening of crafted PDF document. Scope: local bookworm: resolved (fixed in 9.51~dfsg-1) bullseye: resolved (fixed in 9.51~dfsg-1) forky: resolved (fixed in 9.51~dfsg-1) s

CVE-2018-16543 [HIGH] CVE-2018-16543: ghostscript - In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow at... In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact. Scope: local bookworm: resolved (fixed in 9.25~dfsg-1) bullseye: resolved (fixed in 9.25~dfsg-1) forky: resolved (fixed in 9.25~dfsg-1) sid: resolved (fixed in 9.25~dfsg-1) trixie: resolved (fixed in 9.25~dfsg-1)

CVE-2018-11645 [MEDIUM] CVE-2018-11645: ghostscript - psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command eve... psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977. Scope: local bookworm: resolved (fixed in 9.21~dfsg-1) bullseye: resolved (fixed in 9.21~dfsg-1) forky: resolved (fixed in 9.21~dfsg-1)

CVE-2017-11714 [HIGH] CVE-2017-11714: ghostscript - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner st... psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c. Scope: local bookworm: resolv

CVE-2017-7948 [HIGH] CVE-2017-7948: ghostscript - Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows r... Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document. Scope: local bookworm: resolved (fixed in 9.22~dfsg-1) bullseye: resolved (fixed in 9.22~dfsg-1) forky: resolved (fixed

CVE-2008-3520 [CRITICAL] CVE-2008-3520: ghostscript - Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attac... Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation. Scope: local bookworm: resolved (fixed in 8.64~dfsg-2) bullseye: resolved (fixed in 8.64~dfsg-2) forky: resolved (fixed in 8.64~dfsg-2) sid: resolved (fixed in 8.64~dfs

CVE-2015-3228 [MEDIUM] CVE-2015-3228: ghostscript - Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghost... Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write. Scope: local bookworm: resolved (fixed in 9.15~dfsg-1) bullseye: resolv

CVE-2019-3835 [MEDIUM] CVE-2019-3835: ghostscript - It was found that the superexec operator was available in the internal dictionar... It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Scope: local bookworm: resolved (fixed in 9.27~dfsg-1) bullseye: resolved (fixed in 9.27~dfsg-1

CVE-2019-3838 [MEDIUM] CVE-2019-3838: ghostscript - It was found that the forceput operator could be extracted from the DefineResour... It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. Scope: local bookworm: resolved (fixed in 9.27~dfsg-1) bullseye: resolved (fixed in 9.2

CVE-2013-5653 [MEDIUM] CVE-2013-5653: ghostscript - The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER"... The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file. Scope: local bookworm: resolved (fixed in 9.19~dfsg-3.1) bullseye: resolved (fixed in 9.19~dfsg-3.1) forky: resolved (fixed in 9.19~dfsg-3.1) sid: resolved (fixed in 9.19~dfsg-3.1) trixie: resolved (