Logo
›
›vulnerability›CVE-2023-28879
Name
CVE-2023-28879
Source
NVD ( link)Debian ( link)
Description
In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.
CWEs
CWE-787 CWE-787
Published Date
Updated Date
Workaround
-
Advisories
https://bugs.ghostscript.com/show_bug.cgi?id=706494Exploit
https://ghostscript.readthedocs.io/en/latest/News.htmlRelease Notes
https://lists.debian.org/debian-lts-announce/2023/04/msg00003.htmlMailing List
https://www.debian.org/security/2023/dsa-5383Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=706494Exploit
https://ghostscript.readthedocs.io/en/latest/News.htmlRelease Notes
https://lists.debian.org/debian-lts-announce/2023/04/msg00003.htmlMailing List
https://www.debian.org/security/2023/dsa-5383Third Party Advisory

Analysis#

Affected Component
Analysis
ghostscript
Patched

Vulnerability Ratings#

9.8
CVSSv31
9.8
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
ghostscript
buildroot
2025.02.x
10.07.0
Not Affected
ghostscript
buildroot
master
10.07.0
Not Affected
ghostscript
yocto
master
10.07.1
Not Affected
ghostscript
yocto
scarthgap
10.05.1
Not Affected

Resolved with patches#

ghostscript (yocto:kirkstone)

#
Title
Author
Resolve
1
Graphics library - prevent buffer overrun in (T)BCP encoding
Ken Sharp <ken.sharp@artifex.com>
CVE-2023-28879