CVE-2023-38560: Ghostscript: integer overflow in pcl/pl/plfont.c:418 in pl_glyph_name
First published: Thu Jul 20 2023(Updated: )
An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Artifex Software Ghostscript |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b7eb1d0174c
- https://access.redhat.com/security/cve/CVE-2023-38560
- https://bugzilla.redhat.com/show_bug.cgi?id=2224368
- https://bugs.ghostscript.com/show_bug.cgi?id=706897
- https://bugs.ghostscript.com/show_bug.cgi?id=706898
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2225381
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2224368#c1
- https://bugs.ghostscript.com/show_bug.cgi?id=70689
- https://access.redhat.com/security/cve/cve-2023-38560
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2224368#c6
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-38560.
Where is the vulnerability located?
The vulnerability is located in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript.
What is the impact of this vulnerability?
This vulnerability may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.
What software is affected by this vulnerability?
Artifex Ghostscript is affected by this vulnerability.
How severe is this vulnerability?
The severity of this vulnerability is medium, with a CVSS score of 5.5.
- agent/author
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-38560
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-latest
- collector/nvd-api
- vendor/artifex
- canonical/artifex software ghostscript