Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Ghostscript ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Angriff durchzuführen, oder Informationen auszulesen.
Product
Ghostscript ist ein kostenloser Interpreter der Seitenbeschreibungssprachen PostScript und Portable Document Format (PDF).
Vulnerabilities 2
-
Medium 5.8
Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback
A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit thi…
-
Low 3.3
Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading
A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-cxh6-m3hf-v489 vom 2026-10-29
https://github.com/advisories/GHSA-cxh6-m3hf-v489
-
GitHub Security Advisory GHSA-q8vr-mvf4-2f5x vom 2026-10-29
https://github.com/advisories/GHSA-q8vr-mvf4-2f5x