ghostscript (SUSE:Linux Enterprise Server 12 SP2-BCL) — known CVEs & security advisories
Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 12 SP2-BCL package ghostscript, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (38)
CVE-2021-3781 — CVSS 9.9 (critical): A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted…
CVE-2020-15900 — CVSS 9.8 (critical): A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of…
CVE-2023-28879 — CVSS 9.8 (critical): In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript…
CVE-2018-19409 — CVSS 9.8 (critical): An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used.
CVE-2019-14813 — CVSS 9.8 (critical): A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged…
CVE-2019-14869 — CVSS 8.8 (high): A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its…
CVE-2018-17961 — CVSS 8.6 (high): Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup…
CVE-2018-18284 — CVSS 8.6 (high): Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
CVE-2018-16543 — CVSS 7.8 (high): In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact.
CVE-2018-16585 — CVSS 7.8 (high): An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even though it is not…
CVE-2018-16802 — CVSS 7.8 (high): An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running out of stack during…
CVE-2018-17183 — CVSS 7.8 (high): Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply…
CVE-2018-19475 — CVSS 7.8 (high): psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack…
CVE-2018-19476 — CVSS 7.8 (high): psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace…
CVE-2018-19477 — CVSS 7.8 (high): psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode…
CVE-2019-14811 — CVSS 7.8 (high): A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its…
CVE-2019-14812 — CVSS 7.8 (high): A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its…
CVE-2019-14817 — CVSS 7.8 (high): A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its…
CVE-2023-36664 — CVSS 7.8 (high): Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character…
CVE-2018-15909 — CVSS 7.8 (high): In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply…
CVE-2018-15910 — CVSS 7.8 (high): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams…
CVE-2018-15911 — CVSS 7.8 (high): In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the…
CVE-2018-16509 — CVSS 7.8 (high): An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess…
CVE-2018-16510 — CVSS 7.8 (high): An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primitives could be used…
CVE-2018-16511 — CVSS 7.8 (high): An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attackers able to supply…
CVE-2018-16513 — CVSS 7.8 (high): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the setcolor function…
CVE-2018-16540 — CVSS 7.8 (high): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a…
CVE-2019-3839 — CVSS 7.8 (high): It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially…
CVE-2019-6116 — CVSS 7.8 (high): In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code…
CVE-2018-15908 — CVSS 7.8 (high): In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and…
CVE-2018-18073 — CVSS 6.3 (medium): Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved…
CVE-2018-16539 — CVSS 5.5 (medium): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file…
CVE-2018-16541 — CVSS 5.5 (medium): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice…
CVE-2019-12973 — CVSS 5.5 (medium): In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this…
CVE-2019-3835 — CVSS 5.5 (medium): It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted…
CVE-2019-3838 — CVSS 5.5 (medium): It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted…
CVE-2018-16542 — CVSS 5.5 (medium): In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size…