Skip to content
Fencer Vulns
critical 9.8

CVE-2023-28879 json

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript inter…

published 2023-03-31 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-32499

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
6.3%
EPSS 6.3% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.

Patch / fix

  • artifex ghostscript 10.01.0
  • ghostscript Debian 14, Debian 13, Debian 12 10.0.0~dfsg-11

debian advisories DEBIAN-CVE-2023-28879

  • ghostscript Ubuntu 18.04 LTS 9.26~dfsg+0-0ubuntu0.18.04.18
  • ghostscript Ubuntu 20.04 LTS 9.50~dfsg-5ubuntu4.7
  • ghostscript Ubuntu 22.04 LTS 9.55.0~dfsg1-0ubuntu5.2
  • ghostscript Ubuntu Pro 16.04 LTS 9.26~dfsg+0-0ubuntu0.16.04.14+esm5

ubuntu advisories UBUNTU-CVE-2023-28879

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ghostscript RHEL 8 9.27-11.el8
  • libgs RHEL 8 9.27-11.el8
  • ghostscript-x11 RHEL 8 9.27-11.el8
  • ghostscript-tools-fonts RHEL 8 9.27-11.el8
  • ghostscript-tools-dvipdf RHEL 8 9.27-11.el8
  • ghostscript-tools-printing RHEL 8 9.27-11.el8
  • ghostscript RHEL 9 9.54.0-13.el9
  • libgs RHEL 9 9.54.0-13.el9

red hat advisories RHSA-2023:7053RHSA-2023:6544

  • ghostscript SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +14 more 9.52-150000.164.1
  • ghostscript SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 9.52-23.51.1

suse advisories SUSE-SU-2023:1799-1SUSE-SU-2023:1797-1

  • ghostscript openSUSE Tumbleweed 9.56.1-2.1

opensuse advisories openSUSE-SU-2024:12853-1

  • ghostscript AlmaLinux 8 9.27-11.el8
  • libgs AlmaLinux 8 9.27-11.el8
  • ghostscript-x11 AlmaLinux 8 9.27-11.el8
  • ghostscript-tools-fonts AlmaLinux 8 9.27-11.el8
  • ghostscript-tools-dvipdf AlmaLinux 8 9.27-11.el8
  • ghostscript-tools-printing AlmaLinux 8 9.27-11.el8
  • ghostscript AlmaLinux 9 9.54.0-13.el9
  • libgs AlmaLinux 9 9.54.0-13.el9

almalinux advisories ALSA-2023:7053ALSA-2023:6544

  • ghostscript Alpine 3.14 9.54.0-r2
  • ghostscript Alpine 3.15 9.55.0-r1
  • ghostscript Alpine 3.16 9.56.1-r1
  • ghostscript Alpine 3.17 10.0.0-r1

alpine advisories ALPINE-CVE-2023-28879

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-28879 updated cvss 8.4

ghostscript: buffer overflow in base/sbcp.c leading to data corruption

  • Red Hat Enterprise Linux 6 ghostscript, ghostscript-gtk Red Hat Enterprise Linux 7 libgs, ghostscript, ghostscript-gtk, ghostscript-cups
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 libgs, ghostscript, ghostscript-x11, ghostscript-tools-fonts, ghostscript-tools-dvipdf, ghostscript-tools-printing
    affected: no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder (v. 8) ghostscript-tools-fonts 9.27-11.el8, ghostscript-tools-dvipdf 9.27-11.el8, ghostscript-tools-printing 9.27-11.el8
    fixed: vendor fix RHSA-2023:7053
  • Red Hat CodeReady Linux Builder (v. 9) ghostscript 9.54.0-13.el9, ghostscript-tools-fonts 9.54.0-13.el9, ghostscript-tools-printing 9.54.0-13.el9
    fixed: vendor fix RHSA-2023:6544
  • Red Hat Enterprise Linux AppStream (v. 8) libgs 9.27-11.el8, ghostscript 9.27-11.el8, ghostscript-x11 9.27-11.el8
    fixed: vendor fix RHSA-2023:7053
  • Red Hat Enterprise Linux AppStream (v. 9) libgs 9.54.0-13.el9, ghostscript 9.54.0-13.el9, ghostscript-x11 9.54.0-13.el9, ghostscript-tools-fonts 9.54.0-13.el9, ghostscript-tools-dvipdf 9.54.0-13.el9, ghostscript-tools-printing 9.54.0-13.el9
    fixed: vendor fix RHSA-2023:6544

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction

6.34% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.ghostscript.com https://bugs.ghostscript.com/show_bug.cgi?id=706494 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.