CVE-2023-28879
high-risk
Published 2023-03-31
In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.
Do I need to act?
!
31.2% chance of exploitation in next 30 days
EPSS score — higher than 69% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10
Critical
NETWORK
/ LOW complexity
Affected Products (3)
References (20)
Release Notes
https://ghostscript.readthedocs.io/en/latest/News.html
Third Party Advisory
https://www.debian.org/security/2023/dsa-5383
Release Notes
https://ghostscript.readthedocs.io/en/latest/News.html
Third Party Advisory
https://www.debian.org/security/2023/dsa-5383
57
/ 100
high-risk
Severity
32/34 · Critical
Exploitability
16/34 · Moderate
Exposure
9/34 · Low