Vulnerability-Lookup

CVE-2020-16289 (GCVE-0-2020-16289)

Vulnerability from cvelistv5 – Published: 2020-08-13 02:07 – Updated: 2024-08-04 13:37

Summary

A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://bugs.ghostscript.com/show_bug.cgi?id=701788	x_refsource_MISC
https://git.ghostscript.com/?p=ghostpdl.git%3Ba=c…	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2020…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2020/dsa-4748	vendor-advisoryx_refsource_DEBIAN
https://security.gentoo.org/glsa/202008-20	vendor-advisoryx_refsource_GENTOO
https://usn.ubuntu.com/4469-1/	vendor-advisoryx_refsource_UBUNTU

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:37:54.252Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701788"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768"
          },
          {
            "name": "[debian-lts-announce] 20200820 [SECURITY] [DLA 2335-1] ghostscript security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html"
          },
          {
            "name": "DSA-4748",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4748"
          },
          {
            "name": "GLSA-202008-20",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202008-20"
          },
          {
            "name": "USN-4469-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4469-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-31T20:06:23.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701788"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768"
        },
        {
          "name": "[debian-lts-announce] 20200820 [SECURITY] [DLA 2335-1] ghostscript security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html"
        },
        {
          "name": "DSA-4748",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4748"
        },
        {
          "name": "GLSA-202008-20",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202008-20"
        },
        {
          "name": "USN-4469-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4469-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-16289",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.ghostscript.com/show_bug.cgi?id=701788",
              "refsource": "MISC",
              "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701788"
            },
            {
              "name": "https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d31e25ed5b130499e0d880e4609b1b4824699768",
              "refsource": "MISC",
              "url": "https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d31e25ed5b130499e0d880e4609b1b4824699768"
            },
            {
              "name": "[debian-lts-announce] 20200820 [SECURITY] [DLA 2335-1] ghostscript security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html"
            },
            {
              "name": "DSA-4748",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4748"
            },
            {
              "name": "GLSA-202008-20",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202008-20"
            },
            {
              "name": "USN-4469-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4469-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-16289",
    "datePublished": "2020-08-13T02:07:50.000Z",
    "dateReserved": "2020-08-03T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:37:54.252Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-16289",
      "date": "2026-09-16",
      "epss": "0.01988",
      "percentile": "0.79597"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"9.52\", \"matchCriteriaId\": \"F5FAC7D9-2E45-4720-833F-EE7E5FA53299\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*\", \"matchCriteriaId\": \"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*\", \"matchCriteriaId\": \"902B8056-9E37-443B-8905-8AA93E2447FB\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.\"}, {\"lang\": \"es\", \"value\": \"Una vulnerabilidad de desbordamiento del b\\u00fafer en la funci\\u00f3n cif_print_page() en el archivo devices/gdevcif.c de Artifex Software GhostScript versi\\u00f3n v9.50, permite a un atacante remoto causar una denegaci\\u00f3n de servicio por medio de un archivo PDF dise\\u00f1ado. Esto es corregido en la versi\\u00f3n v9.51\"}]",
      "id": "CVE-2020-16289",
      "lastModified": "2024-11-21T05:07:06.313",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:N/A:P\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2020-08-13T03:15:12.807",
      "references": "[{\"url\": \"https://bugs.ghostscript.com/show_bug.cgi?id=701788\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202008-20\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4469-1/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2020/dsa-4748\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://bugs.ghostscript.com/show_bug.cgi?id=701788\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://security.gentoo.org/glsa/202008-20\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4469-1/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2020/dsa-4748\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-16289\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-08-13T03:15:12.807\",\"lastModified\":\"2024-11-21T05:07:06.313\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de desbordamiento del b\u00fafer en la funci\u00f3n cif_print_page() en el archivo devices/gdevcif.c de Artifex Software GhostScript versi\u00f3n v9.50, permite a un atacante remoto causar una denegaci\u00f3n de servicio por medio de un archivo PDF dise\u00f1ado. Esto es corregido en la versi\u00f3n v9.51\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"9.52\",\"matchCriteriaId\":\"F5FAC7D9-2E45-4720-833F-EE7E5FA53299\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*\",\"matchCriteriaId\":\"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"902B8056-9E37-443B-8905-8AA93E2447FB\"}]}]}],\"references\":[{\"url\":\"https://bugs.ghostscript.com/show_bug.cgi?id=701788\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202008-20\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4469-1/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4748\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugs.ghostscript.com/show_bug.cgi?id=701788\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.gentoo.org/glsa/202008-20\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4469-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4748\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-09T19:06:25+00:00",
      "cve": "CVE-2020-16289",
      "id": "CVE-2020-16289",
      "initial_release_date": "2020-08-13T00:00:00+00:00",
      "product_status:fixed": "82",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ghostscript: buffer overflow in cif_print_page() in devices/gdevcif.c could result in a DoS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-16289.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-01T01:44:07Z",
      "cve": "CVE-2020-16289",
      "id": "CVE-2020-16289",
      "initial_release_date": "2023-02-15T03:55:52Z",
      "product_status:known_not_affected": "175",
      "product_status:recommended": "8",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2020-16289",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2020-16289.json",
      "version": "20"
    }
  }
}

alsa-2021:1852

Vulnerability from osv_almalinux

Published

2021-05-18 06:14

Modified

2021-11-12 10:20

Summary

Moderate: ghostscript security, bug fix, and enhancement update

Details

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

The following packages have been upgraded to a later upstream version: ghostscript (9.27). (BZ#1874523)

Security Fix(es):

ghostscript: use-after-free vulnerability in igc_reloc_struct_ptr() could result in DoS (CVE-2020-14373)
ghostscript: buffer overflow in lprn_is_black() in contrib/lips4/gdevlprn.c could result in a DoS (CVE-2020-16287)
ghostscript: buffer overflow in pj_common_print_page() in devices/gdevpjet.c could result in a DoS (CVE-2020-16288)
ghostscript: buffer overflow in jetp3852_print_page() in devices/gdev3852.c could result in a DoS (CVE-2020-16290)
ghostscript: buffer overflow in contrib/gdevdj9.c could result in a DoS (CVE-2020-16291)
ghostscript: buffer overflow in mj_raster_cmd() in contrib/japanese/gdevmjc.c could result in a DoS (CVE-2020-16292)
ghostscript: NULL pointer dereference in compose_group_nonknockout_nonblend_isolated_allmask_common() in base/gxblend.c could result in a DoS (CVE-2020-16293)
ghostscript: buffer overflow in epsc_print_page() in devices/gdevepsc.c could result in a DoS (CVE-2020-16294)
ghostscript: NULL pointer dereference in clj_media_size() in devices/gdevclj.c could result in a DoS (CVE-2020-16295)
ghostscript: buffer overflow in GetNumWrongData() in contrib/lips4/gdevlips.c could result in a DoS (CVE-2020-16296)
ghostscript: buffer overflow in FloydSteinbergDitheringC() in contrib/gdevbjca.c could result in a DoS (CVE-2020-16297)
ghostscript: buffer overflow in mj_color_correct() in contrib/japanese/gdevmjc.c could result in a DoS (CVE-2020-16298)
ghostscript: division by zero in bj10v_print_page() in contrib/japanese/gdev10v.c could result in a DoS (CVE-2020-16299)
ghostscript: buffer overflow in tiff12_print_page() in devices/gdevtfnx.c could result in a DoS (CVE-2020-16300)
ghostscript: buffer overflow in okiibm_print_page1() in devices/gdevokii.c could result in a DoS (CVE-2020-16301)
ghostscript: buffer overflow in jetp3852_print_page() in devices/gdev3852.c could result in a privilege escalation (CVE-2020-16302)
ghostscript: use-after-free in xps_finish_image_path() in devices/vector/gdevxps.c could result in a privilege escalation (CVE-2020-16303)
ghostscript: buffer overflow in image_render_color_thresh() in base/gxicolor.c could result in a DoS (CVE-2020-16304)
ghostscript: NULL pointer dereference in devices/gdevtsep.c could result in a DoS (CVE-2020-16306)
ghostscript: NULL pointer dereference in devices/vector/gdevtxtw.c and psi/zbfont.c could result in a DoS (CVE-2020-16307)
ghostscript: buffer overflow in p_print_image() in devices/gdevcdj.c could result in a DoS (CVE-2020-16308)
ghostscript: buffer overflow in lxm5700m_print_page() in devices/gdevlxm.c could result in a DoS (CVE-2020-16309)
ghostscript: division by zero in dot24_print_page() in devices/gdevdm24.c could result in a DoS (CVE-2020-16310)
ghostscript: buffer overflow in GetNumSameData() in contrib/lips4/gdevlips.c could result in a DoS (CVE-2020-17538)
ghostscript: buffer overflow in cif_print_page() in devices/gdevcif.c could result in a DoS (CVE-2020-16289)
ghostscript: buffer overflow in pcx_write_rle() in contrib/japanese/gdev10v.c could result in a DoS (CVE-2020-16305)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References

URL

Type

	https://errata.almalinux.org/8/ALSA-2021-1852.html	ADVISORY
	https://vulners.com/cve/CVE-2020-14373	REPORT
	https://vulners.com/cve/CVE-2020-16287	REPORT
	https://vulners.com/cve/CVE-2020-16288	REPORT
	https://vulners.com/cve/CVE-2020-16289	REPORT
	https://vulners.com/cve/CVE-2020-16290	REPORT
	https://vulners.com/cve/CVE-2020-16291	REPORT
	https://vulners.com/cve/CVE-2020-16292	REPORT
	https://vulners.com/cve/CVE-2020-16293	REPORT
	https://vulners.com/cve/CVE-2020-16294	REPORT
	https://vulners.com/cve/CVE-2020-16295	REPORT
	https://vulners.com/cve/CVE-2020-16296	REPORT
	https://vulners.com/cve/CVE-2020-16297	REPORT
	https://vulners.com/cve/CVE-2020-16298	REPORT
	https://vulners.com/cve/CVE-2020-16299	REPORT
	https://vulners.com/cve/CVE-2020-16300	REPORT
	https://vulners.com/cve/CVE-2020-16301	REPORT
	https://vulners.com/cve/CVE-2020-16302	REPORT
	https://vulners.com/cve/CVE-2020-16303	REPORT
	https://vulners.com/cve/CVE-2020-16304	REPORT
	https://vulners.com/cve/CVE-2020-16305	REPORT
	https://vulners.com/cve/CVE-2020-16306	REPORT
	https://vulners.com/cve/CVE-2020-16307	REPORT
	https://vulners.com/cve/CVE-2020-16308	REPORT
	https://vulners.com/cve/CVE-2020-16309	REPORT
	https://vulners.com/cve/CVE-2020-16310	REPORT
	https://vulners.com/cve/CVE-2020-17538	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "ghostscript"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.27-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "ghostscript-doc"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.27-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "ghostscript-tools-dvipdf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.27-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "ghostscript-tools-fonts"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.27-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "ghostscript-tools-printing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.27-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "ghostscript-x11"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.27-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libgs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.27-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libgs-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.27-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nThe following packages have been upgraded to a later upstream version: ghostscript (9.27). (BZ#1874523)\n\nSecurity Fix(es):\n\n* ghostscript: use-after-free vulnerability in igc_reloc_struct_ptr() could result in DoS (CVE-2020-14373)\n\n* ghostscript: buffer overflow in lprn_is_black() in contrib/lips4/gdevlprn.c could result in a DoS (CVE-2020-16287)\n\n* ghostscript: buffer overflow in pj_common_print_page() in devices/gdevpjet.c could result in a DoS (CVE-2020-16288)\n\n* ghostscript: buffer overflow in jetp3852_print_page() in devices/gdev3852.c could result in a DoS (CVE-2020-16290)\n\n* ghostscript: buffer overflow in contrib/gdevdj9.c could result in a DoS (CVE-2020-16291)\n\n* ghostscript: buffer overflow in mj_raster_cmd() in contrib/japanese/gdevmjc.c could result in a DoS (CVE-2020-16292)\n\n* ghostscript: NULL pointer dereference in compose_group_nonknockout_nonblend_isolated_allmask_common() in base/gxblend.c could result in a DoS (CVE-2020-16293)\n\n* ghostscript: buffer overflow in epsc_print_page() in devices/gdevepsc.c could result in a DoS (CVE-2020-16294)\n\n* ghostscript: NULL pointer dereference in clj_media_size() in devices/gdevclj.c could result in a DoS (CVE-2020-16295)\n\n* ghostscript: buffer overflow in GetNumWrongData() in contrib/lips4/gdevlips.c could result in a DoS (CVE-2020-16296)\n\n* ghostscript: buffer overflow in FloydSteinbergDitheringC() in contrib/gdevbjca.c could result in a DoS (CVE-2020-16297)\n\n* ghostscript: buffer overflow in mj_color_correct() in contrib/japanese/gdevmjc.c could result in a DoS (CVE-2020-16298)\n\n* ghostscript: division by zero in bj10v_print_page() in contrib/japanese/gdev10v.c could result in a DoS (CVE-2020-16299)\n\n* ghostscript: buffer overflow in tiff12_print_page() in devices/gdevtfnx.c could result in a DoS (CVE-2020-16300)\n\n* ghostscript: buffer overflow in okiibm_print_page1() in devices/gdevokii.c could result in a DoS (CVE-2020-16301)\n\n* ghostscript: buffer overflow in jetp3852_print_page() in devices/gdev3852.c could result in a privilege escalation (CVE-2020-16302)\n\n* ghostscript: use-after-free in xps_finish_image_path() in devices/vector/gdevxps.c could result in a privilege escalation (CVE-2020-16303)\n\n* ghostscript: buffer overflow in image_render_color_thresh() in base/gxicolor.c could result in a DoS (CVE-2020-16304)\n\n* ghostscript: NULL pointer dereference in devices/gdevtsep.c could result in a DoS (CVE-2020-16306)\n\n* ghostscript: NULL pointer dereference in devices/vector/gdevtxtw.c and psi/zbfont.c could result in a DoS (CVE-2020-16307)\n\n* ghostscript: buffer overflow in p_print_image() in devices/gdevcdj.c could result in a DoS (CVE-2020-16308)\n\n* ghostscript: buffer overflow in lxm5700m_print_page() in devices/gdevlxm.c could result in a DoS (CVE-2020-16309)\n\n* ghostscript: division by zero in dot24_print_page() in devices/gdevdm24.c could result in a DoS (CVE-2020-16310)\n\n* ghostscript: buffer overflow in GetNumSameData() in contrib/lips4/gdevlips.c could result in a DoS (CVE-2020-17538)\n\n* ghostscript: buffer overflow in cif_print_page() in devices/gdevcif.c could result in a DoS (CVE-2020-16289)\n\n* ghostscript: buffer overflow in pcx_write_rle() in contrib/japanese/gdev10v.c could result in a DoS (CVE-2020-16305)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.",
  "id": "ALSA-2021:1852",
  "modified": "2021-11-12T10:20:56Z",
  "published": "2021-05-18T06:14:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2021-1852.html"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-14373"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16287"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16288"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16289"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16290"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16291"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16292"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16293"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16294"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16295"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16296"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16297"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16298"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16299"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16300"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16301"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16302"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16303"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16304"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16305"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16306"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16307"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16308"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16309"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-16310"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2020-17538"
    }
  ],
  "related": [
    "CVE-2020-14373",
    "CVE-2020-16287",
    "CVE-2020-16288",
    "CVE-2020-16290",
    "CVE-2020-16291",
    "CVE-2020-16292",
    "CVE-2020-16293",
    "CVE-2020-16294",
    "CVE-2020-16295",
    "CVE-2020-16296",
    "CVE-2020-16297",
    "CVE-2020-16298",
    "CVE-2020-16299",
    "CVE-2020-16300",
    "CVE-2020-16301",
    "CVE-2020-16302",
    "CVE-2020-16303",
    "CVE-2020-16304",
    "CVE-2020-16306",
    "CVE-2020-16307",
    "CVE-2020-16308",
    "CVE-2020-16309",
    "CVE-2020-16310",
    "CVE-2020-17538",
    "CVE-2020-16289",
    "CVE-2020-16305"
  ],
  "summary": "Moderate: ghostscript security, bug fix, and enhancement update"
}

CNVD-2020-46241

Vulnerability from cnvd - Published: 2020-08-16

Title

Artifex Software Ghostscript缓冲区溢出漏洞（CNVD-2020-46241）

Description

Artifex Software Ghostscript是美国Artifex Software公司的一款开源的PostScript（一种用于电子产业和桌面出版领域的页面描述语言和编程语言）解析器。该产品可显示Postscript文件以及在非Postscript打印机上打印Postscript文件。 Artifex Software Ghostscript v9.50版本中的devices/gdevcif.c文件的cif_print_page() 存在缓冲区溢出漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。

Severity

中

Patch Name

Artifex Software Ghostscript缓冲区溢出漏洞（CNVD-2020-46241）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d31e25ed5b130499e0d880e4609b1b4824699768

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-16289

Impacted products

Name
Artifex Software Artifex Software Ghostscript 9.50

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-16289",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-16289"
    }
  },
  "description": "Artifex Software Ghostscript\u662f\u7f8e\u56fdArtifex Software\u516c\u53f8\u7684\u4e00\u6b3e\u5f00\u6e90\u7684PostScript\uff08\u4e00\u79cd\u7528\u4e8e\u7535\u5b50\u4ea7\u4e1a\u548c\u684c\u9762\u51fa\u7248\u9886\u57df\u7684\u9875\u9762\u63cf\u8ff0\u8bed\u8a00\u548c\u7f16\u7a0b\u8bed\u8a00\uff09\u89e3\u6790\u5668\u3002\u8be5\u4ea7\u54c1\u53ef\u663e\u793aPostscript\u6587\u4ef6\u4ee5\u53ca\u5728\u975ePostscript\u6253\u5370\u673a\u4e0a\u6253\u5370Postscript\u6587\u4ef6\u3002\n\nArtifex Software Ghostscript v9.50\u7248\u672c\u4e2d\u7684devices/gdevcif.c\u6587\u4ef6\u7684cif_print_page() \u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u5728\u5185\u5b58\u4e0a\u6267\u884c\u64cd\u4f5c\u65f6\uff0c\u672a\u6b63\u786e\u9a8c\u8bc1\u6570\u636e\u8fb9\u754c\uff0c\u5bfc\u81f4\u5411\u5173\u8054\u7684\u5176\u4ed6\u5185\u5b58\u4f4d\u7f6e\u4e0a\u6267\u884c\u4e86\u9519\u8bef\u7684\u8bfb\u5199\u64cd\u4f5c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7f13\u51b2\u533a\u6ea2\u51fa\u6216\u5806\u6ea2\u51fa\u7b49\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d31e25ed5b130499e0d880e4609b1b4824699768",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-46241",
  "openTime": "2020-08-16",
  "patchDescription": "Artifex Software Ghostscript\u662f\u7f8e\u56fdArtifex Software\u516c\u53f8\u7684\u4e00\u6b3e\u5f00\u6e90\u7684PostScript\uff08\u4e00\u79cd\u7528\u4e8e\u7535\u5b50\u4ea7\u4e1a\u548c\u684c\u9762\u51fa\u7248\u9886\u57df\u7684\u9875\u9762\u63cf\u8ff0\u8bed\u8a00\u548c\u7f16\u7a0b\u8bed\u8a00\uff09\u89e3\u6790\u5668\u3002\u8be5\u4ea7\u54c1\u53ef\u663e\u793aPostscript\u6587\u4ef6\u4ee5\u53ca\u5728\u975ePostscript\u6253\u5370\u673a\u4e0a\u6253\u5370Postscript\u6587\u4ef6\u3002\r\n\r\nArtifex Software Ghostscript v9.50\u7248\u672c\u4e2d\u7684devices/gdevcif.c\u6587\u4ef6\u7684cif_print_page() \u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u5728\u5185\u5b58\u4e0a\u6267\u884c\u64cd\u4f5c\u65f6\uff0c\u672a\u6b63\u786e\u9a8c\u8bc1\u6570\u636e\u8fb9\u754c\uff0c\u5bfc\u81f4\u5411\u5173\u8054\u7684\u5176\u4ed6\u5185\u5b58\u4f4d\u7f6e\u4e0a\u6267\u884c\u4e86\u9519\u8bef\u7684\u8bfb\u5199\u64cd\u4f5c\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7f13\u51b2\u533a\u6ea2\u51fa\u6216\u5806\u6ea2\u51fa\u7b49\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Artifex Software Ghostscript\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-46241\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Artifex Software  Artifex Software Ghostscript 9.50"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-16289",
  "serverity": "\u4e2d",
  "submitTime": "2020-08-14",
  "title": "Artifex Software Ghostscript\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2020-46241\uff09"
}

FKIE_CVE-2020-16289

Vulnerability from fkie_nvd - Published: 2020-08-13 03:15 - Updated: 2026-06-17 02:58

Severity

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Summary

References

URL	Tags
cve@mitre.org	https://bugs.ghostscript.com/show_bug.cgi?id=701788	Exploit, Issue Tracking, Vendor Advisory
cve@mitre.org	https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768
cve@mitre.org	https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html	Mailing List, Third Party Advisory
cve@mitre.org	https://security.gentoo.org/glsa/202008-20	Third Party Advisory
cve@mitre.org	https://usn.ubuntu.com/4469-1/	Third Party Advisory
cve@mitre.org	https://www.debian.org/security/2020/dsa-4748	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://bugs.ghostscript.com/show_bug.cgi?id=701788	Exploit, Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.gentoo.org/glsa/202008-20	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://usn.ubuntu.com/4469-1/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.debian.org/security/2020/dsa-4748	Third Party Advisory

Impacted products

Vendor	Product	Version
artifex	ghostscript	*
debian	debian_linux	9.0
debian	debian_linux	10.0
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
canonical	ubuntu_linux	20.04

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5FAC7D9-2E45-4720-833F-EE7E5FA53299",
              "versionEndExcluding": "9.52",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desbordamiento del b\u00fafer en la funci\u00f3n cif_print_page() en el archivo devices/gdevcif.c de Artifex Software GhostScript versi\u00f3n v9.50, permite a un atacante remoto causar una denegaci\u00f3n de servicio por medio de un archivo PDF dise\u00f1ado. Esto es corregido en la versi\u00f3n v9.51"
    }
  ],
  "id": "CVE-2020-16289",
  "lastModified": "2026-06-17T02:58:00.020",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-08-13T03:15:12.807",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701788"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202008-20"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4469-1/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4748"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701788"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d31e25ed5b130499e0d880e4609b1b4824699768"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202008-20"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4469-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4748"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-23CW-P4X6-MCQC

Vulnerability from github – Published: 2022-05-24 17:25 – Updated: 2022-08-25 00:00

Details

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-16289"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-08-13T03:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.",
  "id": "GHSA-23cw-p4x6-mcqc",
  "modified": "2022-08-25T00:00:26Z",
  "published": "2022-05-24T17:25:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-16289"
    },
    {
      "type": "WEB",
      "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701788"
    },
    {
      "type": "WEB",
      "url": "https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d31e25ed5b130499e0d880e4609b1b4824699768"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202008-20"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4469-1"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4748"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2020-16289

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2020-16289

Aliases

CVE-2020-16289

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-16289",
    "description": "A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.",
    "id": "GSD-2020-16289",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-16289.html",
      "https://www.debian.org/security/2020/dsa-4748",
      "https://access.redhat.com/errata/RHSA-2021:1852",
      "https://ubuntu.com/security/CVE-2020-16289",
      "https://advisories.mageia.org/CVE-2020-16289.html",
      "https://linux.oracle.com/cve/CVE-2020-16289.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-16289"
      ],
      "details": "A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.",
      "id": "GSD-2020-16289",
      "modified": "2023-12-13T01:21:46.445480Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2020-16289",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://bugs.ghostscript.com/show_bug.cgi?id=701788",
            "refsource": "MISC",
            "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701788"
          },
          {
            "name": "https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d31e25ed5b130499e0d880e4609b1b4824699768",
            "refsource": "MISC",
            "url": "https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d31e25ed5b130499e0d880e4609b1b4824699768"
          },
          {
            "name": "[debian-lts-announce] 20200820 [SECURITY] [DLA 2335-1] ghostscript security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html"
          },
          {
            "name": "DSA-4748",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2020/dsa-4748"
          },
          {
            "name": "GLSA-202008-20",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202008-20"
          },
          {
            "name": "USN-4469-1",
            "refsource": "UBUNTU",
            "url": "https://usn.ubuntu.com/4469-1/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "9.52",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-16289"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-787"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.ghostscript.com/show_bug.cgi?id=701788",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Issue Tracking",
                "Vendor Advisory"
              ],
              "url": "https://bugs.ghostscript.com/show_bug.cgi?id=701788"
            },
            {
              "name": "https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d31e25ed5b130499e0d880e4609b1b4824699768",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=d31e25ed5b130499e0d880e4609b1b4824699768"
            },
            {
              "name": "[debian-lts-announce] 20200820 [SECURITY] [DLA 2335-1] ghostscript security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00032.html"
            },
            {
              "name": "DSA-4748",
              "refsource": "DEBIAN",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.debian.org/security/2020/dsa-4748"
            },
            {
              "name": "GLSA-202008-20",
              "refsource": "GENTOO",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.gentoo.org/glsa/202008-20"
            },
            {
              "name": "USN-4469-1",
              "refsource": "UBUNTU",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://usn.ubuntu.com/4469-1/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-08-24T19:24Z",
      "publishedDate": "2020-08-13T03:15Z"
    }
  }
}

RHSA-2021:1852

Vulnerability from csaf_redhat - Published: 2021-05-18 14:44 - Updated: 2026-08-08 16:41

Summary

Red Hat Security Advisory: ghostscript security, bug fix, and enhancement update

Severity

Moderate

Scope

26 vulnerabilities in this advisory, including CVE-2020-16289.

CVE-2020-16289

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 82 products

https://access.redhat.com/errata/RHSA-2021:1852

Open the full advisory

RHSA-2021_1852

Vulnerability from csaf_redhat - Published: 2021-05-18 14:44 - Updated: 2024-11-22 16:08

Summary

Red Hat Security Advisory: ghostscript security, bug fix, and enhancement update

Severity

Moderate

Scope

26 vulnerabilities in this advisory, including CVE-2020-16289.

CVE-2020-16289

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 114 products

https://access.redhat.com/errata/RHSA-2021:1852

Open the full advisory

ubuntu-cve-2020-16289

Vulnerability from osv_ubuntu

Published

2020-08-13 03:15

Modified

2026-04-22 07:39

Summary

Details

Severity

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2020-16289	REPORT
	https://ubuntu.com/security/notices/USN-4469-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2020-16289	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "ghostscript",
            "binary_version": "9.26~dfsg+0-0ubuntu0.16.04.13"
          },
          {
            "binary_name": "ghostscript-x",
            "binary_version": "9.26~dfsg+0-0ubuntu0.16.04.13"
          },
          {
            "binary_name": "libgs9",
            "binary_version": "9.26~dfsg+0-0ubuntu0.16.04.13"
          },
          {
            "binary_name": "libgs9-common",
            "binary_version": "9.26~dfsg+0-0ubuntu0.16.04.13"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "ghostscript",
        "purl": "pkg:deb/ubuntu/ghostscript@9.26~dfsg+0-0ubuntu0.16.04.13?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.26~dfsg+0-0ubuntu0.16.04.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.16~dfsg~0-0ubuntu3",
        "9.16~dfsg~0-0ubuntu4",
        "9.18~dfsg~0-0ubuntu1",
        "9.18~dfsg~0-0ubuntu2",
        "9.18~dfsg~0-0ubuntu2.2",
        "9.18~dfsg~0-0ubuntu2.3",
        "9.18~dfsg~0-0ubuntu2.4",
        "9.18~dfsg~0-0ubuntu2.6",
        "9.18~dfsg~0-0ubuntu2.7",
        "9.18~dfsg~0-0ubuntu2.8",
        "9.18~dfsg~0-0ubuntu2.9",
        "9.25~dfsg+1-0ubuntu0.16.04.1",
        "9.25~dfsg+1-0ubuntu0.16.04.2",
        "9.25~dfsg+1-0ubuntu0.16.04.3",
        "9.26~dfsg+0-0ubuntu0.16.04.1",
        "9.26~dfsg+0-0ubuntu0.16.04.3",
        "9.26~dfsg+0-0ubuntu0.16.04.4",
        "9.26~dfsg+0-0ubuntu0.16.04.5",
        "9.26~dfsg+0-0ubuntu0.16.04.6",
        "9.26~dfsg+0-0ubuntu0.16.04.7",
        "9.26~dfsg+0-0ubuntu0.16.04.8",
        "9.26~dfsg+0-0ubuntu0.16.04.9",
        "9.26~dfsg+0-0ubuntu0.16.04.10",
        "9.26~dfsg+0-0ubuntu0.16.04.11",
        "9.26~dfsg+0-0ubuntu0.16.04.12"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "ghostscript",
            "binary_version": "9.26~dfsg+0-0ubuntu0.18.04.13"
          },
          {
            "binary_name": "ghostscript-x",
            "binary_version": "9.26~dfsg+0-0ubuntu0.18.04.13"
          },
          {
            "binary_name": "libgs9",
            "binary_version": "9.26~dfsg+0-0ubuntu0.18.04.13"
          },
          {
            "binary_name": "libgs9-common",
            "binary_version": "9.26~dfsg+0-0ubuntu0.18.04.13"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "ghostscript",
        "purl": "pkg:deb/ubuntu/ghostscript@9.26~dfsg+0-0ubuntu0.18.04.13?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.26~dfsg+0-0ubuntu0.18.04.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.21~dfsg+1-0ubuntu3",
        "9.22~dfsg+1-0ubuntu1",
        "9.22~dfsg+1-0ubuntu1.1",
        "9.22~dfsg+1-0ubuntu1.2",
        "9.25~dfsg+1-0ubuntu0.18.04.1",
        "9.25~dfsg+1-0ubuntu0.18.04.2",
        "9.26~dfsg+0-0ubuntu0.18.04.1",
        "9.26~dfsg+0-0ubuntu0.18.04.3",
        "9.26~dfsg+0-0ubuntu0.18.04.4",
        "9.26~dfsg+0-0ubuntu0.18.04.5",
        "9.26~dfsg+0-0ubuntu0.18.04.6",
        "9.26~dfsg+0-0ubuntu0.18.04.7",
        "9.26~dfsg+0-0ubuntu0.18.04.8",
        "9.26~dfsg+0-0ubuntu0.18.04.9",
        "9.26~dfsg+0-0ubuntu0.18.04.10",
        "9.26~dfsg+0-0ubuntu0.18.04.11",
        "9.26~dfsg+0-0ubuntu0.18.04.12"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "ghostscript",
            "binary_version": "9.50~dfsg-5ubuntu4.2"
          },
          {
            "binary_name": "ghostscript-x",
            "binary_version": "9.50~dfsg-5ubuntu4.2"
          },
          {
            "binary_name": "libgs9",
            "binary_version": "9.50~dfsg-5ubuntu4.2"
          },
          {
            "binary_name": "libgs9-common",
            "binary_version": "9.50~dfsg-5ubuntu4.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "ghostscript",
        "purl": "pkg:deb/ubuntu/ghostscript@9.50~dfsg-5ubuntu4.2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.50~dfsg-5ubuntu4.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.27~dfsg+0-0ubuntu3",
        "9.27~dfsg+0-0ubuntu4",
        "9.50~dfsg-5ubuntu1",
        "9.50~dfsg-5ubuntu2",
        "9.50~dfsg-5ubuntu3",
        "9.50~dfsg-5ubuntu4",
        "9.50~dfsg-5ubuntu4.1"
      ]
    }
  ],
  "aliases": [],
  "details": "A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.",
  "id": "UBUNTU-CVE-2020-16289",
  "modified": "2026-04-22T07:39:29Z",
  "published": "2020-08-13T03:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-16289"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4469-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-16289"
    }
  ],
  "related": [
    "USN-4469-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2020-16289"
  ]
}

WID-SEC-W-2023-2405

Vulnerability from csaf_certbund - Published: 2020-08-12 22:00 - Updated: 2023-11-14 23:00

Summary

Ghostscript: Mehrere Schwachstellen

Severity

Hoch

Scope

25 vulnerabilities in this advisory, including CVE-2020-16289.

CVE-2020-16289

In Ghostscript existieren mehrere Schwachstellen aufgrund von verschiedenen Pufferüberläufen, Division-durch-Null-Fehlern, Null-Zeiger-Dereferenzierungen sowie Use-after-Free-Fehlern. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service Zustand herbeizuführen. Zur erfolgreichen Ausnutzung dieser Schwachstellen muss der Angreifer den Benutzer dazu bringen eine modifizierte .pdf-Datei öffnen.

Known affected: 5 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-16289 (GCVE-0-2020-16289)

Vulnerability from osv_almalinux

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour