Artifex Software Ghostscript vulnerability
Artifex Software · Ghostscript
Higher than 58% of scored CVEs
DescriptionNVD
Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare different subsampling values, the non-samescale sub-byte-depth output path allocates a row buffer sized for packed output but writes a full byte per output column regardless of bit depth, overflowing the allocation and corrupting internal chunk-allocator metadata to achieve code execution.
Coverage2 articles · 1 outlet
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 17 Sep.
- Thu 17 Sep, 11:55 UTC. SecurityOnline, first report. Critical Ghostscript Flaw Enables Remote Code Execution via PDFs.
- Tue 13 Oct, 00:26 UTC. SecurityOnline. Ghostscript flaw could let crafted PDFs trigger remote code execution.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 17 Sep 11:55 | SecurityOnline | Critical Ghostscript Flaw Enables Remote Code Execution via PDFs |
| 13 Oct 00:26 | SecurityOnline | Ghostscript flaw could let crafted PDFs trigger remote code execution |
- Critical Ghostscript Flaw Enables Remote Code Execution via PDFsSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.