CVE-2023-38559

MediumCVSS 5.5/10Last modified Nov 7, 2026

Description

A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125 CWE-120

Affected software

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—

References

https://access.redhat.com/errata/RHSA-2023:6544Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7053Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-38559Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=706897Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2224367Issue Tracking, Third Party Advisory
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1Mailing List, Patch
https://access.redhat.com/errata/RHSA-2023:6544Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7053Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-38559Third Party Advisory
https://bugs.ghostscript.com/show_bug.cgi?id=706897Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2224367Issue Tracking, Third Party Advisory
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1Mailing List, Patch
https://lists.debian.org/debian-lts-announce/2023/08/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GBV6BTUREXM6DB3OGHGLMWGAZ3I45TXE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QH7ERAYSSXEYDWWY7LOV7CA5MIDZN3Z6/

Timeline

Published: Aug 1, 2023
Last modified: Nov 7, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-38566.1A vulnerability, which was classified as problematic, has been found in phpscriptpoint Ecommerce 1.15. Affected by this issue is some unknow CVE-2023-385605.5An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a CVE-2023-385617.8Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalat CVE-2023-385629.1A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafte CVE-2023-385638.8Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allo CVE-2023-385647.5The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. An app may be able to modify protected parts of the CVE-2023-385657.8A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, macOS CVE-2023-385667.8Uncontrolled search path in some Intel(R) ISPC software before version 1.21.0 may allow an authenticated user to potentially enable escalati CVE-2023-385688.8Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS CVE-2023-385695.4Stored cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to execute an arbitrary scrip CVE-2023-38576.1A vulnerability, which was classified as problematic, was found in phpscriptpoint Ecommerce 1.15. This affects an unknown part of the file /CVE-2023-385707.8Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalatio