CVE-2023-28879 Memory corruption in n/a

Critical 9.8 Published 31 Mar 2023 Updated 14 Feb 2025

A buffer overflow in Ghostscript's PostScript interpreter allows attackers to corrupt memory, potentially leading to code execution or denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-28879?

CVE-2023-28879 is a critical memory corruption vulnerability in Artifex Ghostscript, published on 31 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.

Weakness: CWE-787

Which versions are affected by CVE-2023-28879?

It affects 2 products.

Linux distribution packages (27)

`ghostscript` SUSE:Enterprise Storage 7	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Enterprise Storage 7.1	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise Real Time 15 SP3	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`9.52-23.51.1`
`ghostscript` SUSE:Linux Enterprise Server 12 SP4-ESPOS	All versions	`9.52-23.51.1`
`ghostscript` SUSE:Linux Enterprise Server 12 SP4-LTSS	All versions	`9.52-23.51.1`
`ghostscript` SUSE:Linux Enterprise Server 12 SP5	All versions	`9.52-23.51.1`
`ghostscript` SUSE:Linux Enterprise Server 15 SP1-LTSS	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise Server 15 SP3-LTSS	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`9.52-23.51.1`
`ghostscript` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`9.52-23.51.1`
`ghostscript` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`9.52-23.51.1`
`ghostscript` SUSE:Manager Proxy 4.2	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:Manager Server 4.2	All versions	`9.52-150000.164.1`
`ghostscript` SUSE:OpenStack Cloud 9	All versions	`9.52-23.51.1`
`ghostscript` SUSE:OpenStack Cloud Crowbar 9	All versions	`9.52-23.51.1`
`ghostscript` openSUSE:Leap 15.4	All versions	`9.52-150000.164.1`
`ghostscript` openSUSE:Tumbleweed	All versions	`9.56.1-2.1`

Products include Artifex Ghostscript, Debian Debian Linux.

How do I fix CVE-2023-28879?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-28879 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-28879 exists.

All Artifex Ghostscript vulnerabilities

Sources

Also known as ALPINE-CVE-2023-28879, CLSA-2025-1742923385, CLSA-2026-1792239264, DEBIAN-CVE-2023-28879, DLA-3381-1, DSA-5383-1 and 7 more.