CVE-2023-46751 Use after free in n/a
Remote attackers can crash the application via a dangling pointer in Ghostscript, requiring a patch to prevent denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46751?
CVE-2023-46751 is a high-severity use after free vulnerability in Artifex Ghostscript, published on 6 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer.
Weakness: CWE-416
Which versions are affected by CVE-2023-46751?
It affects 1 product.
Linux distribution packages (19)
ghostscript SUSE:Enterprise Storage 7.1 | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise Server 12 SP5 | All versions | 9.52-23.63.1 |
ghostscript SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 9.52-23.63.1 |
ghostscript SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 9.52-150000.177.1 |
ghostscript SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 9.52-23.63.1 |
ghostscript openSUSE:Leap 15.4 | All versions | 9.52-150000.177.1 |
ghostscript openSUSE:Leap 15.5 | All versions | 9.52-150000.177.1 |
ghostscript openSUSE:Tumbleweed | All versions | 9.56.1-8.1 |
Products include Artifex Ghostscript.
How do I fix CVE-2023-46751?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-46751 being exploited?
There is no known exploitation of CVE-2023-46751 in the wild and no public exploit code.
Other vulnerabilities in Artifex Ghostscript
Sources
Also known as BELL-CVE-2023-46751, DEBIAN-CVE-2023-46751, DSA-5578-1, GHSA-798r-fxxx-hvxj, MGASA-2023-0351, OESA-2023-1984 and 7 more.