Buffer Overflow Vulnerability in Ghostscript Affects Multiple Alpine Versions
Summary
ALPINE-CVE-2025-27832: An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c. Affects ghostscript versions < 10.05.0. Fixed in 10.05.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The vulnerability in question affects multiple versions of Ghostscript packaged in Alpine Linux, making it crucial for users to be aware of the potential risks associated with this issue.
Vulnerability Detail
An issue was discovered in Artifex Ghostscript before version 10.05.0. The vulnerability is related to the NPDL device, which has a compression buffer overflow in the file contrib/japanese/gdevnpdl.c. This flaw could allow an attacker to exploit the buffer overflow, potentially leading to arbitrary code execution or denial of service, thereby compromising the integrity and availability of systems using the affected versions of Ghostscript.
How To Fix
Minimum fixed version
10.05.0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the NPDL device in Ghostscript until the package is updated. This can be done by modifying scripts or applications that utilize Ghostscript to bypass the affected functionality.
Conclusion
The buffer overflow vulnerability in Ghostscript poses significant risks to users of Alpine Linux. It is essential to update to the patched versions to mitigate these risks. Users should also consider using Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability is a buffer overflow in the NPDL device, which can lead to potential code execution or denial of service.
Alpine versions v3.18, v3.19, v3.20, v3.21, and v3.22 are affected by this vulnerability in Ghostscript.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
As a workaround, avoid using the NPDL device in Ghostscript until you can update to a patched version.
Failure to address this vulnerability may expose your systems to arbitrary code execution or denial of service attacks, compromising system integrity and availability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
