Buffer Overflow Vulnerability in Ghostscript Package
Summary
ALPINE-CVE-2025-27836: An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c. Affects ghostscript versions < 10.05.0. Fixed in 10.05.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is essential for applications that require document manipulation and conversion. However, certain versions of Ghostscript are vulnerable to a buffer overflow issue that can lead to potential exploitation.
Vulnerability Detail
An issue was discovered in Artifex Ghostscript before version 10.05.0. The vulnerability is specifically related to the BJ10V device, which has a Print buffer overflow in the file contrib/japanese/gdev10v.c. This flaw can be exploited by attackers to execute arbitrary code, potentially compromising the system's integrity and confidentiality.
How To Fix
Minimum fixed version
10.05.0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the BJ10V device or restricting access to the Ghostscript functionality until the package can be updated.
Conclusion
The buffer overflow vulnerability in Ghostscript poses significant risks to systems using affected versions. It is crucial to update to the patched version to ensure security. Users can also utilize Vulert to monitor their applications for vulnerabilities without needing to install additional software.
See every vulnerability recorded for ghostscript →
FAQ
A buffer overflow vulnerability occurs when a program writes more data to a buffer than it can hold, potentially allowing attackers to overwrite memory and execute arbitrary code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized code execution, data breaches, and complete system compromise.
Yes, you can disable the affected device or limit access to Ghostscript functionalities as a temporary measure.
Detailed information can be found in the CVE database or by checking the official Ghostscript documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
