Buffer Overflow Vulnerability in Ghostscript Package
Summary
ALPINE-CVE-2025-27835: An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c. Affects ghostscript versions < 10.05.0. Fixed in 10.05.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ghostscript is an interpreter for the PostScript language and for PDF. It is widely used for processing and rendering documents in various formats. The package is known for its versatility in handling graphics and text, making it a critical component in many applications. However, it has been identified to have a vulnerability that could lead to severe security risks if not addressed promptly.
Vulnerability Detail
An issue was discovered in Artifex Ghostscript before version 10.05.0, where a buffer overflow occurs when converting glyphs to Unicode in the file psi/zbfont.c. This vulnerability can potentially allow an attacker to execute arbitrary code, leading to unauthorized access or system compromise. The flaw arises from improper handling of input data, which can be exploited to overwrite memory and disrupt normal operations.
How To Fix
Minimum fixed version
10.05.0
This is the first release that contains the fix.
sudo apk add --upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the Ghostscript service or disabling it until the patch can be applied. This can help mitigate the risk of exploitation.
Conclusion
The buffer overflow vulnerability in Ghostscript poses a significant security risk that can lead to severe consequences if not addressed. It is crucial for users to update their Ghostscript packages to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for ghostscript →
FAQ
The vulnerability is a buffer overflow that occurs during the conversion of glyphs to Unicode, which can lead to arbitrary code execution.
All versions of Ghostscript before 10.05.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could allow attackers to execute arbitrary code, potentially leading to unauthorized access and system compromise.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
