{"id":"CVE-2023-38559","title":"A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript","summary":"A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cwe":["CWE-125","CWE-120"],"vendor":"artifex","product":"ghostscript","affected":["ghostscript < 10.02.0","enterprise_linux = 8.0","enterprise_linux = 9.0","fedora = 37","fedora = 38","debian_linux = 10.0"],"patched":["ghostscript 10.02.0"],"published":"2023-08-01","updated":"2026-06-23","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-38559","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:6544","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7053","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2023-38559","label":"secalert@redhat.com"},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=706897","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224367","label":"secalert@redhat.com"},{"url":"https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6544","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7053","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/security/cve/CVE-2023-38559","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=706897","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224367","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00006.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GBV6BTUREXM6DB3OGHGLMWGAZ3I45TXE/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QH7ERAYSSXEYDWWY7LOV7CA5MIDZN3Z6/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.00435,"epssPercentile":0.35088,"ingestedAt":"2026-06-29T13:24:33.514Z","slug":"CVE-2023-38559","body":"## Overview\n\nA buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.\n\n## Affected\n\n- `ghostscript < 10.02.0`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `fedora = 37`\n- `fedora = 38`\n- `debian_linux = 10.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `ghostscript 10.02.0`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}