Every CVE Search/ Get API key

CVE-2023-4042

Ghostscript: incomplete fix for cve-2020-16305

5.5 Medium

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.34%Up 0.3 points since Aug 24, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.5

Ghostscript: incomplete fix for cve-2020-16305

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.

Record
CVE-2023-4042
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-07
EUVDEUVD-2023-53934 5.5

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.

Record
EUVD-2023-53934
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-07
GitHub AdvisoriesGHSA-jgj3-64jr-4g3x 5.5

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in...

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.

Record
GHSA-jgj3-64jr-4g3x
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125, CWE-787
Updated
2026-11-02
NVD 5.5

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.

Record
CVE-2023-4042
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125, CWE-787
Updated
2026-11-07
OSV 5.5

Ghostscript: incomplete fix for cve-2020-16305

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.

Record
CVE-2023-4042
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVRHSA-2023:7053 8.4

Red Hat Security Advisory: ghostscript security and bug fix update

Record
RHSA-2023:7053
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2023:7053 No score

Moderate: ghostscript security and bug fix update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

  • ghostscript: buffer overflow in base/sbcp.c leading to data corruption (CVE-2023-28879)
  • ghostscript: Out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in DoS (CVE-2023-38559)
  • ghostscript: Incomplete fix for CVE-2020-16305 (CVE-2023-4042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2023:7053
Updated
2026-11-02

Affected products

Show 1 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
ghostscript
AlmaLinux:8
From an advisory covering 4 CVEs
 before 9.27-11.el8
9.27-11.el8
ghostscript-doc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 9.27-11.el8
9.27-11.el8
ghostscript-tools-dvipdf
AlmaLinux:8
From an advisory covering 4 CVEs
 before 9.27-11.el8
9.27-11.el8
ghostscript-tools-fonts
AlmaLinux:8
From an advisory covering 4 CVEs
 before 9.27-11.el8
9.27-11.el8
ghostscript-tools-printing
AlmaLinux:8
From an advisory covering 4 CVEs
 before 9.27-11.el8
9.27-11.el8
ghostscript-x11
AlmaLinux:8
From an advisory covering 4 CVEs
 before 9.27-11.el8
9.27-11.el8
libgs
AlmaLinux:8
From an advisory covering 4 CVEs
 before 9.27-11.el8
9.27-11.el8
libgs-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 9.27-11.el8
9.27-11.el8
ghostscript
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
Show 16 moreShow less
Affected packages
PackageAffectedFixed
ghostscript-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-gtk-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-x11
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-x11-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
libgs
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
libgs-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-debugsource
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-doc
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-gtk-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-tools-dvipdf
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-tools-fonts
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-tools-printing
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
ghostscript-x11-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
libgs-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8
libgs-devel
Red Hat:enterprise_linux:8::crb
From an advisory covering 3 CVEs
 before 0:9.27-11.el8
0:9.27-11.el8

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4042 is a medium vulnerability (CVSS 5.5) in Artifex Ghostscript, published August 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. No source names a fixed version.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open