{"id":"CVE-2015-3228","aliases":["BELL-CVE-2015-3228","DEBIAN-CVE-2015-3228","DLA-280-1","DSA-3326-1","EUVD-2015-3284","GHSA-jf9j-9gh2-gp45","MGASA-2015-0308","SUSE-SU-2016:0884-1","SUSE-SU-2016:2493-1","UBUNTU-CVE-2015-3228","USN-2697-1","openSUSE-SU-2024:10003-1"],"status":"published","title":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and...","description":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03883,"percentile":0.903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2015-07-24T00:00:00Z","modified":"2026-09-09T06:47:23Z","fixes":[{"ecosystem":"Debian:12","package":"ghostscript","fixed_in":["9.15~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ghostscript","fixed_in":["9.15~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["9.15~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"ghostscript","fixed_in":["8.71~dfsg2-9+squeeze2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"ghostscript","fixed_in":["9.05~dfsg-6.3+deb7u2"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"ghostscript","fixed_in":["9.06~dfsg-2+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"ghostscript","fixed_in":["9.10-2.1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"ghostscript","fixed_in":["9.14-3.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"ghostscript","fixed_in":["9.15-6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ghostscript","fixed_in":["9.15-6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"ghostscript","fixed_in":["9.15-6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"ghostscript","fixed_in":["9.15-6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"ghostscript","fixed_in":["9.15-6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"ghostscript","fixed_in":["9.15-6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ghostscript","fixed_in":["9.15-6.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ghostscript","fixed_in":["9.15-6.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ghostscript","fixed_in":["9.10~dfsg-0ubuntu10.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.71~dfsg2-9+squeeze2"}]}],"versions":["8.71~dfsg2-9","8.71~dfsg2-9+squeeze1"]},{"source":"osv","ecosystem":"Debian:7","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.05~dfsg-6.3+deb7u2"}]}],"versions":["9.05~dfsg-6.3","9.05~dfsg-6.3+deb7u1"]},{"source":"osv","ecosystem":"Debian:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.06~dfsg-2+deb8u1"}]}],"versions":["9.06~dfsg-2"]},{"source":"osv","ecosystem":"Mageia:4","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10-2.1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.14-3.1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15-6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15-6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15-6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15-6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15-6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15-6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15-6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.15-6.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ghostscript-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.62-32.38.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10~dfsg-0ubuntu10.4"}]}],"versions":["9.10~dfsg-0ubuntu2","9.10~dfsg-0ubuntu3","9.10~dfsg-0ubuntu4","9.10~dfsg-0ubuntu5","9.10~dfsg-0ubuntu6","9.10~dfsg-0ubuntu7","9.10~dfsg-0ubuntu8","9.10~dfsg-0ubuntu9","9.10~dfsg-0ubuntu10","9.10~dfsg-0ubuntu10.1","9.10~dfsg-0ubuntu10.2","9.10~dfsg-0ubuntu10.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10~dfsg-0ubuntu10.4"}]}],"versions":["9.10~dfsg-0ubuntu2","9.10~dfsg-0ubuntu3","9.10~dfsg-0ubuntu4","9.10~dfsg-0ubuntu5","9.10~dfsg-0ubuntu6","9.10~dfsg-0ubuntu7","9.10~dfsg-0ubuntu8","9.10~dfsg-0ubuntu9","9.10~dfsg-0ubuntu10","9.10~dfsg-0ubuntu10.1","9.10~dfsg-0ubuntu10.2","9.10~dfsg-0ubuntu10.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20-2.1"}]}],"bundled":7}],"products":[{"vendor":"artifex","product":"afpl_ghostscript"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3326","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://bugs.ghostscript.com/show_bug.cgi?id=696070","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1033149","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1232805","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=0c0b0859","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://bugs.ghostscript.com/show_bug.cgi?id=696041","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201612-33","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/76017","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2697-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://openwall.com/lists/oss-security/2015/07/23/14","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3228"},{"url":"http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=0c0b0859"},{"url":"https://github.com/advisories/GHSA-jf9j-9gh2-gp45"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2015-3228","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3228","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0308.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3228","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160884-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/939342","tags":["report"]},{"url":"https://bugzilla.suse.com/963017","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3228","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162493-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1001951","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7979","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3228","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2697-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3228","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8602","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-3228","description":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.","status":"published","published":"2015-08-11T14:00:00Z","modified":"2024-08-06T05:39:32.07Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3284","description":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.","status":"published","published":"2015-08-11T14:00:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-jf9j-9gh2-gp45","title":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and...","description":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.","status":"published","published":"2022-05-17T00:51:50Z","modified":"2025-04-12T12:51:39Z","updated_at":"2026-11-02T15:01:23.273238Z"}],"nvd":[{"id":"CVE-2015-3228","description":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.","status":"published","published":"2015-08-11T14:59:02.867Z","modified":"2026-06-17T00:25:34.817Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"BELL-CVE-2015-3228","title":"CVE-2015-3228 does not affect BellSoft software","status":"withdrawn","published":"2015-08-11T14:59:00Z","modified":"2026-01-28T07:20:43.975715Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2015-3228","description":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.","status":"published","published":"2015-08-11T14:59:02Z","modified":"2026-04-16T06:21:08.826639093Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3228","description":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.","status":"published","published":"2015-08-11T14:59:02.867Z","modified":"2026-09-09T06:47:23.477391928Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-280-1","title":"ghostscript - security update","status":"published","published":"2015-07-25T00:00:00Z","modified":"2026-03-09T01:21:09.690094Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-3326-1","title":"ghostscript - security update","status":"published","published":"2015-08-02T00:00:00Z","modified":"2026-03-09T01:19:52.336812Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0308","title":"Updated ghostscript package fixes security vulnerability","description":"GhostScript is vulnerable to an integer overflow when processing a crafted\nPostScript file using the ps2pdf command (CVE-2015-3228).\n","status":"published","published":"2015-08-10T14:31:41Z","modified":"2026-04-16T06:23:07.178710769Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10003-1","title":"ghostscript-9.20-2.1 on GA media","description":"These are all security issues fixed in the ghostscript-9.20-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:05:23.23663Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:0884-1","title":"Security update for ghostscript","description":"ghostscript was updated to fix one security issue and one bug.\n\nThe following vulnerability was fixed:\n\n* CVE-2015-3228: Specially crafted ps files could have caused an out of\n  bound read/write due to an integer overflow, causing a segfault in the\n  application or having unspecified further impact.\n\nAlso a non security bug was fixed:\n- fix a crash in mutex handling (bsc#963017)\n","status":"published","published":"2016-03-24T11:41:17Z","modified":"2026-02-04T02:45:54.2149Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:2493-1","title":"Security update for ghostscript-library","description":"\nThis update for ghostscript-library fixes the following issues:\n\n- Multiple security vulnerabilities have been discovered where ghostscript's\n  '-dsafer' flag did not provide sufficient protection against unintended\n  access to the file system. Thus, a machine that would process a specially\n  crafted Postscript file would potentially leak sensitive information to an\n  attacker. (CVE-2013-5653, CVE-2016-7977, bsc#1001951)\n\n- Insufficient validation of the type of input in .initialize_dsc_parser used\n  to allow remote code execution. (CVE-2016-7979, bsc#1001951)\n\n- An integer overflow in the gs_heap_alloc_bytes function used to allow remote\n  attackers to cause a denial of service (crash) via specially  crafted\n  Postscript files. (CVE-2015-3228, boo#939342)\n\n","status":"published","published":"2016-10-11T13:08:17Z","modified":"2026-02-04T04:28:32.560839Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"UBUNTU-CVE-2015-3228","description":"Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.","status":"published","published":"2015-07-24T00:00:00Z","modified":"2026-04-22T10:07:52.16919Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2697-1","title":"ghostscript vulnerability","description":"William Robinet and Stefan Cornelius discovered that Ghostscript did not\ncorrectly handle certain Postscript files. If a user or automated system\nwere tricked into opening a specially crafted file, an attacker could cause\na denial of service or possibly execute arbitrary code.\n","status":"published","published":"2015-07-30T12:13:27Z","modified":"2026-04-22T09:14:12.093334Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}