{"id":"CVE-2023-38560","aliases":["BELL-CVE-2023-38560","DEBIAN-CVE-2023-38560","EUVD-2023-42359","GHSA-hj8r-56hg-7wg8","MGASA-2023-0267","ROOT-OS-DEBIAN-12-CVE-2023-38560","UBUNTU-CVE-2023-38560"],"status":"published","title":"Ghostscript: integer overflow in pcl/pl/plfont.c:418 in pl_glyph_name","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00323,"percentile":0.2555,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2023-08-01T16:49:48Z","modified":"2026-11-07T11:32:29Z","fixes":[{"ecosystem":"Alpaquita:stream","package":"ghostscript","fixed_in":["10.02.0-r1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ghostscript","fixed_in":["10.02.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ghostscript","fixed_in":["10.02.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"ghostpcl","fixed_in":["9.53.3-2.1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"ghostpcl","fixed_in":["10.0.0-2.2.mga9"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"ghostscript","fixed_in":["10.0.0~dfsg-11+deb12u8.aikido.6"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-ghostscript","fixed_in":["10.0.0~dfsg-11+deb12u8.aikido.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:stream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-r0"},{"fixed":"10.02.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0~dfsg-11","10.0.0~dfsg-11+deb12u1","10.0.0~dfsg-11+deb12u2","10.0.0~dfsg-11+deb12u3","10.0.0~dfsg-11+deb12u4","10.0.0~dfsg-11+deb12u5","10.0.0~dfsg-11+deb12u6","10.0.0~dfsg-11+deb12u7","10.0.0~dfsg-11+deb12u8","10.01.2~dfsg-1","10.02.0~dfsg-1","10.02.0~dfsg-2","10.02.1~dfsg-1","10.02.1~dfsg-2","10.02.1~dfsg-3","10.03.0~dfsg-1","10.03.1~dfsg-1","10.03.1~dfsg-2","10.03.1~dfsg~git20240518-1","10.04.0~dfsg-1","10.04.0~dfsg-2","10.05.0~dfsg-1","10.05.1~dfsg-1","10.05.1~dfsg-2","10.05.1~dfsg-3","10.06.0~dfsg-1","10.06.0~dfsg-2","10.06.0~dfsg-3","10.07.0~dfsg-1","10.07.0~dfsg-2","10.07.1~dfsg-1","10.08.0~dfsg-1","10.08.0~dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.02.0~dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"ghostpcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.53.3-2.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"ghostpcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-2.2.mga9"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0~dfsg-11+deb12u8.aikido.6"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0~dfsg-11+deb12u8.aikido.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.27~dfsg+0-0ubuntu3","9.27~dfsg+0-0ubuntu4","9.50~dfsg-5ubuntu1","9.50~dfsg-5ubuntu2","9.50~dfsg-5ubuntu3","9.50~dfsg-5ubuntu4","9.50~dfsg-5ubuntu4.1","9.50~dfsg-5ubuntu4.2","9.50~dfsg-5ubuntu4.3","9.50~dfsg-5ubuntu4.4","9.50~dfsg-5ubuntu4.5","9.50~dfsg-5ubuntu4.6","9.50~dfsg-5ubuntu4.7","9.50~dfsg-5ubuntu4.8","9.50~dfsg-5ubuntu4.9","9.50~dfsg-5ubuntu4.10","9.50~dfsg-5ubuntu4.11","9.50~dfsg-5ubuntu4.12","9.50~dfsg-5ubuntu4.13","9.50~dfsg-5ubuntu4.14","9.50~dfsg-5ubuntu4.15","9.50~dfsg-5ubuntu4.15+esm1","9.50~dfsg-5ubuntu4.15+esm2","9.50~dfsg-5ubuntu4.15+esm3"]}],"products":[{"vendor":"artifex","product":"ghostscript"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-38560","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=706898","tags":["x_transferred","Permissions Required","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224368","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=b7eb1d0174c","tags":["x_transferred","Mailing List","Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38560"},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=706897"},{"url":"https://github.com/advisories/GHSA-hj8r-56hg-7wg8"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-38560","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-38560","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0267.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32260","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-38560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38560","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-38560","title":"Ghostscript: integer overflow in pcl/pl/plfont.c:418 in pl_glyph_name","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.","status":"published","published":"2023-08-01T16:49:48.327Z","modified":"2026-11-07T11:32:29.507Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-07T12:33:58.237937Z"}],"euvd":[{"id":"EUVD-2023-42359","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.","status":"published","published":"2023-08-01T16:49:48Z","modified":"2026-11-07T11:32:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T12:09:17.956424Z"}],"ghsa":[{"id":"GHSA-hj8r-56hg-7wg8","title":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This...","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.","status":"published","published":"2023-08-01T18:30:27Z","modified":"2024-04-04T06:28:47Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:56:42.669106Z"}],"nvd":[{"id":"CVE-2023-38560","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.","status":"published","published":"2023-08-01T17:15:09.967Z","modified":"2026-11-07T12:17:29.147Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-07T14:05:24.982965Z"}],"osv":[{"id":"BELL-CVE-2023-38560","status":"published","published":"2023-08-01T17:15:00Z","modified":"2026-01-26T09:33:30.517782Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-38560","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.","status":"published","published":"2023-08-01T17:15:09.967Z","modified":"2026-04-16T04:34:12.986675278Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"DEBIAN-CVE-2023-38560","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.","status":"published","published":"2023-08-01T17:15:09.967Z","modified":"2026-11-08T09:47:31.93078885Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-08T10:03:28.621517Z"},{"id":"UBUNTU-CVE-2023-38560","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.","status":"published","published":"2023-08-01T17:15:00Z","modified":"2026-10-21T23:00:12.553711157Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"MGASA-2023-0267","title":"Updated ghostpcl packages fix security vulnerability","description":"An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name\nin ghostscript. This issue may allow a local attacker to cause a denial of\nservice via transforming a crafted PCL file to PDF format.\n(CVE-2023-38560)\n","status":"published","published":"2023-09-24T22:16:18Z","modified":"2026-04-16T04:41:47.103017992Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2023-38560","title":"CVE-2023-38560 in ghostscript - Patched by Root","description":"Root has patched CVE-2023-38560 in the ghostscript package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-28T06:29:27Z","modified":"2026-08-28T08:45:04.305326644Z","updated_at":"2026-11-02T15:53:30.70924Z"}]}}