{"id":"CVE-2023-4042","aliases":["ALSA-2023:7053","EUVD-2023-53934","GHSA-jgj3-64jr-4g3x","RHSA-2023:7053"],"status":"published","title":"Ghostscript: incomplete fix for cve-2020-16305","description":"A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00335,"percentile":0.27081,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125","CWE-787"],"published":"2023-08-23T12:19:29Z","modified":"2026-10-29T11:02:19Z","affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.27-11.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"ghostscript-x11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libgs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libgs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"ghostscript-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"ghostscript-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"ghostscript-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"ghostscript-gtk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"ghostscript-tools-dvipdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"ghostscript-tools-fonts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"ghostscript-tools-printing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"ghostscript-x11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libgs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libgs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.27-11.el8"}]}],"bundled":3}],"products":[{"vendor":"artifex","product":"ghostscript"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"codeready_linux_builder"},{"vendor":"redhat","product":"codeready_linux_builder_for_arm64"},{"vendor":"redhat","product":"codeready_linux_builder_for_ibm_z_systems"},{"vendor":"redhat","product":"codeready_linux_builder_for_power_little_endian"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_for_arm_64"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:7053","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4042","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1870257","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228151","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4042","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jgj3-64jr-4g3x"},{"url":"https://access.redhat.com/security/cve/CVE-2023-28879","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38559","tags":["report"]},{"url":"https://bugzilla.redhat.com/2184585","tags":["report"]},{"url":"https://bugzilla.redhat.com/2224367","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228151","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7053.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4042.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224367","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7053.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4042","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28879","tags":["advisory"]},{"url":"https://artifex.com/news/critical-security-vulnerability-fixed-in-ghostscript","tags":["article"]},{"url":"https://offsec.almond.consulting/ghostscript-cve-2023-28879.html","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2023/04/12/4","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38559","tags":["advisory"]},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=706897","tags":["article"]},{"url":"https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d81b82c70bc1","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2023-4042","title":"Ghostscript: incomplete fix for cve-2020-16305","description":"A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.","status":"published","published":"2023-08-23T12:19:29.156Z","modified":"2026-11-07T11:31:56.924Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-07T12:33:58.237937Z"}],"euvd":[{"id":"EUVD-2023-53934","description":"A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.","status":"published","published":"2023-08-23T12:19:29Z","modified":"2026-11-07T11:31:56Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-07T12:09:17.956424Z"}],"ghsa":[{"id":"GHSA-jgj3-64jr-4g3x","title":"A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in...","description":"A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.","status":"published","published":"2023-08-23T15:30:51Z","modified":"2023-11-23T05:05:05Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-02T14:55:05.78804Z"}],"nvd":[{"id":"CVE-2023-4042","description":"A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.","status":"published","published":"2023-08-23T13:15:07.847Z","modified":"2026-11-07T12:17:36.64Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-787"],"updated_at":"2026-11-07T14:05:24.982965Z"}],"osv":[{"id":"CVE-2023-4042","title":"Ghostscript: incomplete fix for cve-2020-16305","description":"A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.","status":"published","published":"2023-08-23T12:19:29.156Z","modified":"2026-11-09T02:30:29.297889208Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-08T02:58:58.208661Z"},{"id":"RHSA-2023:7053","title":"Red Hat Security Advisory: ghostscript security and bug fix update","status":"published","published":"2024-09-16T12:50:02Z","modified":"2026-06-26T12:22:21.723853258Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"ALSA-2023:7053","title":"Moderate: ghostscript security and bug fix update","description":"The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.\n\nSecurity Fix(es):\n\n* ghostscript: buffer overflow in base/sbcp.c leading to data corruption (CVE-2023-28879)\n* ghostscript: Out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in DoS (CVE-2023-38559)\n* ghostscript: Incomplete fix for CVE-2020-16305 (CVE-2023-4042)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.298366841Z","updated_at":"2026-11-02T15:27:52.091404Z"}]}}