CVE-2020-15900: artifex ghostscript Integer Underflow (Wrap or Wraparound)
CVSS: 9.8v3.1CriticalModified
AliasesALPINE-CVE-2020-15900SUSE-SU-2020:2095-1SUSE-SU-2020:2097-1UBUNTU-CVE-2020-15900USN-4445-1DEBIAN-CVE-2020-15900openSUSE-SU-2020:1142-1openSUSE-SU-2020:1146-1
Published 28-07-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-15900 is a critical (CVSS 9.8) Integer Underflow (Wrap or Wraparound) vulnerability in artifex ghostscript. EPSS estimates a 5.19% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
5.19%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 28-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
CVSS metrics
5 scores · 4 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
5.19%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 5.19% on 21-09-2026
21-09-202621-10-2026
EPSS score5.19%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Suse24 products
- ghostscript&distro=HPE Helion OpenStack 8< 9.52-23.39.1
- ghostscript&distro=SUSE Enterprise Storage 5< 9.52-23.39.1
- ghostscript&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 9.52-3.32.1
- ghostscript&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 9.52-3.32.1
- ghostscript&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 9.52-3.32.1
Opensuse5 products
- leapEOL15.1 | 15.2
- ghostscript-mini&distro=openSUSE Leap 15.1< 9.52-lp151.3.15.1
- ghostscript-mini&distro=openSUSE Leap 15.2< 9.52-lp152.2.4.1
- ghostscript&distro=openSUSE Leap 15.1< 9.52-lp151.3.15.1
- ghostscript&distro=openSUSE Leap 15.2< 9.52-lp152.2.4.1
Alpine1 product
- ghostscript< 9.50-r1 | < 9.52-r1
Artifex1 product
- ghostscript9.50 | 9.52
Canonical1 product
- ubuntu_linuxEOL20.04
Debian1 product
- ghostscript< 9.52.1~dfsg-1
Ubuntu1 product
- ghostscript< 9.50~dfsg-5ubuntu4.1
7 vendors · 34 products
References
20 links- git.ghostscript.com?p=ghostpdl.git%3Ba=logX Refsource MISC
- github.com/ArtifexSoftware/ghostpdl/commits/master/psi/zstring.cX Refsource MISCPatchThird Party Advisory
- github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31bX Refsource MISCPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-08/msg00006.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 20 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory