An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTF-8 characters, for base/gp_mswin.c and base/winrtsup.cpp.

vendor_unpatched cve-2025-27837: Unpatched CVEs for Debian Linux (cve-2025-27837)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2820 advisory.

    Fix confusion between bytes and shorts. Data is being copied from a string in multiple of shorts, rather     than multiple of bytes, leading to both a read (probably benign, given the memory manager) and write     buffer overflow.

    Info: https://bugs.ghostscript.com/show_bug.cgi?id=708131Patch: https://cgit.ghostscript.com/cgi-     bin/cgit.cgi/ghostpdl.git/commit/?id=de900010a6f2310d1fd54e99eeba466693da0e13 (ghostpdl-10.05.0)     (CVE-2025-27835)

    Potential print buffer overflow. Fixed in ghostpdl-10.05.0 by implementing stricter buffer length     validation.

    Info: https://bugs.ghostscript.com/show_bug.cgi?id=708192Patch: https://cgit.ghostscript.com/cgi-     bin/cgit.cgi/ghostpdl.git/commit/?id=8b6d19b2b4079da6863ef25f2370f25d4b054919 (ghostpdl-10.05.0)     (CVE-2025-27836)

    Patch to error check UTF-8 conversions. Fixed in ghostpdl-10.05.0 by adding a check on the value returned     by the gp_utf8_to_uint16 function.

    Info: https://bugs.ghostscript.com/show_bug.cgi?id=708238Patch: https://cgit.ghostscript.com/cgi-     bin/cgit.cgi/ghostpdl.git/commit/?id=dbb9f2b11f820697e77863523a8d835ab040e5d1 (ghostpdl-10.05.0)     (CVE-2025-27837)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-927 advisory.

    PDF interpreter - Guard against unsigned int overflow. A large Type 4 function definition can overflow the     uint counter, causing the allocated buffer to be smaller than required.

    Info: https://bugs.ghostscript.com/show_bug.cgi?id=708253Patch: https://cgit.ghostscript.com/cgi-     bin/cgit.cgi/ghostpdl.git/commit/?id=ef42ff180a04926e187d40faea40d4a43e304e3b (ghostpdl-10.05.0)     (CVE-2025-27834)

    Fix confusion between bytes and shorts. Data is being copied from a string in multiple of shorts, rather     than multiple of bytes, leading to both a read (probably benign, given the memory manager) and write     buffer overflow.

    Info: https://bugs.ghostscript.com/show_bug.cgi?id=708131Patch: https://cgit.ghostscript.com/cgi-     bin/cgit.cgi/ghostpdl.git/commit/?id=de900010a6f2310d1fd54e99eeba466693da0e13 (ghostpdl-10.05.0)     (CVE-2025-27835)

    Potential print buffer overflow. Fixed in ghostpdl-10.05.0 by implementing stricter buffer length     validation.

    Info: https://bugs.ghostscript.com/show_bug.cgi?id=708192Patch: https://cgit.ghostscript.com/cgi-     bin/cgit.cgi/ghostpdl.git/commit/?id=8b6d19b2b4079da6863ef25f2370f25d4b054919 (ghostpdl-10.05.0)     (CVE-2025-27836)

    Patch to error check UTF-8 conversions. Fixed in ghostpdl-10.05.0 by adding a check on the value returned     by the gp_utf8_to_uint16 function.

    Info: https://bugs.ghostscript.com/show_bug.cgi?id=708238Patch: https://cgit.ghostscript.com/cgi-     bin/cgit.cgi/ghostpdl.git/commit/?id=dbb9f2b11f820697e77863523a8d835ab040e5d1 (ghostpdl-10.05.0)     (CVE-2025-27837)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3a7a29de24 advisory.

    CVE-2025-27835 ghostscript: Buffer overflow when converting glyphs to unicode (fedora#2355025)

    CVE-2025-27834 ghostscript: Buffer overflow caused by an oversized Type 4 function in a PDF     (fedora#2355023)

    CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow (fedora#2355021)

    CVE-2025-27836 ghostscript: device: Print buffer overflow (fedora#2355019)

    CVE-2025-27830 ghostscript: Buffer overflow during serialization of DollarBlend in font (fedora#2355015)

    CVE-2025-27833 ghostscript: Buffer overflow with long TTF font name (fedora#2355011)

    CVE-2025-27837 ghostscript: Access to arbitrary files through truncated path with invalid UTF-8     (fedora#2355009)

    CVE-2025-27831 ghostscript: Text buffer overflow with long characters (fedora#2355007)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-47818d27ba advisory.

    CVE-2025-27835 ghostscript: Buffer overflow when converting glyphs to unicode (fedora#2355026)

    CVE-2025-27834 ghostscript: Buffer overflow caused by an oversized Type 4 function in a PDF     (fedora#2355024)

    CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow (fedora#2355022)

    CVE-2025-27836 ghostscript: device: Print buffer overflow (fedora#2355020)

    CVE-2025-27830 ghostscript: Buffer overflow during serialization of DollarBlend in font (fedora#2355016)

    CVE-2025-27833 ghostscript: Buffer overflow with long TTF font name (fedora#2355012)

    CVE-2025-27837 ghostscript: Access to arbitrary files through truncated path with invalid UTF-8     (fedora#2355010)

    CVE-2025-27831 ghostscript: Text buffer overflow with long characters (fedora#2355008)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234521	Amazon Linux 2 : ghostscript (ALAS-2025-2820)	Nessus	Amazon Linux Local Security Checks	critical
234341	Amazon Linux 2023 : ghostscript, ghostscript-gtk, ghostscript-tools-dvipdf (ALAS2023-2025-927)	Nessus	Amazon Linux Local Security Checks	critical
234110	Fedora 40 : ghostscript (2025-3a7a29de24)	Nessus	Fedora Local Security Checks	critical
233884	Fedora 41 : ghostscript (2025-47818d27ba)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2025-27837

critical

Tenable Plugins

Coming Soon

critical

critical

critical

critical