Vulnerability · Published Aug 19, 2022 · Assigned by redhat
CVE-2020-27792Ghostscript: heap buffer over write vulnerability in ghostscript's lp8000_print_page() in gdevlp8k.c
High 7.1
In plain English
A high-severity memory corruption in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | ghostscript | 9.27-16.el8_10 | ALSA-2025:4362 |
| AlmaLinux:8 | ghostscript-doc | 9.27-16.el8_10 | ALSA-2025:4362 |
| AlmaLinux:8 | ghostscript-tools-dvipdf | 9.27-16.el8_10 | ALSA-2025:4362 |
| AlmaLinux:8 | ghostscript-tools-fonts | 9.27-16.el8_10 | ALSA-2025:4362 |
| AlmaLinux:8 | ghostscript-tools-printing | 9.27-16.el8_10 | ALSA-2025:4362 |
| AlmaLinux:8 | ghostscript-x11 | 9.27-16.el8_10 | ALSA-2025:4362 |
| AlmaLinux:8 | libgs | 9.27-16.el8_10 | ALSA-2025:4362 |
| AlmaLinux:8 | libgs-devel | 9.27-16.el8_10 | ALSA-2025:4362 |
| Debian:12 | ghostscript | 9.51~dfsg-1 | DEBIAN-CVE-2020-27792 |
| Debian:13 | ghostscript | 9.51~dfsg-1 | DEBIAN-CVE-2020-27792 |
| Debian:14 | ghostscript | 9.51~dfsg-1 | DEBIAN-CVE-2020-27792 |
| Rocky Linux:8 | ghostscript | 0:9.27-16.el8_10 | RLSA-2025:4362 |
| Ubuntu:22.04:LTS | ghostscript | 9.55.0~dfsg1-0ubuntu5.1 | USN-5643-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
References
- RHSA-2025:4362 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2020-27792 vdb-entry, x_refsource_REDHAT
- RHBZ#2247179 issue-tracking, x_refsource_REDHAT
- https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4f6bc662909ab79e8fbe9822afb36e8a0eafc2b7
- https://bugs.ghostscript.com/show_bug.cgi?id=701844 x_refsource_MISC, x_transferred
- https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=4f6bc662909ab79e8fbe9822afb36e8a0eafc2b7 x_refsource_MISC, x_transferred
- [debian-lts-announce] 20220903 [SECURITY] [DLA 3096-1] ghostscript security update mailing-list, x_refsource_MLIST, x_transferred