CVE-2009-3743
Critical
Description
Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based buffer overflow.
SeverityCritical
CVSS9.3
Exploit probability—
ProductArtifex Ghostscript Fonts
PublishedAug 26, 2010
First seenAug 26, 2010
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| artifex ghostscript_fonts | 6.0, 8.11 | — |
| artifex afpl_ghostscript | 6.0, 6.01, 6.50, 7.00, 7.03, 7.04, 8.00, 8.11, 8.12, 8.13, 8.14, 8.50, 8.51, 8.52, 8.53, 8.54 | — |
| artifex gpl_ghostscript | v ≤ 8.70, 8.01, 8.15, 8.50, 8.51, 8.54, 8.56, 8.57, 8.60, 8.61, 8.62, 8.63, 8.64 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.