CVE-2009-4897

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-07-22 · updated 2026-06-16
Weakness: CWE-119

Description

Buffer overflow in gs/psi/iscan.c in Ghostscript 8.64 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document containing a long name.

Affected products

Artifex Afpl Ghostscript: 6.0, 6.01, 6.50, 7.00, 7.03, 7.04 (+10)
Artifex Ghostscript Fonts: 8.11
Artifex Gpl Ghostscript: through 8.64; 8.01, 8.15, 8.50, 8.51, 8.54, 8.56 (+7)

References

http://bugs.ghostscript.com/show_bug.cgi?id=690523
http://secunia.com/advisories/40580
http://security.gentoo.org/glsa/glsa-201412-17.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2010:134
http://www.mandriva.com/security/advisories?name=MDVSA-2010:135
http://www.osvdb.org/66277
http://www.securityfocus.com/bid/41593
http://www.ubuntu.com/usn/USN-961-1
https://bugzilla.redhat.com/show_bug.cgi?id=613792
https://exchange.xforce.ibmcloud.com/vulnerabilities/60380
http://bugs.ghostscript.com/show_bug.cgi?id=690523
http://secunia.com/advisories/40580

Get alerted when CVE-2009-4897 or the next vulnerability affects your stack