Artifex Ghostscript 9.21 vulnerabilities

Artifex Ghostscript up to 10.09.0 has a stack-based buffer overflow in the function type1_callsubr in devices/vector/gdevpsfx.c of the Pdfwrite component. Remote exploitation is possible, and the exploit is publicly available. A patch is suggested.

The psi/ztoken.c file in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, allowing remote attackers to cause application crashes or potentially other unspecified impacts via a crafted PostScript document.

The gs_alloc_ref_array function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.

Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document.