CVE-2015-3228

What it actually does

Integer overflow in gs_heap_alloc_bytes allows crafted Postscript input to trigger out-of-bounds memory access, resulting in process crash.

Why it matters to the business

Disruption to document conversion and rendering workflows that rely on Ghostscript, with potential for availability loss in print and PDF pipelines.

How an attack unfolds

An attacker creates a malicious Postscript file that overflows an allocation size calculation inside Ghostscript; when the file is processed via ps2pdf or similar utilities the overflow leads to invalid memory access and denial of service.

How to fix it

Upgrade Ghostscript to a version that corrects the allocation integer overflow; replace any remaining instances of 9.15 or earlier with a maintained release.

How to confirm the fix worked

Confirm Ghostscript version is newer than 9.15; reprocess known trigger Postscript files and verify absence of crash or memory corruption.

Typical attack path

1. Craft a Postscript file that triggers the integer overflow in gs_heap_alloc_bytes
2. Deliver the file to a target system or service that invokes Ghostscript
3. Victim or automated process executes Ghostscript on the file (e.g., ps2pdf)
4. Overflow causes out-of-bounds read or write and process termination

How to detect it

Review application and system logs for Ghostscript crashes or segmentation faults occurring during Postscript or PDF conversion; correlate with file-processing timestamps.

What your security team should do

• Inventory all systems using Ghostscript and schedule immediate upgrade
• Block or sandbox untrusted Postscript and PDF conversion jobs until patched
• Add Ghostscript version checks to configuration compliance scans