CVE-2023-38559

What it actually does

Buffer overflow in devn_pcx_write_rle() within base/gdevdevn.c allows crafted PDF input processed by a DEVN device to trigger memory corruption and application crash.

Why it matters to the business

Organizations relying on Ghostscript for PDF rendering or conversion may experience sudden service interruptions and require manual restarts when processing untrusted files.

How an attack unfolds

An attacker prepares a malicious PDF targeting the DEVN device path, causes the victim to invoke Ghostscript on the file, and the overflow in the RLE write routine leads to denial of service.

How to fix it

Upgrade Ghostscript to a version containing the fix for the buffer overflow in devn_pcx_write_rle(); apply vendor patches for affected distributions of Red Hat Enterprise Linux, Fedora, and Debian.

How to confirm the fix worked

Confirm Ghostscript version is newer than the vulnerable release; test processing of known-malformed DEVN-targeted PDFs in a controlled environment and verify absence of crashes.

Typical attack path

1. Craft malicious PDF exploiting DEVN device handling
2. Deliver file to target environment
3. Trigger Ghostscript processing of the PDF
4. Trigger buffer overflow resulting in crash

How to detect it

Review system and application logs for Ghostscript segmentation faults or abnormal exits when handling PDF files; correlate with file creation or download events involving untrusted PDFs.

What your security team should do

• Prioritize patching Ghostscript across all systems that process untrusted PDFs
• Restrict use of DEVN device output in automated pipelines until updated
• Monitor for Ghostscript process crashes in logging systems