CVE-2023-28879

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.

• CWE-787
• CWE-787

• http://www.openwall.com/lists/oss-security/2023/04/12/4
• https://bugs.ghostscript.com/show_bug.cgi?id=706494Exploit, Vendor Advisory
• https://ghostscript.readthedocs.io/en/latest/News.htmlRelease Notes
• https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179
• https://lists.debian.org/debian-lts-announce/2023/04/msg00003.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CI6UCKM3XMK7PYNIRGAVDJ5VKN6XYZOE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHJX62KSRIOBZA6FKONMJP7MEFY7LTH2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MADLP3GWJFLLFVNZGEDNPMDQR6CCXAHN/
• https://security.gentoo.org/glsa/202309-03
• https://www.debian.org/security/2023/dsa-5383Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/04/12/4
• https://bugs.ghostscript.com/show_bug.cgi?id=706494Exploit, Vendor Advisory
• https://ghostscript.readthedocs.io/en/latest/News.htmlRelease Notes
• https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=37ed5022cecd584de868933b5b60da2e995b3179
• https://lists.debian.org/debian-lts-announce/2023/04/msg00003.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CI6UCKM3XMK7PYNIRGAVDJ5VKN6XYZOE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHJX62KSRIOBZA6FKONMJP7MEFY7LTH2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MADLP3GWJFLLFVNZGEDNPMDQR6CCXAHN/
• https://security.gentoo.org/glsa/202309-03
• https://www.debian.org/security/2023/dsa-5383Third Party Advisory

Published

Mar 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28872Support Assistant in NCP Secure Enterprise Client before 13.…8.8
• CVE-2023-28873An XSS issue in wiki and discussion pages in Seafile 9.0.6 a…5.4
• CVE-2023-28874The next parameter in the /accounts/login endpoint of Seafil…6.1
• CVE-2023-28875A Stored XSS issue in shared files download terms in Filerun…5.4
• CVE-2023-28876A Broken Access Control issue in comments to uploaded files …4.3
• CVE-2023-28877The VTEX apps-graphql@2.x GraphQL API module does not proper…7.5
• CVE-2023-2888A vulnerability, which was classified as problematic, was fo…8.8
• CVE-2023-28882Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allow…7.5
• CVE-2023-28883In Cerebrate 1.13, a blind SQL injection exists in the searc…9.8
• CVE-2023-28884In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allo…6.1
• CVE-2023-28885The MyLink infotainment system (build 2021.3.26) in General …6.8
• CVE-2023-2889Improper Neutralization of Special Elements used in an SQL C…9.8