Critical
Security advisory
A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-15900
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:21 UTC · Revision 1
Source evidence
A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.
osv:CVE-2020-15900
Complete source record
{
"id": "b54de434a9b7ea98e135645270e0d73a3465021ec6753b191cbedaf01c1da7f9",
"url": "https://osv.dev/vulnerability/CVE-2020-15900",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-15900",
"summary": "A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The 'rsearch' calculation for the 'post' size resulted in a size that was too large, and could underflow to max uint32_t. This was fixed in commit 5d499272b95a6b890a1397e11d20937de000d31b.",
"evidence": "osv:CVE-2020-15900",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2020-15900",
"aliases": [
"CVE-2020-15900"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/artifexsoftware/ghostpdl",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5d499272b95a6b890a1397e11d20937de000d31b"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "5d499272b95a6b890a1397e11d20937de000d31b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"ghostpdl-9.52-test-base-4",
"ghostpdl-9.52-test-base-3",
"ghostpdl-9.52-test-base-1",
"chrisl-test",
"jbig2dec-0.14",
"ghostpdl-9.02",
"ghostpdl",
"ghostscript-9.02",
"ghostscript-9.01",
"ghostpdl-9.01",
"ghostpdl-9.00",
"ghostpdl-8.71",
"ghostscript-8.71",
"ghostpdl-8.70",
"ghostscript-8.70",
"ghostpdl-ebuild",
"ghostpdl-1.54",
"ghostscript-8.64",
"ghostpdl-1.53",
"ghostscript-8.63",
"ghostscript-8.62",
"ghostscript-8.61",
"ghostscript-8.60",
"ghostscript-8.57",
"ghostscript-8.56",
"ghostscript-8.53",
"ghostscript-8.52",
"ghostscript-8.51",
"ghostscript-8.50",
"ghostscript-8.33",
"ghostscript-8.32",
"ghostscript-8.31",
"ghostscript-8.30",
"ghostscript-8.12",
"ghostscript-8.11",
"ghostscript-8.10",
"ghostscript-8.15",
"ghostscript-8.14",
"ghostscript-8.13",
"ghostscript-8.00",
"ghostscript-8.01",
"ghostscript-7.33",
"ghostscript-7.32",
"ghostscript-7.31",
"ghostscript-7.30",
"ghostscript-7.22",
"ghostscript-7.21",
"ghostscript-7.20",
"ghostscript-7.03",
"ghostscript-7.04",
"ghostscript-7.02",
"ghostscript-7.00",
"ghostscript-6.64",
"ghostscript-6.63",
"ghostscript-6.62",
"ghostscript-6.61",
"ghostscript-6.60",
"ghostscript-6.30",
"ghostscript-6.50",
"ghostscript-6.32",
"ghostscript-6.31",
"ghostscript-6.23",
"ghostscript-6.22",
"ghostscript-6.21",
"ghostscript-6.20",
"ghostscript-6.01",
"ghostscript-6.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15900.json",
"vanir_signatures": [
{
"id": "CVE-2020-15900-2b0aa55f",
"digest": {
"length": 988,
"function_hash": "46940119944633808988474283792764943994"
},
"source": "https://github.com/artifexsoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b",
"target": {
"file": "psi/zstring.c",
"function": "search_impl"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15900-a3bb7899",
"digest": {
"threshold": 0.9,
"line_hashes": [
"190536486911980564259186184284028251322",
"310639197693366512344773929327924035765",
"39712407557047782312763705291186047712",
"207635925999652990285057282992758349798",
"285190544700574057999012646783096917780",
"76464664580891842030516054201090584625",
"100906624819924311054212833575538464718",
"310528718498703024283454547331776211651",
"171002816041803318278104589197268229569",
"288390351824469318354059772346635214554"
]
},
"source": "https://github.com/artifexsoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b",
"target": {
"file": "psi/zstring.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:19:41Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/artifexsoftware/ghostpdl-downloads",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5d499272b95a6b890a1397e11d20937de000d31b"
},
{
"last_affected": "5d499272b95a6b890a1397e11d20937de000d31b"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5d499272b95a6b890a1397e11d20937de000d31b"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "5d499272b95a6b890a1397e11d20937de000d31b"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15900.json"
}
}
],
"modified": "2026-10-24T14:19:41.847184946Z",
"provider": "osv",
"references": [
"https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=5d499272b95a6b890a1397e11d20937de000d31b",
"https://artifex.com/security-advisories/CVE-2020-15900",
"https://security.gentoo.org/glsa/202008-20",
"https://usn.ubuntu.com/4445-1/",
"https://github.com/ArtifexSoftware/ghostpdl/commit/5d499272b95a6b890a1397e11d20937de000d31b",
"https://github.com/ArtifexSoftware/ghostpdl/commits/master/psi/zstring.c"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:artifex:ghostscript:9.50:*:*:*:*:*:*:*",
"cpe:2.3:a:artifex:ghostscript:9.52:*:*:*:*:*:*:*"
],
"vendor_product": "artifex:ghostscript",
"extracted_events": [
{
"range": [
{
"introduced": "9.50"
},
{
"last_affected": "9.50"
},
{
"introduced": "9.52"
},
{
"last_affected": "9.52"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "20.04"
},
{
"last_affected": "20.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
},
{
"introduced": "15.2"
},
{
"last_affected": "15.2"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-15900",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443463,
"published_at": "2020-07-28T16:15:12.84+00:00"
}