CVE-2009-3743

Published: Aug 26, 2010Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based buffer overflow.

Affected (31)

Products: Artifex: Afpl Ghostscript, Ghostscript Fonts, Gpl Ghostscript

3 products

Configuration A

31 vulnerable

Vulnerable Software	Affected Versions
Artifex Afpl Ghostscript	Version 6.01
Artifex Afpl Ghostscript	Version 6.0
Artifex Afpl Ghostscript	Version 6.50
Artifex Afpl Ghostscript	Version 7.00
Artifex Afpl Ghostscript	Version 7.03
Artifex Afpl Ghostscript	Version 7.04
Artifex Afpl Ghostscript	Version 8.00
Artifex Afpl Ghostscript	Version 8.11
Artifex Afpl Ghostscript	Version 8.12
Artifex Afpl Ghostscript	Version 8.13
Artifex Afpl Ghostscript	Version 8.14
Artifex Afpl Ghostscript	Version 8.50
Artifex Afpl Ghostscript	Version 8.51
Artifex Afpl Ghostscript	Version 8.52
Artifex Afpl Ghostscript	Version 8.53
Artifex Afpl Ghostscript	Version 8.54
Artifex Ghostscript Fonts	Version 6.0
Artifex Ghostscript Fonts	Version 8.11
Artifex Gpl Ghostscript	Up to 8.70
Artifex Gpl Ghostscript	Version 8.01
Artifex Gpl Ghostscript	Version 8.15
Artifex Gpl Ghostscript	Version 8.50
Artifex Gpl Ghostscript	Version 8.51
Artifex Gpl Ghostscript	Version 8.54
Artifex Gpl Ghostscript	Version 8.56
Artifex Gpl Ghostscript	Version 8.57
Artifex Gpl Ghostscript	Version 8.60
Artifex Gpl Ghostscript	Version 8.61
Artifex Gpl Ghostscript	Version 8.62
Artifex Gpl Ghostscript	Version 8.63
Artifex Gpl Ghostscript	Version 8.64