5.5Medium

CVE-2023-4042Ghostscript: incomplete fix for cve-2020-16305

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 9 Published: 2023-08-23 15:19 (3 years ago)

Description

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.

Weakness (CWE): CWE-125 CWE-787

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
artifex	ghostscript	< 9.51
enterprise linux	8	—
redhat	codeready linux builder	8.0
redhat	codeready linux builder for arm64	8.0_aarch64
redhat	codeready linux builder for ibm z systems	8.0_s390x
redhat	codeready linux builder for power little endian	8.0_ppc64le
redhat	enterprise linux	8.0
redhat	enterprise linux for arm 64	8.0_aarch64
redhat	enterprise linux for ibm z systems	8.0_s390x
redhat	enterprise linux for power little endian	8.0_ppc64le
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 9	—

References and patches

RHSA-2023:7053 vendor-advisoryThird Party Advisory
https://access.redhat.com/security/cve/CVE-2023-4042 vdb-entryThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1870257 Issue TrackingThird Party Advisory
RHBZ#2228151 issue-trackingIssue TrackingThird Party Advisory

CPE matches (NVD) (9)

cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:* < 9.51
cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_arm64:8.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*

CVSS score

5.5Medium

Source: redhat · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

All scores (3)

cna	CVSS 3.1	5.5Medium
secalert@redhat.com	CVSS 3.1	5.5Medium
nvd	CVSS 3.1	5.5Medium

EPSS (chance of exploitation in 30 days)

0.34%

higher than 27% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2023-08-01
Published2023-08-23 15:19
Reached IP-DB2026-10-24 23:53
Last updated2026-11-07 15:17

Assigned by (CNA): redhat
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Red Hat Enterprise Linux

8.8High

CVE-2026-18379 23 hours ago

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…

5.5Medium

CVE-2026-127101 yesterday