CVE-2009-3743 - CVE House
Back to Database
Status published Critical CVE-2009-3743

Off-by-one error in the Ins_MINDEX function in the TrueType bytecode...

Vulnerability Description

Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based buffer overflow.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-3743

Credits & Attribution

No credits recorded in the NVD database.

References

More from artifex

View All →
CVE-2022-44789
A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through...
Unknown 0
CVE-2022-30975
In Artifex MuJS through 1.2.0, jsP_dumpsyntax in jsdump.c has a...
Medium 5.5
CVE-2022-30974
compile in regexp.c in Artifex MuJS through 1.2.0 results in...
Medium 5.5
CVE-2021-45949
Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow...
Medium 5.5
CVE-2021-45944
Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample...
Medium 5.5

Affected Vendor

Affected Software

afpl ghostscript, ghostscript fonts, gpl ghostscript
Vulnerable Versions:
6.0, 6.01, 6.50, 7.00, 7.03, 7.04, 8.00, 8.11, 8.12, 8.13, 8.14, 8.50, 8.51, 8.52, 8.53, 8.54, 0, 8.01, 8.15, 8.56, 8.57, 8.60, 8.61, 8.62, 8.63, 8.64

Timeline

Official Publish: August 26th, 2010
Last Modified: August 7th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.