# CVE-2025-27837: ghostscript: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-27837: Patch to... CVE-2025-27837 is fixed in 14 products on 1 platform, first by ALAS2023-2025-927, released April 9, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-27837 - Priority: High - CVSS: n/a (important) - EPSS: 0.0062 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 9, 2025 ## Description Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-27837: Patch to error check UTF-8 conversions. Fixed in ghostpdl-10.05.0 by adding a check on the value returned by the gp_utf8_to_uint16 function. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708238 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=dbb9f2b11f820697e77863523a8d835ab040e5d1 (ghostpdl-10.05.0) CVE-2025-27836: Potential print buffer overflow. Fixed in ghostpdl-10.05.0 by implementing stricter buffer length validation. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708192 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=8b6d19b2b4079da6863ef25f2370f25d4b054919 (ghostpdl-10.05.0) CVE-2025-27835: Fix confusion between bytes and shorts. Data is being copied from a string in multiple of shorts, rather than multiple of bytes, leading to both a read (probably benign, given the memory manager) and write buffer overflow. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708131 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=de900010a6f2310d1fd54e99eeba466693da0e13 (ghostpdl-10.05.0) CVE-2025-27834: PDF interpreter - Guard against unsigned int overflow. A large Type 4 function definition can overflow the uint counter, causing the allocated buffer to be smaller than required. Info: https://bugs.ghostscript.com/show_bug.cgi?id=708253 Patch: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ef42ff180a04926e187d40faea40d4a43e304e3b (ghostpdl-10.05.0) ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | ghostscript amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-debuginfo amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-debugsource amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-doc amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-gtk amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-gtk-debuginfo amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-tools-dvipdf amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-tools-fonts amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-tools-printing amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-x11 amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | ghostscript-x11-debuginfo amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | libgs amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | libgs-debuginfo amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | | Linux | libgs-devel amzn 2023 | 9.56.1-7.amzn2023.0.16 | [ALAS2023-2025-927](https://patchblox.com/security/data/fix/linux/alas2023-2025-927.md) | Apr 9, 2025 | --- Data as of 2026-11-10T01:44:33Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.