Nixpkgs Security Tracker

Login with GitHub

Suggestions search

All statuses
Filter by:
With package: ghostscript_headless

Found 7 matching suggestions

Untriaged
Permalink CVE-2026-26980
created 3 weeks, 2 days ago
Ghost has a SQL Injection in its Content API

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

References

Affected products

Ghost
  • ==>= 3.24.0, < 6.19.1

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2026-24778
created 1 month, 2 weeks ago
Ghost vulnerable to XSS via malicious Portal preview links

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover. Ghost Portal versions 2.29.1 through 2.51.4 and 2.52.0 through 2.57.0 were vulnerable to this issue. Ghost automatically loads the latest patch of the members Portal component via CDN. For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability. v5.121.0 loads Portal v2.51.5, which contains the patch. For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability. v6.15.0 loads Portal v2.57.1, which contains the patch. For Ghost installations using a customized or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version.

References

Affected products

Ghost
  • ==@tryghost/portal >= 2.29.1, < 2.51.5
  • ==ghost >= 5.43.0, < 5.121.0
  • ==ghost >= 6.0.0, < 6.15.0
  • ==@tryghost/portal >= 2.52.0, < 2.57.1

Matching in nixpkgs

pkgs.ghostty

Fast, native, feature-rich terminal emulator pushing modern features

pkgs.ghostunnel

TLS proxy with mutual authentication support for securing non-TLS backend applications

Package maintainers

Untriaged
Permalink CVE-2024-34559
created 5 months, 3 weeks ago
WordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerability

Insertion of Sensitive Information into Log File vulnerability in Ghost Foundation Ghost.This issue affects Ghost: from n/a through 1.4.0.

References

Affected products

ghost
  • =<1.4.0

Matching in nixpkgs

pkgs.ghost

Android post-exploitation framework

  • nixos-unstable -

pkgs.ghostie

Github notifications in your terminal

  • nixos-unstable -

pkgs.ghostty

Fast, native, feature-rich terminal emulator pushing modern features

  • nixos-unstable -

pkgs.ghost-cli

CLI Tool for installing & updating Ghost

  • nixos-unstable -

pkgs.ghostfolio

Open Source Wealth Management Software

pkgs.ghostunnel

TLS proxy with mutual authentication support for securing non-TLS backend applications

  • nixos-unstable -

pkgs.ghosttohugo

Convert Ghost export to Hugo posts

  • nixos-unstable -

pkgs.ghostty-bin

Fast, native, feature-rich terminal emulator pushing modern features

  • nixos-unstable -

Package maintainers

Untriaged
Permalink CVE-2020-27792
created 5 months, 3 weeks ago
Ghostscript: heap buffer over write vulnerability in ghostscript's lp8000_print_page() in gdevlp8k.c

A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering the heap buffer overflow that could lead to memory corruption or a denial of service.

References

Affected products

ghostscript
  • ==9.27
  • *

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2023-38559
created 5 months, 3 weeks ago
Ghostscript: out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in dos

A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.

References

Affected products

ghostscript
  • *
gimp:flatpak/ghostscript
  • *

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2023-4042
created 5 months, 3 weeks ago
Ghostscript: incomplete fix for cve-2020-16305

A flaw was found in ghostscript. The fix for CVE-2020-16305 in ghostscript was not included in RHSA-2021:1852-06 advisory as it was claimed to be. This issue only affects the ghostscript package as shipped with Red Hat Enterprise Linux 8.

References

Affected products

ghostscript
  • ==9.51
  • *
gimp:flatpak/ghostscript
  • *

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2023-38560
created 5 months, 3 weeks ago
Ghostscript: integer overflow in pcl/pl/plfont.c:418 in pl_glyph_name

An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.

References

Affected products

ghostscript
gimp:flatpak/ghostscript

Matching in nixpkgs

Package maintainers