Artifex Ghostscript before 10.03.0 sometimes has a stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "ghostscript", "binary_version": "10.02.1~dfsg1-0ubuntu7.3" }, { "binary_name": "ghostscript-dbgsym", "binary_version": "10.02.1~dfsg1-0ubuntu7.3" }, { "binary_name": "ghostscript-doc", "binary_version": "10.02.1~dfsg1-0ubuntu7.3" }, { "binary_name": "libgs-common", "binary_version": "10.02.1~dfsg1-0ubuntu7.3" }, { "binary_name": "libgs-dev", "binary_version": "10.02.1~dfsg1-0ubuntu7.3" }, { "binary_name": "libgs10", "binary_version": "10.02.1~dfsg1-0ubuntu7.3" }, { "binary_name": "libgs10-common", "binary_version": "10.02.1~dfsg1-0ubuntu7.3" }, { "binary_name": "libgs10-dbgsym", "binary_version": "10.02.1~dfsg1-0ubuntu7.3" } ] }