In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in
    xpstiff.c because the samplesperpixel value is not checked. (CVE-2025-59801)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20592-1 advisory.

    Update to version 10.06.0.

    Security issues fixed:

    - CVE-2025-59800: an integer overflow can lead to a heap-based buffer overflow in ocr_line8 (bsc#1250355).
    - CVE-2025-59799: a large size value can cause a stack-based buffer overflow in pdfmark_coerce_dest     (bsc#1250354).
    - CVE-2025-59798: stack-based buffer overflow in pdf_write_cmap can lead to a denial-of-service     (bsc#1250353).
    - CVE-2025-48708: lacks of argument sanitization may lead to password disclosure (bsc#1243701).
    - CVE-2025-46646: mishandling of overlong utf-8 encoding in artifex ghostscript's decode_utf8 function     (bsc#1257699).

    Other updates and bugfixes:

    - switch over to libalternatives for ghostscript to provide a gs       variant (bsc#1245896)

    - Version upgrade to 10.06.0:

      * removes the non-standard operator selectdevice         (cf. the entry below dated Tue Apr  1 09:56:06 UTC 2025)

    - Version upgrade to 10.05.1:

      * an overflow issue in Freetype on platforms           where long is a 4 byte (rather than 8 byte) type           (Microsoft Windows, for example) causing corrupted           glyph rendering at higher resolutions
      * an issue with embedded files, affecting Zugferd           format PDF creation.
      * broken logic in PDF Optional Content processing
      * potential slow down due to searching for identifiable           font files
      * a small number of extreme edge case segmentation faults.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in     xpstiff.c because the samplesperpixel value is not checked. (CVE-2025-59801)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
464261	Echo: ghostscript: security update to 10.05.1~dfsg-1+deb13u1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464261	Echo: ghostscript: security update to 10.05.1~dfsg-1+deb13u1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
309884	openSUSE 16 Security Update : ghostscript (openSUSE-SU-2026:20592-1)	Nessus	SuSE Local Security Checks	Local	low
265891	Linux Distros Unpatched Vulnerability : CVE-2025-59801	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-59801

medium

Tenable Plugins

medium

medium

low

medium