William Robinet

The issue is caused by an integer overflow in the `gs heap alloc bytes` function, which can lead to a denial of service (crash) when processing a crafted Postscript file. This can be triggered using the `ps2pdf` command, resulting in an out-of-bounds read or write.

A buffer overflow issue exists in the EntrReadArch function, potentially allowing remote attackers to execute arbitrary code through unspecified vectors.

The issue allows remote attackers to cause a denial of service, resulting in an infinite loop and resource consumption. This is related to pointer handling in the (1) ExtrArch or (2) ListArch function.

The issue is related to the `bdfReadCharacters` function in `bitmap/bdfread.c`, which does not properly perform type conversion for metrics values. This allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.

The issue is related to a buffer overflow in the charset to intern function, which can be exploited by remote attackers to execute arbitrary code. This is achieved by converting a crafted string, for example, from CP866 to UTF-8.

The issue allows remote attackers to cause a denial of service due to uninitialized memory access via a crafted TIFF image. This is related to the `putcontig8bitYCbCr21tile` function in `tif getimage.c` or the `NeXTDecode` function in `tif next.c`.

The issue allows remote attackers to cause a denial of service or possibly have other unspecified impacts via a crafted TIFF image. This is demonstrated by the failure of tif next.c to verify that the BitsPerSample value is 2, and the t2p sample lab signed to unsigned function in tiff2pdf.c.