Multiple buffer overflows in the psscan function in ps.c for gv (ghostview) allow remote attackers to execute arbitrary code via a Postscript file with a long (1) BoundingBox (2) comment (3) Orientation (4) PageOrder or (5) Pages value.