rpm package
suse/ghostscript&distro=SUSE Linux Enterprise Server 12-LTSS
pkg:rpm/suse/ghostscript&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS
Vulnerabilities (33)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-16509 | — | < 9.25-23.13.1 | 9.25-23.13.1 | Sep 5, 2018 | An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction. | ||
| CVE-2018-15911 | — | < 9.25-23.13.1 | 9.25-23.13.1 | Aug 28, 2018 | In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code. | ||
| CVE-2018-15910 | — | < 9.25-23.13.1 | 9.25-23.13.1 | Aug 27, 2018 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code. | ||
| CVE-2018-15909 | — | < 9.25-23.13.1 | 9.25-23.13.1 | Aug 27, 2018 | In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code. | ||
| CVE-2018-15908 | — | < 9.25-23.13.1 | 9.25-23.13.1 | Aug 27, 2018 | In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files. | ||
| CVE-2016-9601 | — | < 9.15-22.1 | 9.15-22.1 | Apr 23, 2018 | ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_image function which is used to decode halftone segments in a JBIG2 image. A document (PostScript or PDF) with an embedded, specially crafted, j | ||
| CVE-2016-7979 | Cri | 9.8 | < 9.15-11.1 | 9.15-11.1 | May 23, 2017 | Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser. | |
| CVE-2016-7978 | Cri | 9.8 | < 9.15-11.1 | 9.15-11.1 | May 23, 2017 | Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice. | |
| CVE-2017-8291 | Hig | 7.8 | KEV | < 9.15-22.1 | 9.15-22.1 | Apr 27, 2017 | Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. |
| CVE-2017-5951 | Med | 5.5 | < 9.15-22.1 | 9.15-22.1 | Apr 3, 2017 | The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. | |
| CVE-2016-10220 | Med | 5.5 | < 9.15-22.1 | 9.15-22.1 | Apr 3, 2017 | The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module. | |
| CVE-2017-7207 | Med | 5.5 | < 9.15-22.1 | 9.15-22.1 | Mar 21, 2017 | The mem_get_bits_rectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document. | |
| CVE-2013-5653 | Med | 5.5 | < 9.15-11.1 | 9.15-11.1 | Mar 7, 2017 | The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file. |
- CVE-2018-16509Sep 5, 2018affected < 9.25-23.13.1fixed 9.25-23.13.1
An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
- CVE-2018-15911Aug 28, 2018affected < 9.25-23.13.1fixed 9.25-23.13.1
In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.
- CVE-2018-15910Aug 27, 2018affected < 9.25-23.13.1fixed 9.25-23.13.1
In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code.
- CVE-2018-15909Aug 27, 2018affected < 9.25-23.13.1fixed 9.25-23.13.1
In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the interpreter or potentially execute code.
- CVE-2018-15908Aug 27, 2018affected < 9.25-23.13.1fixed 9.25-23.13.1
In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files.
- CVE-2016-9601Apr 23, 2018affected < 9.15-22.1fixed 9.15-22.1
ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_image function which is used to decode halftone segments in a JBIG2 image. A document (PostScript or PDF) with an embedded, specially crafted, j
- affected < 9.15-11.1fixed 9.15-11.1
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.
- affected < 9.15-11.1fixed 9.15-11.1
Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
- affected < 9.15-22.1fixed 9.15-22.1
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
- affected < 9.15-22.1fixed 9.15-22.1
The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file.
- affected < 9.15-22.1fixed 9.15-22.1
The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module.
- affected < 9.15-22.1fixed 9.15-22.1
The mem_get_bits_rectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document.
- affected < 9.15-11.1fixed 9.15-11.1
The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.
Page 2 of 2