rpm package
suse/ghostscript-library&distro=SUSE OpenStack Cloud 5
pkg:rpm/suse/ghostscript-library&distro=SUSE%20OpenStack%20Cloud%205
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-7979 | Cri | 9.8 | < 8.62-32.38.1 | 8.62-32.38.1 | May 23, 2017 | Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser. | |
| CVE-2016-7977 | Med | 5.5 | < 8.62-32.38.1 | 8.62-32.38.1 | May 23, 2017 | Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document. | |
| CVE-2017-8291 | Hig | 7.8 | KEV | < 8.62-32.46.1 | 8.62-32.46.1 | Apr 27, 2017 | Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. |
| CVE-2013-5653 | Med | 5.5 | < 8.62-32.38.1 | 8.62-32.38.1 | Mar 7, 2017 | The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file. | |
| CVE-2015-3228 | — | < 8.62-32.38.1 | 8.62-32.38.1 | Aug 11, 2015 | Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds re |
- affected < 8.62-32.38.1fixed 8.62-32.38.1
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.
- affected < 8.62-32.38.1fixed 8.62-32.38.1
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
- affected < 8.62-32.46.1fixed 8.62-32.46.1
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
- affected < 8.62-32.38.1fixed 8.62-32.38.1
The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.
- CVE-2015-3228Aug 11, 2015affected < 8.62-32.38.1fixed 8.62-32.38.1
Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds re