CVE-2016-7976 The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.
HighCVSS 8.8
EPSS 23.5%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ghostscript(Debian:12) | < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| debian/ghostscript(Debian:13) | < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| debian/ghostscript(Debian:14) | < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex ghostscript | = 9.18 | No fix listed |
| artifex ghostscript | = 9.20 | No fix listed |
References
- Debian Security Tracker CVE-2016-7976 vendor-advisory
- bugs.debian.org issue-tracking
- git.ghostscript.com
- DSA-3691 vendor-advisory
- [oss-security] 20161019 Re: Re: CVE Request - multiple ghostscript -dSAFER sandbox problems mailing-list third-party-advisory
- 95332 third-party-advisory vdb-entry
- bugs.ghostscript.com issue-tracking third-party-advisory
- GLSA-201702-31 third-party-advisory vendor-advisory