CVE-2016-7978 Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
CriticalCVSS 9.8
EPSS 5.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ghostscript(Debian:12) | < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| debian/ghostscript(Debian:13) | < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| debian/ghostscript(Debian:14) | < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex ghostscript | = 9.20 | No fix listed |
References
- Debian Security Tracker CVE-2016-7978 vendor-advisory
- RHSA-2017:0013 vendor-advisory
- DSA-3691 vendor-advisory
- [oss-security] 20161005 Re: CVE Request - multiple ghostscript -dSAFER sandbox problems mailing-list patch third-party-advisory
- 95336 third-party-advisory vdb-entry
- bugs.ghostscript.com issue-tracking patch
- GLSA-201702-31 vendor-advisory
- bugs.debian.org issue-tracking