The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade ghostscript | Jan 11, 2017 | Oct 12, 2016 |
| Centos_linux | — | Upgrade ghostscript-develUpgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscript-debuginfoUpgrade ghostscriptUpgrade ghostscript-doc | Jan 27, 2017 | Oct 12, 2016 |
| Debian | — | Upgrade ghostscript | Oct 13, 2016 | Oct 12, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade ghostscript-cupsUpgrade ghostscript | Nov 30, 2017 | Mar 7, 2017 |
| Oracle_linux | — | Upgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-develUpgrade ghostscript-gtkUpgrade ghostscript-cups | Jan 5, 2017 | Oct 21, 2013 |
| Redhat_linux | — | Upgrade ghostscript-docUpgrade ghostscript-cupsUpgrade ghostscriptUpgrade ghostscript-gtkNo solution existsUpgrade ghostscript-debuginfoUpgrade ghostscript-devel | Jan 5, 2017 | Oct 12, 2016 |
| Suse | — | Upgrade ghostscript-omniUpgrade ghostscript-mini-develUpgrade ghostscript-fonts-rusUpgrade ghostscript-ijs-develUpgrade ghostscript-debuginfoUpgrade ghostscript-mini-debugsourceUpgrade ghostscript-miniUpgrade ghostscript-debugsourceUpgrade ghostscript-libraryUpgrade ghostscript-x11Upgrade ghostscript-fonts-otherUpgrade ghostscript-develUpgrade ghostscript-mini-debuginfoUpgrade libgimpprintUpgrade ghostscript-fonts-stdUpgrade ghostscriptUpgrade libgimpprint-develUpgrade ghostscript-x11-debuginfo | Apr 26, 2018 | Oct 11, 2016 |
| Ubuntu | — | Upgrade ghostscriptUpgrade ghostscript-xUpgrade libgs9Upgrade libgs9-common | Dec 2, 2016 | Oct 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub