The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade ghostscript | Jan 11, 2017 | Oct 12, 2016 |
| Centos_linux | — | Upgrade ghostscript-develUpgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscript-debuginfoUpgrade ghostscriptUpgrade ghostscript-doc | Jan 27, 2017 | Oct 12, 2016 |
| Debian | — | Upgrade ghostscript | Oct 13, 2016 | Oct 12, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade ghostscript-cupsUpgrade ghostscript | Nov 30, 2017 | Mar 7, 2017 |
| Oracle_linux | — | Upgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscript-docUpgrade ghostscript-develUpgrade ghostscript | Jan 5, 2017 | Oct 21, 2013 |
| Redhat_linux | — | Upgrade ghostscript-develUpgrade ghostscript-debuginfoNo solution existsUpgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscriptUpgrade ghostscript-doc | Jan 5, 2017 | Oct 12, 2016 |
| Suse | — | Upgrade ghostscript-develUpgrade ghostscript-x11Upgrade ghostscript-miniUpgrade ghostscript-fonts-stdUpgrade ghostscript-libraryUpgrade ghostscriptUpgrade ghostscript-mini-debuginfoUpgrade libgimpprint-develUpgrade ghostscript-debugsourceUpgrade libgimpprintUpgrade ghostscript-fonts-otherUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-mini-debugsourceUpgrade ghostscript-ijs-develUpgrade ghostscript-fonts-rusUpgrade ghostscript-mini-develUpgrade ghostscript-debuginfoUpgrade ghostscript-omni | Apr 26, 2018 | Oct 11, 2016 |
| Ubuntu | — | Upgrade libgs9Upgrade ghostscript-xUpgrade ghostscriptUpgrade libgs9-common | Dec 2, 2016 | Oct 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub