The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade ghostscript | Jan 11, 2017 | Oct 12, 2016 |
| Centos_linux | — | Upgrade ghostscript-gtkUpgrade ghostscript-debuginfoUpgrade ghostscript-develUpgrade ghostscript-cupsUpgrade ghostscriptUpgrade ghostscript-doc | Jan 27, 2017 | Oct 12, 2016 |
| Debian | — | Upgrade ghostscript | Oct 13, 2016 | Oct 12, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade ghostscriptUpgrade ghostscript-cups | Nov 30, 2017 | Mar 7, 2017 |
| Oracle_linux | — | Upgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-devel | Jan 5, 2017 | Oct 21, 2013 |
| Redhat_linux | — | No solution existsUpgrade ghostscript-gtkUpgrade ghostscript-develUpgrade ghostscript-debuginfoUpgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-cups | Jan 5, 2017 | Oct 12, 2016 |
| Suse | — | Upgrade ghostscript-ijs-develUpgrade ghostscript-fonts-rusUpgrade ghostscript-omniUpgrade ghostscript-mini-develUpgrade ghostscript-debuginfoUpgrade ghostscriptUpgrade ghostscript-debugsourceUpgrade ghostscript-fonts-stdUpgrade libgimpprint-develUpgrade libgimpprintUpgrade ghostscript-mini-debugsourceUpgrade ghostscript-fonts-otherUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-mini-debuginfoUpgrade ghostscript-libraryUpgrade ghostscript-miniUpgrade ghostscript-develUpgrade ghostscript-x11 | Apr 26, 2018 | Oct 11, 2016 |
| Ubuntu | — | Upgrade libgs9Upgrade ghostscript-xUpgrade libgs9-commonUpgrade ghostscript | Dec 2, 2016 | Oct 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub