The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade ghostscript | Jan 11, 2017 | Oct 12, 2016 |
| Centos_linux | — | Upgrade ghostscript-cupsUpgrade ghostscript-gtkUpgrade ghostscript-debuginfoUpgrade ghostscript-develUpgrade ghostscript-docUpgrade ghostscript | Jan 27, 2017 | Oct 12, 2016 |
| Debian | — | Upgrade ghostscript | Oct 13, 2016 | Oct 12, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade ghostscriptUpgrade ghostscript-cups | Nov 30, 2017 | Mar 7, 2017 |
| Oracle_linux | — | Upgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-develUpgrade ghostscript-cupsUpgrade ghostscript-gtk | Jan 5, 2017 | Oct 21, 2013 |
| Redhat_linux | — | Upgrade ghostscript-cupsUpgrade ghostscript-docUpgrade ghostscriptUpgrade ghostscript-gtkUpgrade ghostscript-develUpgrade ghostscript-debuginfoNo solution exists | Jan 5, 2017 | Oct 12, 2016 |
| Suse | — | Upgrade libgimpprint-develUpgrade ghostscript-x11-debuginfoUpgrade ghostscript-fonts-stdUpgrade ghostscript-develUpgrade ghostscript-fonts-otherUpgrade ghostscript-x11Upgrade ghostscript-mini-debuginfoUpgrade ghostscript-miniUpgrade ghostscript-debugsourceUpgrade ghostscript-libraryUpgrade ghostscript-mini-debugsourceUpgrade ghostscriptUpgrade libgimpprintUpgrade ghostscript-ijs-develUpgrade ghostscript-mini-develUpgrade ghostscript-omniUpgrade ghostscript-debuginfoUpgrade ghostscript-fonts-rus | Apr 26, 2018 | Oct 11, 2016 |
| Ubuntu | — | Upgrade libgs9Upgrade ghostscript-xUpgrade ghostscriptUpgrade libgs9-common | Dec 2, 2016 | Oct 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub