psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ghostscript-develUpgrade ghostscript-gtkUpgrade ghostscript-debuginfoUpgrade ghostscript-cupsUpgrade ghostscriptUpgrade ghostscript-doc | Apr 27, 2020 | Jun 1, 2018 |
| Centos_linux | — | Upgrade ghostscript-debuginfoUpgrade libgsUpgrade ghostscriptUpgrade ghostscript-docUpgrade ghostscript-cupsUpgrade libgs-develUpgrade ghostscript-gtk | Aug 28, 2019 | Jun 1, 2018 |
| Debian | — | Upgrade ghostscript | Nov 11, 2018 | Jun 1, 2018 |
| Ghostscript | — | Upgrade to Ghostscript version 9.21 | Oct 10, 2018 | Jun 1, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ghostscript-cupsUpgrade ghostscript | Apr 30, 2021 | Jun 1, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ghostscript-cupsUpgrade ghostscript | Nov 19, 2019 | Jun 1, 2018 |
| Oracle_linux | — | Upgrade ghostscript-gtkUpgrade ghostscript-cupsUpgrade ghostscriptUpgrade libgs-develUpgrade libgsUpgrade ghostscript-doc | Jul 21, 2020 | Oct 5, 2016 |
| Redhat_linux | — | Upgrade ghostscript-debuginfoUpgrade ghostscript-cupsUpgrade libgs-develNo solution existsUpgrade libgsUpgrade ghostscript-gtkUpgrade ghostscript-docUpgrade ghostscript | Aug 7, 2019 | Jun 1, 2018 |
| Ubuntu | — | Upgrade ghostscriptUpgrade libgs9 | Oct 2, 2018 | Jun 1, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub