PT-2016-7452 · Artifex+2 · Ghostscript+2

Florian Weimer + 1 · Publicado 2016-10-06 · Atualizado 2024-06-15 · CVE-2016-7976

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghostscript versions 9.18 through 9.20

Description The issue allows remote attackers to execute arbitrary code via crafted userparams.

Recommendations For Ghostscript versions 9.18 through 9.20, update to a version that contains a fix for this issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2018-2344

CVE-2016-7976

DLA-674-1

DSA-3691-1

DSA-3691-2

MGASA-2017-0133

OPENSUSE-SU-2024:10003-1

USN-3148-1

Produtos afetados

Alt Linux

Ghostscript

Ubuntu

Referências · 39

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/fileformat/imagemagick_delegate.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/fileformat/ghostscript_type_confusion.rb · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7976 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-8602 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-7978 · Nota
• http://openwall.com/lists/oss-security/2016/10/05/7 · Nota
• http://openwall.com/lists/oss-security/2016/09/30/8 · Nota
• http://debian.org/security/2016/dsa-3691 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201702-31 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-8602 · Nota
• https://osv.dev/vulnerability/DSA-3691-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3148-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-7976 · Nota
• https://ubuntu.com/security/notices/USN-3148-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=19542 · Nota