PT-2016-7519 · Artifex+5 · Ghostscript+5

Cedric Buissart · Publicado 2016-10-12 · Atualizado 2024-06-15 · CVE-2016-8602

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghostscript versions prior to 9.21

Description The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted Postscript document. This is achieved by calling the .sethalftone5 function with an empty operand stack.

Recommendations For Ghostscript versions prior to 9.21, update to version 9.21 or later to resolve the issue. As a temporary workaround, consider restricting the use of the .sethalftone5 function in psi/zht2.c to minimize the risk of exploitation.

Correção

DoS

Incorrect Type Conversion or Cast

Enumeração de Fraquezas

CWE-704

Identificadores relacionados

ALT-PU-2018-2344

CESA-2017_0013

CESA-2017_0014

CVE-2016-8602

DLA-674-1

DSA-3691-1

DSA-3691-2

MGASA-2017-0133

OPENSUSE-SU-2016_2648-1

OPENSUSE-SU-2024:10003-1

RHSA-2017:0013

RHSA-2017:0014

RHSA-2017_0013

RHSA-2017_0014

SUSE-SU-2016:2654-1

SUSE-SU-2016:2723-1

SUSE-SU-2016_2654-1

SUSE-SU-2016_2723-1

USN-3148-1

Produtos afetados

Alt Linux

Centos

Ghostscript

Red Hat

Suse

Ubuntu

Referências · 45

• https://advisories.mageia.org/MGASA-2017-0133.html · Nota de Segurança
• https://osv.dev/vulnerability/DSA-3691-2 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2017-0014.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-7977 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2016/10/11/7 · Correção
• https://ubuntu.com/security/notices/USN-3148-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-8602 · Nota
• http://rhn.redhat.com/errata/RHSA-2017-0013.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-5653 · Nota
• https://bugzilla.suse.com/1004237 · Nota
• https://ghostscript.com/doc/9.21/History9.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8602 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/10/05/15 · Nota
• https://osv.dev/vulnerability/MGASA-2017-0133 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3691-1 · Aviso do Fabricante