PT-2017-18615 · Artifex · Artifex Ghostscript

Kamil Frankowicz · Published 2017-05-12 · Updated 2017-11-29 · CVE-2017-8908

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript version 9.21

Description The issue allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PostScript document. This is due to a problem in the mark line tr function in gxscanc.c.

Recommendations For Artifex Ghostscript version 9.21, consider updating to a newer version that contains a fix for this issue, as no specific workaround is provided for this version.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2017-8908

MGASA-2017-0430

Affected Products

Artifex Ghostscript

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-8908 · Security Note
• https://advisories.mageia.org/MGASA-2017-0430.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-8908 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-8908 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/2QUCMGMEGU4TK3I5424ZFZYFJHEQRF4P · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8908 · Vendor Advisory
• https://bugs.ghostscript.com/show_bug.cgi?id=697810 · Patch
• https://osv.dev/vulnerability/MGASA-2017-0430 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=22052 · Note
• http://securityfocus.com/bid/98427 · Note