PT-2019-8030 · Artifex+1 · Artifex Ghostscript+1

Jasper Yu · Published 2019-05-23 · Updated 2019-05-27 · CVE-2017-15652

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript version 9.22

Description The issue allows an attacker to obtain sensitive information by opening a postscript file through Ghostscript. The affected components include the source code file, function, executable, and libga, which is also used by ImageMagick, making it affected as well.

Recommendations For Artifex Ghostscript version 9.22, consider restricting access to postscript files until a fix is available. As a temporary workaround, avoid using the affected libga component, which is also used by ImageMagick, to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-15652

Affected Products

Artifex Ghostscript

Imagemagick

References · 11

• 🔥 https://bugs.ghostscript.com/show_bug.cgi?id=698676 · Exploit
• https://ubuntu.com/security/CVE-2017-15652 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15652 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15652 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15652 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15652 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15652 · Security Note
• http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=2fc463d0e · Note
• http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2fc463d0e · Note
• http://securityfocus.com/bid/108463 · Note