Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: /invalidaccess bypass after failed restore (699654) (CVE-2018-16509)

  - ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c     (CVE-2018-19409)

  - The getenv and filenameforall functions in Ghostscript 9.10 ignore the -dSAFER argument, which allows     remote attackers to read data via a crafted postscript file. (CVE-2013-5653)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c     (CVE-2018-19409)

  - Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier     allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as     demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write. (CVE-2015-3228)

  - The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is     mishandled in the color management module. (CVE-2016-10217)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: use-after-free in xps_finish_image_path() in devices/vector/gdevxps.c could result in a     privilege escalation (CVE-2020-16303)

  - Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier     allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as     demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write. (CVE-2015-3228)

  - The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is     mishandled in the color management module. (CVE-2016-10217)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the version of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - An integer overflow flaw was discovered in one of     Ghostscript's memory allocation routines. A remote     attacker could possibly exploit this flaw to cause a     crash or, potentially, execute arbitrary code by     tricking a user into processing a specially crafted     file.i1/4^CVE-2015-3228i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Integer overflow in the gs_heap_alloc_bytes function in     base/gsmalloc.c in Ghostscript 9.15 and earlier allows     remote attackers to cause a denial of service (crash)     via a crafted Postscript (ps) file, as demonstrated by     using the ps2pdf command, which triggers an     out-of-bounds read or write.(CVE-2015-3228)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-33 (GPL Ghostscript: User-assisted execution of arbitrary code)

    An integer overflow flaw was discovered that leads to an out-of-bounds       read and write in gs_ttf.ps.
  Impact :

    A remote attacker could entice a user to open a specially crafted file,       possibly resulting in the execution of arbitrary code with the privileges       of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for ghostscript-library fixes the following issues :

  - Multiple security vulnerabilities have been discovered     where ghostscript's '-dsafer' flag did not provide     sufficient protection against unintended access to the     file system. Thus, a machine that would process a     specially crafted Postscript file would potentially leak     sensitive information to an attacker. (CVE-2013-5653,     CVE-2016-7977, bsc#1001951)

  - Insufficient validation of the type of input in     .initialize_dsc_parser used to allow remote code     execution. (CVE-2016-7979, bsc#1001951)

  - An integer overflow in the gs_heap_alloc_bytes function     used to allow remote attackers to cause a denial of     service (crash) via specially crafted Postscript files.
    (CVE-2015-3228, boo#939342)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ghostscript was updated to fix one security issue and one bug.

The following vulnerability was fixed :

  - CVE-2015-3228: Specially crafted ps files could have     caused an out of bound read/write due to an integer     overflow, causing a segfault in the application or     having unspecified further impact.

Also a non security bug was fixed :

  - fix a crash in mutex handling (bsc#963017)

This update was imported from the SUSE:SLE-12:Update update project.

ghostscript was updated to fix one security issue and one bug.

The following vulnerability was fixed :

  - CVE-2015-3228: Specially crafted ps files could have     caused an out of bound read/write due to an integer     overflow, causing a segfault in the application or     having unspecified further impact.

Also a non security bug was fixed :

  - fix a crash in mutex handling (bsc#963017)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE reports :

Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write.

Ghostscript was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-3228: Specially crafted files could have caused     an interger overflow, resulting in a crash of the     application or unspecified other impact (bsc#939342)

William Robinet and Stefan Cornelius discovered an integer overflow in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service or potentially execution of arbitrary code if a specially crafted file is opened.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2697-1 advisory.

    William Robinet and Stefan Cornelius discovered that Ghostscript did not correctly handle certain     Postscript files. If a user or automated system were tricked into opening a specially crafted file, an     attacker could cause a denial of service or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In gs_heap_alloc_bytes(), add a sanity check to ensure we don't overflow the variable holding the actual number of bytes we allocate.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198835	RHEL 5 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198822	RHEL 6 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198813	RHEL 7 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
123863	EulerOS Virtualization 2.5.3 : ghostscript (EulerOS-SA-2019-1177)	Nessus	Huawei Local Security Checks	medium
122710	EulerOS Virtualization 2.5.2 : ghostscript (EulerOS-SA-2019-1088)	Nessus	Huawei Local Security Checks	medium
95736	GLSA-201612-33 : GPL Ghostscript: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
94007	SUSE SLES11 Security Update : ghostscript-library (SUSE-SU-2016:2493-1)	Nessus	SuSE Local Security Checks	critical
90381	openSUSE Security Update : ghostscript (openSUSE-2016-427)	Nessus	SuSE Local Security Checks	medium
90187	SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2016:0884-1)	Nessus	SuSE Local Security Checks	medium
85731	FreeBSD : ghostscript -- denial of service (crash) via crafted Postscript files (fc1f6658-4f53-11e5-934b-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
85260	openSUSE Security Update : ghostscript (openSUSE-2015-537)	Nessus	SuSE Local Security Checks	medium
85165	Debian DSA-3326-1 : ghostscript - security update	Nessus	Debian Local Security Checks	medium
85155	Ubuntu 14.04 LTS : Ghostscript vulnerability (USN-2697-1)	Nessus	Ubuntu Local Security Checks	high
84989	Debian DLA-280-1 : ghostscript security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-3228

high

Tenable Plugins

critical

critical

high

medium

medium

medium

critical

medium

medium

medium

medium

medium

high

medium