The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: /invalidaccess bypass after failed restore (699654) (CVE-2018-16509)

  - ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c     (CVE-2018-19409)

  - The getenv and filenameforall functions in Ghostscript 9.10 ignore the -dSAFER argument, which allows     remote attackers to read data via a crafted postscript file. (CVE-2013-5653)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c     (CVE-2018-19409)

  - Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier     allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as     demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write. (CVE-2015-3228)

  - The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is     mishandled in the color management module. (CVE-2016-10217)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: use-after-free in xps_finish_image_path() in devices/vector/gdevxps.c could result in a     privilege escalation (CVE-2020-16303)

  - Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier     allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as     demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write. (CVE-2015-3228)

  - The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is     mishandled in the color management module. (CVE-2016-10217)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the ghostscript package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The gs_alloc_ref_array function in psi/ialloc.c in     Artifex Ghostscript 9.21 allows remote attackers to     cause a denial of service (heap-based buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted PostScript document. This is     related to a lack of an integer overflow check in     base/gsalloc.c.(CVE-2017-9835)

  - The Ins_JMPR function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9739)

  - The gx_ttfReader__Read function in base/gxttfb.c in     Artifex Ghostscript GhostXPS 9.21 allows remote     attackers to cause a denial of service (heap-based     buffer over-read and application crash) or possibly     have unspecified other impact via a crafted     document.(CVE-2017-9727)

  - The Ins_MDRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9726)

  - The Ins_IP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (use-after-free and     application crash) or possibly have unspecified other     impact via a crafted document.(CVE-2017-9612)

  - The mem_get_bits_rectangle function in base/gdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file.(CVE-2017-5951)

  - The fill_threshhold_buffer function in     base/gxht_thresh.c in Artifex Software, Inc.
    Ghostscript 9.20 allows remote attackers to cause a     denial of service (heap-based buffer overflow and     application crash) or possibly have unspecified other     impact via a crafted PostScript     document.(CVE-2016-10317)

  - The gs_makewordimagedevice function in base/gsdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file that is mishandled in the PDF Transparency     module.(CVE-2016-10220)

  - The intersect function in base/gxfill.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (divide-by-zero error and     application crash) via a crafted file.(CVE-2016-10219)

  - The pdf14_pop_transparency_group function in     base/gdevp14.c in the PDF Transparency module in     Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (NULL pointer

  - dereference and application crash) via a crafted     file.(CVE-2016-10218)

  - The pdf14_open function in base/gdevp14.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (use-after-free and     application crash) via a crafted file that is     mishandled in the color management     module.(CVE-2016-10217)

  - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles     references to the scanner state structure, which allows     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted PostScript document, related to an     out-of-bounds read in the igc_reloc_struct_ptr function     in psi/igc.c.(CVE-2017-11714)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles     references to the scanner state structure, which allows     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted PostScript document, related to an     out-of-bounds read in the igc_reloc_struct_ptr function     in psi/igc.c.(CVE-2017-11714)

  - The pdf14_open function in base/gdevp14.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (use-after-free and     application crash) via a crafted file that is     mishandled in the color management     module.(CVE-2016-10217)

  - The pdf14_pop_transparency_group function in     base/gdevp14.c in the PDF Transparency module in     Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted     file.(CVE-2016-10218)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2016-10219)

  - The gs_makewordimagedevice function in base/gsdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file that is mishandled in the PDF Transparency     module.(CVE-2016-10220)

  - The fill_threshhold_buffer function in     base/gxht_thresh.c in Artifex Software, Inc.
    Ghostscript 9.20 allows remote attackers to cause a     denial of service (heap-based buffer overflow and     application crash) or possibly have unspecified other     impact via a crafted PostScript     document.(CVE-2016-10317)

  - The mem_get_bits_rectangle function in base/gdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file.(CVE-2017-5951)

  - The Ins_IP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (use-after-free and     application crash) or possibly have unspecified other     impact via a crafted document.(CVE-2017-9612)

  - The Ins_MDRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9726)

  - The gx_ttfReader__Read function in base/gxttfb.c in     Artifex Ghostscript GhostXPS 9.21 allows remote     attackers to cause a denial of service (heap-based     buffer over-read and application crash) or possibly     have unspecified other impact via a crafted     document.(CVE-2017-9727)

  - The Ins_JMPR function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9739)

  - The gs_alloc_ref_array function in psi/ialloc.c in     Artifex Ghostscript 9.21 allows remote attackers to     cause a denial of service (heap-based buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted PostScript document. This is     related to a lack of an integer overflow check in     base/gsalloc.c.(CVE-2017-9835)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A Division by Zero vulnerability in bj10v_print_page()     in contrib/japanese/gdev10v.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file.
    (CVE-2020-16299)

  - A buffer overflow vulnerability in     pj_common_print_page() in devices/gdevpjet.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted PDF file.
    (CVE-2020-16288)

  - A buffer overflow vulnerability in cif_print_page() in     devices/gdevcif.c of Artifex Software GhostScript v9.50     allows a remote attacker to cause a denial of service     via a crafted PDF file. (CVE-2020-16289)

  - A buffer overflow vulnerability in     jetp3852_print_page() in devices/gdev3852.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted PDF file.
    (CVE-2020-16290)

  - A buffer overflow vulnerability in mj_raster_cmd() in     contrib/japanese/gdevmjc.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file.
    (CVE-2020-16292)

  - A buffer overflow vulnerability in epsc_print_page() in     devices/gdevepsc.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file. (CVE-2020-16294)

  - A null pointer dereference vulnerability in     clj_media_size() in devices/gdevclj.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted PDF file.
    (CVE-2020-16295)

  - A buffer overflow vulnerability in GetNumWrongData() in     contrib/lips4/gdevlips.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file.
    (CVE-2020-16296)

  - A buffer overflow vulnerability in     FloydSteinbergDitheringC() in contrib/gdevbjca.c of     Artifex Software GhostScript v9.50 allows a remote     attacker to cause a denial of service via a crafted PDF     file. (CVE-2020-16297)

  - A buffer overflow vulnerability in mj_color_correct()     in contrib/japanese/gdevmjc.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file.
    (CVE-2020-16298)

  - A buffer overflow vulnerability in tiff12_print_page()     in devices/gdevtfnx.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file. (CVE-2020-16300)

  - A buffer overflow vulnerability in okiibm_print_page1()     in devices/gdevokii.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file. (CVE-2020-16301)

  - A buffer overflow vulnerability in GetNumSameData() in     contrib/lips4/gdevlips.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file.
    (CVE-2020-17538)

  - A buffer overflow vulnerability in pcx_write_rle() in     contrib/japanese/gdev10v.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file.
    (CVE-2020-16305)

  - A buffer overflow vulnerability in p_print_image() in     devices/gdevcdj.c of Artifex Software GhostScript v9.50     allows a remote attacker to cause a denial of service     via a crafted PDF file. (CVE-2020-16308)

  - A buffer overflow vulnerability in     lxm5700m_print_page() in devices/gdevlxm.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted eps file.
    (CVE-2020-16309)

  - A division by zero vulnerability in dot24_print_page()     in devices/gdevdm24.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file. (CVE-2020-16310)

  - A buffer overflow vulnerability in lprn_is_black() in     contrib/lips4/gdevlprn.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF file.
    (CVE-2020-16287)

  - A buffer overflow vulnerability in contrib/gdevdj9.c of     Artifex Software GhostScript v9.50 allows a remote     attacker to cause a denial of service via a crafted PDF     file. (CVE-2020-16291)

  - A buffer overflow vulnerability in     jetp3852_print_page() in devices/gdev3852.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     escalate privileges via a crafted PDF file.
    (CVE-2020-16302)

  - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles     references to the scanner state structure, which allows     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted PostScript document, related to an     out-of-bounds read in the igc_reloc_struct_ptr function     in psi/igc.c.(CVE-2017-11714)

  - The pdf14_open function in base/gdevp14.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (use-after-free and     application crash) via a crafted file that is     mishandled in the color management     module.(CVE-2016-10217)

  - The pdf14_pop_transparency_group function in     base/gdevp14.c in the PDF Transparency module in     Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted     file.(CVE-2016-10218)

  - The intersect function in base/gxfill.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (divide-by-zero error and     application crash) via a crafted file.(CVE-2016-10219)

  - The gs_makewordimagedevice function in base/gsdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file that is mishandled in the PDF Transparency     module.(CVE-2016-10220)

  - The fill_threshhold_buffer function in     base/gxht_thresh.c in Artifex Software, Inc.
    Ghostscript 9.20 allows remote attackers to cause a     denial of service (heap-based buffer overflow and     application crash) or possibly have unspecified other     impact via a crafted PostScript     document.(CVE-2016-10317)

  - The mem_get_bits_rectangle function in base/gdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file.(CVE-2017-5951)

  - The Ins_IP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (use-after-free and     application crash) or possibly have unspecified other     impact via a crafted document.(CVE-2017-9612)

  - The Ins_MDRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9726)

  - The gx_ttfReader__Read function in base/gxttfb.c in     Artifex Ghostscript GhostXPS 9.21 allows remote     attackers to cause a denial of service (heap-based     buffer over-read and application crash) or possibly     have unspecified other impact via a crafted     document.(CVE-2017-9727)

  - The Ins_JMPR function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9739)

  - The gs_alloc_ref_array function in psi/ialloc.c in     Artifex Ghostscript 9.21 allows remote attackers to     cause a denial of service (heap-based buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted PostScript document. This is     related to a lack of an integer overflow check in     base/gsalloc.c.(CVE-2017-9835)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles     references to the scanner state structure, which allows     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted PostScript document, related to an     out-of-bounds read in the igc_reloc_struct_ptr function     in psi/igc.c.(CVE-2017-11714)

  - The pdf14_open function in base/gdevp14.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (use-after-free and     application crash) via a crafted file that is     mishandled in the color management     module.(CVE-2016-10217)

  - The pdf14_pop_transparency_group function in     base/gdevp14.c in the PDF Transparency module in     Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted     file.(CVE-2016-10218)

  - The intersect function in base/gxfill.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (divide-by-zero error and     application crash) via a crafted file.(CVE-2016-10219)

  - The gs_makewordimagedevice function in base/gsdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file that is mishandled in the PDF Transparency     module.(CVE-2016-10220)

  - The fill_threshhold_buffer function in     base/gxht_thresh.c in Artifex Software, Inc.
    Ghostscript 9.20 allows remote attackers to cause a     denial of service (heap-based buffer overflow and     application crash) or possibly have unspecified other     impact via a crafted PostScript     document.(CVE-2016-10317)

  - The mem_get_bits_rectangle function in base/gdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file.(CVE-2017-5951)

  - The Ins_IP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (use-after-free and     application crash) or possibly have unspecified other     impact via a crafted document.(CVE-2017-9612)

  - The Ins_MDRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9726)

  - The gx_ttfReader__Read function in base/gxttfb.c in     Artifex Ghostscript GhostXPS 9.21 allows remote     attackers to cause a denial of service (heap-based     buffer over-read and application crash) or possibly     have unspecified other impact via a crafted     document.(CVE-2017-9727)

  - The Ins_JMPR function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9739)

  - The gs_alloc_ref_array function in psi/ialloc.c in     Artifex Ghostscript 9.21 allows remote attackers to     cause a denial of service (heap-based buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted PostScript document. This is     related to a lack of an integer overflow check in     base/gsalloc.c.(CVE-2017-9835)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Artifex jbig2dec 0.13 has a heap-based buffer over-read     leading to denial of service (application crash) or     disclosure of sensitive information from process     memory, because of an integer overflow in the     jbig2_decode_symbol_dict function in     jbig2_symbol_dict.c in libjbig2dec.a during operation     on a crafted .jb2 file.(CVE-2017-7885)

  - Artifex jbig2dec 0.13, as used in Ghostscript, allows     out-of-bounds writes because of an integer overflow in     the jbig2_build_huffman_table function in     jbig2_huffman.c during operations on a crafted JBIG2     file, leading to a denial of service (application     crash) or possibly execution of arbitrary     code.(CVE-2017-7975)

  - ghostscript before version 9.21 is vulnerable to a heap     based buffer overflow that was found in the ghostscript     jbig2_decode_gray_scale_image function which is used to     decode halftone segments in a JBIG2 image. A document     (PostScript or PDF) with an embedded, specially     crafted, jbig2 image could trigger a segmentation fault     in ghostscript.(CVE-2016-9601)

  - libjbig2dec.a in Artifex jbig2dec 0.13, as used in     MuPDF and Ghostscript, has a NULL pointer dereference     in the jbig2_huffman_get function in jbig2_huffman.c.
    For example, the jbig2dec utility will crash     (segmentation fault) when parsing an invalid     file.(CVE-2017-9216)

  - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles     references to the scanner state structure, which allows     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted PostScript document, related to an     out-of-bounds read in the igc_reloc_struct_ptr function     in psi/igc.c.(CVE-2017-11714)

  - The fill_threshhold_buffer function in     base/gxht_thresh.c in Artifex Software, Inc.
    Ghostscript 9.20 allows remote attackers to cause a     denial of service (heap-based buffer overflow and     application crash) or possibly have unspecified other     impact via a crafted PostScript     document.(CVE-2016-10317)

  - The gs_alloc_ref_array function in psi/ialloc.c in     Artifex Ghostscript 9.21 allows remote attackers to     cause a denial of service (heap-based buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted PostScript document. This is     related to a lack of an integer overflow check in     base/gsalloc.c.(CVE-2017-9835)

  - The gs_makewordimagedevice function in base/gsdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file that is mishandled in the PDF Transparency     module.(CVE-2016-10220)

  - The intersect function in base/gxfill.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (divide-by-zero error and     application crash) via a crafted file.(CVE-2016-10219)

  - The mem_get_bits_rectangle function in base/gdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file.(CVE-2017-5951)

  - The pdf14_open function in base/gdevp14.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (use-after-free and     application crash) via a crafted file that is     mishandled in the color management     module.(CVE-2016-10217)

  - The pdf14_pop_transparency_group function in     base/gdevp14.c in the PDF Transparency module in     Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted     file.(CVE-2016-10218)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Artifex Ghostscript before 9.26, a carefully crafted     PDF file can trigger an extremely long running     computation when parsing the file.(CVE-2018-19478)

  - The gs_makewordimagedevice function in base/gsdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file that is mishandled in the PDF Transparency     module.(CVE-2016-10220)

  - Artifex jbig2dec 0.13 has a heap-based buffer over-read     leading to denial of service (application crash) or     disclosure of sensitive information from process     memory, because of an integer overflow in the     jbig2_decode_symbol_dict function in     jbig2_symbol_dict.c in libjbig2dec.a during operation     on a crafted .jb2 file.(CVE-2017-7885)

  - Artifex jbig2dec 0.13, as used in Ghostscript, allows     out-of-bounds writes because of an integer overflow in     the jbig2_build_huffman_table function in     jbig2_huffman.c during operations on a crafted JBIG2     file, leading to a denial of service (application     crash) or possibly execution of arbitrary     code.(CVE-2017-7975)

  - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles     references to the scanner state structure, which allows     remote attackers to cause a denial of service     (application crash) or possibly have unspecified other     impact via a crafted PostScript document, related to an     out-of-bounds read in the igc_reloc_struct_ptr function     in psi/igc.c.(CVE-2017-11714)

  - The gs_alloc_ref_array function in psi/ialloc.c in     Artifex Ghostscript 9.21 allows remote attackers to     cause a denial of service (heap-based buffer overflow     and application crash) or possibly have unspecified     other impact via a crafted PostScript document. This is     related to a lack of an integer overflow check in     base/gsalloc.c.(CVE-2017-9835)

  - The pdf14_pop_transparency_group function in     base/gdevp14.c in the PDF Transparency module in     Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted     file.(CVE-2016-10218)

  - The fill_threshhold_buffer function in     base/gxht_thresh.c in Artifex Software, Inc.
    Ghostscript 9.20 allows remote attackers to cause a     denial of service (heap-based buffer overflow and     application crash) or possibly have unspecified other     impact via a crafted PostScript     document.(CVE-2016-10317)

  - The pdf14_open function in base/gdevp14.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (use-after-free and     application crash) via a crafted file that is     mishandled in the color management     module.(CVE-2016-10217)

  - The intersect function in base/gxfill.c in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (divide-by-zero error and     application crash) via a crafted file.(CVE-2016-10219)

  - The mem_get_bits_rectangle function in base/gdevmem.c     in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a     crafted file.(CVE-2017-5951)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes release for these CVEs :

  -     [CVE-2016-10217](https://access.redhat.com/security/cve/     CVE-2016-10217) *(use-after-free and application crash)*

  -     [CVE-2016-10218](https://access.redhat.com/security/cve/     CVE-2016-10218) *(NULL pointer dereference and     application crash)*

  -     [CVE-2016-10219](https://access.redhat.com/security/cve/     CVE-2016-10219) *(divide-by-zero error and application     crash)*

  -     [CVE-2016-10220](https://access.redhat.com/security/cve/     CVE-2016-10220) *(NULL pointer dereference and     application crash)*

  -     [CVE-2017-5951](https://access.redhat.com/security/cve/C     VE-2017-5951) *(NULL pointer dereference and application     crash)*

  -     [CVE-2017-7975](https://access.redhat.com/security/cve/C     VE-2017-7975) *(application crash or possible execution     of arbitrary code)*

  -     [CVE-2017-8291](https://access.redhat.com/security/cve/C     VE-2017-8291) *( -dSAFER bypass and remote command     execution)*

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3272-1 advisory.

    It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An     attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby     allowing the execution of arbitrary code, or cause a denial of service (application crash).
    (CVE-2017-8291)

    Kamil Frankowicz discovered a use-after-free vulnerability in the color management module of Ghostscript.
    An attacker could use this to cause a denial of service (application crash). (CVE-2016-10217)

    Kamil Frankowicz discovered a divide-by-zero error in the scan conversion code in Ghostscript. An attacker     could use this to cause a denial of service (application crash). (CVE-2016-10219)

    Kamil Frankowicz discovered multiple NULL pointer dereference errors in Ghostscript. An attacker could use     these to cause a denial of service (application crash). (CVE-2016-10220, CVE-2017-5951, CVE-2017-7207)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198835	RHEL 5 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198822	RHEL 6 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198813	RHEL 7 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196594	RHEL 5 : ghostscript (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196587	RHEL 7 : ghostscript (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196514	RHEL 6 : ghostscript (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
151342	EulerOS Virtualization for ARM 64 3.0.2.0 : ghostscript (EulerOS-SA-2021-2089)	Nessus	Huawei Local Security Checks	high
147428	EulerOS Virtualization 3.0.2.6 : ghostscript (EulerOS-SA-2021-1434)	Nessus	Huawei Local Security Checks	high
147424	EulerOS Virtualization 3.0.6.6 : ghostscript (EulerOS-SA-2021-1476)	Nessus	Huawei Local Security Checks	high
146154	EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2021-1193)	Nessus	Huawei Local Security Checks	high
132121	EulerOS 2.0 SP3 : ghostscript (EulerOS-SA-2019-2586)	Nessus	Huawei Local Security Checks	high
131862	EulerOS 2.0 SP2 : ghostscript (EulerOS-SA-2019-2370)	Nessus	Huawei Local Security Checks	high
101695	Fedora 26 : ghostscript (2017-a606d224a5)	Nessus	Fedora Local Security Checks	high
100201	Fedora 24 : ghostscript (2017-fae1506f94)	Nessus	Fedora Local Security Checks	high
100013	Fedora 25 : ghostscript (2017-c85c0e5637)	Nessus	Fedora Local Security Checks	high
99726	Ubuntu 14.04 LTS / 16.04 LTS : Ghostscript vulnerabilities (USN-3272-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2016-10217

medium

Tenable Plugins

critical

critical

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high