The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: /invalidaccess bypass after failed restore (699654) (CVE-2018-16509)

  - ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c     (CVE-2018-19409)

  - The getenv and filenameforall functions in Ghostscript 9.10 ignore the -dSAFER argument, which allows     remote attackers to read data via a crafted postscript file. (CVE-2013-5653)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: Improperly implemented security check in zsetdevice function in psi/zdevice.c     (CVE-2018-19409)

  - Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier     allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as     demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write. (CVE-2015-3228)

  - The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is     mishandled in the color management module. (CVE-2016-10217)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: use-after-free in xps_finish_image_path() in devices/vector/gdevxps.c could result in a     privilege escalation (CVE-2020-16303)

  - Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier     allows remote attackers to cause a denial of service (crash) via a crafted Postscript (ps) file, as     demonstrated by using the ps2pdf command, which triggers an out-of-bounds read or write. (CVE-2015-3228)

  - The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is     mishandled in the color management module. (CVE-2016-10217)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow vulnerability in lprn_is_black() in     contrib/lips4/gdevlprn.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF     file.(CVE-2020-16287)

  - A buffer overflow vulnerability in     pj_common_print_page() in devices/gdevpjet.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted PDF     file.(CVE-2020-16288)

  - A buffer overflow vulnerability in cif_print_page() in     devices/gdevcif.c of Artifex Software GhostScript v9.50     allows a remote attacker to cause a denial of service     via a crafted PDF file.(CVE-2020-16289)

  - A buffer overflow vulnerability in     jetp3852_print_page() in devices/gdev3852.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted PDF     file.(CVE-2020-16290)

  - A buffer overflow vulnerability in contrib/gdevdj9.c of     Artifex Software GhostScript v9.50 allows a remote     attacker to cause a denial of service via a crafted PDF     file.(CVE-2020-16291)

  - A buffer overflow vulnerability in mj_raster_cmd() in     contrib/japanese/gdevmjc.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF     file.(CVE-2020-16292)

  - A buffer overflow vulnerability in epsc_print_page() in     devices/gdevepsc.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file.(CVE-2020-16294)

  - A null pointer dereference vulnerability in     clj_media_size() in devices/gdevclj.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted PDF     file.(CVE-2020-16295)

  - A buffer overflow vulnerability in GetNumWrongData() in     contrib/lips4/gdevlips.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF     file.(CVE-2020-16296)

  - A buffer overflow vulnerability in     FloydSteinbergDitheringC() in contrib/gdevbjca.c of     Artifex Software GhostScript v9.50 allows a remote     attacker to cause a denial of service via a crafted PDF     file.(CVE-2020-16297)

  - A buffer overflow vulnerability in mj_color_correct()     in contrib/japanese/gdevmjc.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF     file.(CVE-2020-16298)

  - A Division by Zero vulnerability in bj10v_print_page()     in contrib/japanese/gdev10v.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF     file.(CVE-2020-16299)

  - A buffer overflow vulnerability in tiff12_print_page()     in devices/gdevtfnx.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file.(CVE-2020-16300)

  - A buffer overflow vulnerability in okiibm_print_page1()     in devices/gdevokii.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file.(CVE-2020-16301)

  - A buffer overflow vulnerability in pcx_write_rle() in     contrib/japanese/gdev10v.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF     file.(CVE-2020-16305)

  - A buffer overflow vulnerability in p_print_image() in     devices/gdevcdj.c of Artifex Software GhostScript v9.50     allows a remote attacker to cause a denial of service     via a crafted PDF file.(CVE-2020-16308)

  - A buffer overflow vulnerability in     lxm5700m_print_page() in devices/gdevlxm.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     cause a denial of service via a crafted eps     file.(CVE-2020-16309)

  - A division by zero vulnerability in dot24_print_page()     in devices/gdevdm24.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file.(CVE-2020-16310)

  - A buffer overflow vulnerability in GetNumSameData() in     contrib/lips4/gdevlips.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a     denial of service via a crafted PDF     file.(CVE-2020-17538)

  - A buffer overflow vulnerability in     jetp3852_print_page() in devices/gdev3852.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     escalate privileges via a crafted PDF     file.(CVE-2020-16302)

  - The Ins_MIRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9611)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ghostscript package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The Ins_MIRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9611)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A buffer overflow vulnerability in     jetp3852_print_page() in devices/gdev3852.c of Artifex     Software GhostScript v9.50 allows a remote attacker to     escalate privileges via a crafted PDF file. This is     fixed in v9.51.(CVE-2020-16302)

  - In ghostscript before version 9.50, the .buildfont1     procedure did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially     crafted PostScript file that could escalate privileges     and access files outside of restricted     areas.(CVE-2019-10216)

  - The Ins_MIRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9611)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Artifex Ghostscript before 9.26, a carefully crafted     PDF file can trigger an extremely long running     computation when parsing the file.(CVE-2018-19478)

  - In ghostscript before version 9.50, the .buildfont1     procedure did not properly secure its privileged calls,     enabling scripts to bypass `-dSAFER` restrictions. An     attacker could abuse this flaw by creating a specially     crafted PostScript file that could escalate privileges     and access files outside of restricted     areas.(CVE-2019-10216)

  - The Ins_MIRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9611)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The Ins_MIRP function in base/ttinterp.c in Artifex     Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read     and application crash) or possibly have unspecified     other impact via a crafted document.(CVE-2017-9611)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201811-12 (GPL Ghostscript: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GPL Ghostscript. Please       review the CVE identifiers referenced below for additional information.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted PostScript file or PDF document using GPL Ghostscript possibly       resulting in the execution of arbitrary code with the privileges of the       process, a Denial of Service condition, or other unspecified impacts,   Workaround :

    There is no known workaround at this time.

This update for ghostscript-library fixes the following issues :

CVE-2018-16511: A type confusion in 'ztype' could be used by remote attackers able to supply crafted PostScript to crash the interpreter or possibly have unspecified other impact. (bsc#1107426)

CVE-2018-16540: Attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the interpreter or possibly have unspecified other impact. (bsc#1107420)

CVE-2018-16541: Attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter. (bsc#1107421)

CVE-2018-16542: Attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the interpreter. (bsc#1107413)

CVE-2018-16509: Incorrect 'restoration of privilege' checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the 'pipe' instruction. (bsc#1107410

CVE-2018-16513: Attackers able to supply crafted PostScript files could use a type confusion in the setcolor function to crash the interpreter or possibly have unspecified other impact. (bsc#1107412)

CVE-2018-15910: Attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or execute code. (bsc#1106173)

CVE-2017-9611: The Ins_MIRP function allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document. (bsc#1050893)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service if a specially crafted Postscript file is processed.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3403-1 advisory.

    Kamil Frankowicz discovered that Ghostscript mishandles references. A remote attacker could use this to     cause a denial of service. (CVE-2017-11714)

    Kim Gwan Yeong discovered that Ghostscript could allow a heap-based buffer over-read and application     crash. A remote attacker could use a crafted document to cause a denial of service. (CVE-2017-9611,     CVE-2017-9726, CVE-2017-9727, CVE-2017-9739)

    Kim Gwan Yeong discovered an use-after-free vulnerability in Ghostscript. A remote attacker could use a     crafted file to cause a denial of service. (CVE-2017-9612)

    Kim Gwan Yeong discovered a lack of integer overflow check in Ghostscript. A remote attacker could use     crafted PostScript document to cause a denial of service. (CVE-2017-9835)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several issues were found in Ghostscript, the GPL PostScript/PDF interpreter, which allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.

For Debian 7 'Wheezy', these problems have been fixed in version 9.05~dfsg-6.3+deb7u7.

We recommend that you upgrade your ghostscript packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198835	RHEL 5 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198822	RHEL 6 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198813	RHEL 7 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
142263	EulerOS 2.0 SP2 : ghostscript (EulerOS-SA-2020-2344)	Nessus	Huawei Local Security Checks	high
141714	EulerOS Virtualization 3.0.2.2 : ghostscript (EulerOS-SA-2020-2232)	Nessus	Huawei Local Security Checks	high
140881	EulerOS 2.0 SP3 : ghostscript (EulerOS-SA-2020-2114)	Nessus	Huawei Local Security Checks	high
137957	EulerOS Virtualization 3.0.6.0 : ghostscript (EulerOS-SA-2020-1738)	Nessus	Huawei Local Security Checks	high
136252	EulerOS Virtualization for ARM 64 3.0.2.0 : ghostscript (EulerOS-SA-2020-1549)	Nessus	Huawei Local Security Checks	high
134797	EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2020-1306)	Nessus	Huawei Local Security Checks	high
119132	GLSA-201811-12 : GPL Ghostscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
118350	SUSE SLES11 Security Update : ghostscript-library (SUSE-SU-2018:3330-1)	Nessus	SuSE Local Security Checks	high
103578	Debian DSA-3986-1 : ghostscript - security update	Nessus	Debian Local Security Checks	high
102815	Ubuntu 14.04 LTS / 16.04 LTS : Ghostscript vulnerabilities (USN-3403-1)	Nessus	Ubuntu Local Security Checks	high
102096	Debian DLA-1048-1 : ghostscript security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-9611

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

critical

high

high

high

high