Ghostscript - Multiple Denial of Service Vulnerabilities
Summary
DLA-905-1: ghostscript - security update. Affects ghostscript versions < 9.05~dfsg-6.3+deb7u5. Fixed in 9.05~dfsg-6.3+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghostscript is an open-source interpreter for the PostScript language and the Adobe Portable Document Format (PDF). It is widely used for rendering and converting PDF files. Ghostscript is vulnerable to multiple denial of service vulnerabilities that can be triggered when processing untrusted content.
Vulnerability Detail
The vulnerabilities in Ghostscript include:
-
CVE-2016-10219: This vulnerability can cause an application crash due to a division by zero in the scan conversion code when processing crafted content.
-
CVE-2016-10220: This vulnerability can cause an application crash with a segmentation fault in gx_device_finalize() when processing crafted content.
-
CVE-2017-5951: This vulnerability can cause an application crash with a segmentation fault in ref_stack_index() when processing crafted content.
These vulnerabilities can be exploited by an attacker to crash the application, leading to a denial of service condition.
How To Fix
Minimum fixed version
9.05~dfsg-6.3+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ghostscriptTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
Ghostscript is vulnerable to multiple denial of service vulnerabilities that can be triggered by processing untrusted content. To mitigate these vulnerabilities, it is recommended to upgrade your Ghostscript packages to the latest version. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ghostscript →
FAQ
Ghostscript is an open-source interpreter for the PostScript language and the Adobe Portable Document Format (PDF). It is commonly used for rendering and converting PDF files.
These vulnerabilities can be exploited by an attacker to crash the application, leading to a denial of service condition.
To fix these vulnerabilities, it is recommended to upgrade your Ghostscript packages to version 9.05~dfsg-6.3+deb7u5 or later.
There are no known workarounds for these vulnerabilities.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for ghostscript.
