kritisch
CVE-2016-7979
ghostscript: Type confusion in .initialize_dsc_parser allows remote code execution
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.8CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel), Amazon (mittel), Oracle (mittel), Ubuntu (mittel).
Beschreibung
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | ghostscript, ghostscript-debuginfo, ghostscript-devel und 1 weitere | 8.70-21.1.24.amzn1 |
| debian 11 | ghostscript | 9.19~dfsg-3.1 |
| debian 12 | ghostscript | 9.19~dfsg-3.1 |
| debian 13 | ghostscript | 9.19~dfsg-3.1 |
| debian 14 | ghostscript | 9.19~dfsg-3.1 |
| debian 7 | ghostscript | 9.05~dfsg-6.3+deb7u3 |
| debian 8 | ghostscript | 9.06~dfsg-2+deb8u3 |
| echo | ghostscript | 9.19~dfsg-3.1 |
| Oracle Linux 6 | ghostscript, ghostscript-devel, ghostscript-doc und 1 weitere | 8.70-21.el6_8.1 |
| Oracle Linux 7 | ghostscript, ghostscript-cups, ghostscript-devel und 2 weitere | 9.07-20.el7_3.1 |
| root.io debian 12 | rootio-ghostscript | 9.19~dfsg-3.1 |
| ubuntu 12.04 | ghostscript | 9.05~dfsg-0ubuntu4.4 |
Alle 26 Einträge aus 16 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| amazon linux 1 | ghostscript | 8.70-21.1.24.amzn1 |
| amazon linux 1 | ghostscript-debuginfo | 8.70-21.1.24.amzn1 |
| amazon linux 1 | ghostscript-devel | 8.70-21.1.24.amzn1 |
| amazon linux 1 | ghostscript-doc | 8.70-21.1.24.amzn1 |
| debian 11 | ghostscript | 9.19~dfsg-3.1 |
| debian 12 | ghostscript | 9.19~dfsg-3.1 |
| debian 13 | ghostscript | 9.19~dfsg-3.1 |
| debian 14 | ghostscript | 9.19~dfsg-3.1 |
| debian 7 | ghostscript | 9.05~dfsg-6.3+deb7u3 |
| debian 8 | ghostscript | 9.06~dfsg-2+deb8u3 |
| echo | ghostscript | 9.19~dfsg-3.1 |
| Oracle Linux 6 | ghostscript | 8.70-21.el6_8.1 |
| Oracle Linux 6 | ghostscript-devel | 8.70-21.el6_8.1 |
| Oracle Linux 6 | ghostscript-doc | 8.70-21.el6_8.1 |
| Oracle Linux 6 | ghostscript-gtk | 8.70-21.el6_8.1 |
| Oracle Linux 7 | ghostscript | 9.07-20.el7_3.1 |
| Oracle Linux 7 | ghostscript-cups | 9.07-20.el7_3.1 |
| Oracle Linux 7 | ghostscript-devel | 9.07-20.el7_3.1 |
| Oracle Linux 7 | ghostscript-doc | 9.07-20.el7_3.1 |
| Oracle Linux 7 | ghostscript-gtk | 9.07-20.el7_3.1 |
| root.io debian 12 | rootio-ghostscript | 9.19~dfsg-3.1 |
| ubuntu 12.04 | ghostscript | 9.05~dfsg-0ubuntu4.4 |
| ubuntu 14.04 | ghostscript | 9.10~dfsg-0ubuntu10.5 |
| ubuntu 16.04 | ghostscript | 9.18~dfsg~0-0ubuntu2.2 |
| ubuntu 16.04-ESM | ghostscript | 9.18~dfsg~0-0ubuntu2.2 |
| ubuntu 16.10 | ghostscript | 9.19~dfsg+1-0ubuntu6.2 |
Referenzen
- http://git.ghostscript.com/?p=ghostpdl.git%3Bh=875a0095f37626a721c7ff57d606a0f95af03913
- http://rhn.redhat.com/errata/RHSA-2017-0013.html
- http://rhn.redhat.com/errata/RHSA-2017-0014.html
- http://www.debian.org/security/2016/dsa-3691
- http://www.openwall.com/lists/oss-security/2016/10/05/15
- http://www.openwall.com/lists/oss-security/2016/10/05/19
- http://www.openwall.com/lists/oss-security/2016/10/05/7
- http://www.securityfocus.com/bid/95337
Alle 16 Referenzen
- https://access.redhat.com/security/cve/CVE-2016-7979
- https://bugs.ghostscript.com/show_bug.cgi?id=697190
- https://linux.oracle.com/cve/CVE-2016-7979.html
- https://linux.oracle.com/errata/ELSA-2017-0014.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-7979
- https://security.gentoo.org/glsa/201702-31
- https://ubuntu.com/security/notices/USN-3148-1
- https://www.cve.org/CVERecord?id=CVE-2016-7979