critique
CVE-2016-7979
ghostscript: Type confusion in .initialize_dsc_parser allows remote code execution
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.8CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne), Amazon (moyenne), Oracle (moyenne), Ubuntu (moyenne).
Description
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | ghostscript, ghostscript-debuginfo, ghostscript-devel et 1 autres | 8.70-21.1.24.amzn1 |
| debian 11 | ghostscript | 9.19~dfsg-3.1 |
| debian 12 | ghostscript | 9.19~dfsg-3.1 |
| debian 13 | ghostscript | 9.19~dfsg-3.1 |
| debian 14 | ghostscript | 9.19~dfsg-3.1 |
| debian 7 | ghostscript | 9.05~dfsg-6.3+deb7u3 |
| debian 8 | ghostscript | 9.06~dfsg-2+deb8u3 |
| echo | ghostscript | 9.19~dfsg-3.1 |
| Oracle Linux 6 | ghostscript, ghostscript-devel, ghostscript-doc et 1 autres | 8.70-21.el6_8.1 |
| Oracle Linux 7 | ghostscript, ghostscript-cups, ghostscript-devel et 2 autres | 9.07-20.el7_3.1 |
| root.io debian 12 | rootio-ghostscript | 9.19~dfsg-3.1 |
| ubuntu 12.04 | ghostscript | 9.05~dfsg-0ubuntu4.4 |
Afficher les 26 entrées de 16 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | ghostscript | 8.70-21.1.24.amzn1 |
| amazon linux 1 | ghostscript-debuginfo | 8.70-21.1.24.amzn1 |
| amazon linux 1 | ghostscript-devel | 8.70-21.1.24.amzn1 |
| amazon linux 1 | ghostscript-doc | 8.70-21.1.24.amzn1 |
| debian 11 | ghostscript | 9.19~dfsg-3.1 |
| debian 12 | ghostscript | 9.19~dfsg-3.1 |
| debian 13 | ghostscript | 9.19~dfsg-3.1 |
| debian 14 | ghostscript | 9.19~dfsg-3.1 |
| debian 7 | ghostscript | 9.05~dfsg-6.3+deb7u3 |
| debian 8 | ghostscript | 9.06~dfsg-2+deb8u3 |
| echo | ghostscript | 9.19~dfsg-3.1 |
| Oracle Linux 6 | ghostscript | 8.70-21.el6_8.1 |
| Oracle Linux 6 | ghostscript-devel | 8.70-21.el6_8.1 |
| Oracle Linux 6 | ghostscript-doc | 8.70-21.el6_8.1 |
| Oracle Linux 6 | ghostscript-gtk | 8.70-21.el6_8.1 |
| Oracle Linux 7 | ghostscript | 9.07-20.el7_3.1 |
| Oracle Linux 7 | ghostscript-cups | 9.07-20.el7_3.1 |
| Oracle Linux 7 | ghostscript-devel | 9.07-20.el7_3.1 |
| Oracle Linux 7 | ghostscript-doc | 9.07-20.el7_3.1 |
| Oracle Linux 7 | ghostscript-gtk | 9.07-20.el7_3.1 |
| root.io debian 12 | rootio-ghostscript | 9.19~dfsg-3.1 |
| ubuntu 12.04 | ghostscript | 9.05~dfsg-0ubuntu4.4 |
| ubuntu 14.04 | ghostscript | 9.10~dfsg-0ubuntu10.5 |
| ubuntu 16.04 | ghostscript | 9.18~dfsg~0-0ubuntu2.2 |
| ubuntu 16.04-ESM | ghostscript | 9.18~dfsg~0-0ubuntu2.2 |
| ubuntu 16.10 | ghostscript | 9.19~dfsg+1-0ubuntu6.2 |
Références
- http://git.ghostscript.com/?p=ghostpdl.git%3Bh=875a0095f37626a721c7ff57d606a0f95af03913
- http://rhn.redhat.com/errata/RHSA-2017-0013.html
- http://rhn.redhat.com/errata/RHSA-2017-0014.html
- http://www.debian.org/security/2016/dsa-3691
- http://www.openwall.com/lists/oss-security/2016/10/05/15
- http://www.openwall.com/lists/oss-security/2016/10/05/19
- http://www.openwall.com/lists/oss-security/2016/10/05/7
- http://www.securityfocus.com/bid/95337
Les 16 références
- https://access.redhat.com/security/cve/CVE-2016-7979
- https://bugs.ghostscript.com/show_bug.cgi?id=697190
- https://linux.oracle.com/cve/CVE-2016-7979.html
- https://linux.oracle.com/errata/ELSA-2017-0014.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-7979
- https://security.gentoo.org/glsa/201702-31
- https://ubuntu.com/security/notices/USN-3148-1
- https://www.cve.org/CVERecord?id=CVE-2016-7979