CVE-2016-7976

The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.

The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.

Various userparams in Ghostscript allow %pipe% in paths, allowing remote shell command execution (CVE-2016-7976).

The .libfile function in Ghostscript doesn't check PermitFileReading array, allowing remote file disclosure (CVE-2016-7977).

Reference leak in the .setdevice function in Ghostscript allows use-after-free and remote code execution (CVE-2016-7978).

Type confusion in the .initialize_dsc_parser function in Ghostscript allows remote code execution (CVE-2016-7979).

The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack (CVE-2016-8602).

A heap based buffer overflow was found in the ghostscript jbig2_decode_gray_scale_image() function used to decode halftone segments in a JBIG2 image. A document (PostScript or PDF) with an embedded, specially crafted, jbig2 image could trigger a segmentation fault in ghostscript (CVE-2016-9601).

The pdf14_open function in base/gdevp14.c in Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module (CVE-2016-10217).

The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file (CVE-2016-10218).

The intersect function in base/gxfill.c in Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file (CVE-2016-10219).

The gs_makewordimagedevice function in base/gsdevmem.c in Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module (CVE-2016-10220).

The mem_get_bits_rectangle function in base/gdevmem.c in Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file (CVE-2017-5951).

The mem_get_bits_rectangle function in Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document (CVE-2017-7207).

Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program (CVE-2017-8291).

These are all security issues fixed in the ghostscript-9.20-2.1 package on the GA media of openSUSE Tumbleweed.

Tavis Ormandy discovered multiple vulnerabilities in the way that Ghostscript processes certain Postscript files. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause a denial of service or possibly execute arbitrary code. (CVE-2016-7976, CVE-2016-7978, CVE-2016-7979, CVE-2016-8602)

Multiple vulnerabilities were discovered in Ghostscript related to information disclosure. If a user or automated system were tricked into opening a specially crafted file, an attacker could expose sensitive data. (CVE-2013-5653, CVE-2016-7977)