USN-3272-2
ghostscript regression
USN-3272-1 fixed vulnerabilities in Ghostscript. This change introduced a regression when the DELAYBIND feature is used with the eqproc command. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby allowing the execution of arbitrary code, or cause a denial of service (application crash). (CVE-2017-8291)
Kamil Frankowicz discovered a use-after-free vulnerability in the color management module of Ghostscript. An attacker could use this to cause a denial of service (application crash). (CVE-2016-10217)
Kamil Frankowicz discovered a divide-by-zero error in the scan conversion code in Ghostscript. An attacker could use this to cause a denial of service (application crash). (CVE-2016-10219)
Kamil Frankowicz discovered multiple NULL pointer dereference errors in Ghostscript. An attacker could use these to cause a denial of service (application crash). (CVE-2016-10220, CVE-2017-5951, CVE-2017-7207)
What each source reports
OSV No score
ghostscript regression
USN-3272-1 fixed vulnerabilities in Ghostscript. This change introduced a regression when the DELAYBIND feature is used with the eqproc command. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby allowing the execution of arbitrary code, or cause a denial of service (application crash). (CVE-2017-8291)
Kamil Frankowicz discovered a use-after-free vulnerability in the color management module of Ghostscript. An attacker could use this to cause a denial of service (application crash). (CVE-2016-10217)
Kamil Frankowicz discovered a divide-by-zero error in the scan conversion code in Ghostscript. An attacker could use this to cause a denial of service (application crash). (CVE-2016-10219)
Kamil Frankowicz discovered multiple NULL pointer dereference errors in Ghostscript. An attacker could use these to cause a denial of service (application crash). (CVE-2016-10220, CVE-2017-5951, CVE-2017-7207)
- Record
USN-3272-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ghostscriptUbuntu:14.04:LTS |
before 9.10~dfsg-0ubuntu10.9, plus listed versions 9.10~dfsg-0ubuntu29.10~dfsg-0ubuntu39.10~dfsg-0ubuntu49.10~dfsg-0ubuntu59.10~dfsg-0ubuntu6 Show 11 moreShow less9.10~dfsg-0ubuntu79.10~dfsg-0ubuntu89.10~dfsg-0ubuntu99.10~dfsg-0ubuntu109.10~dfsg-0ubuntu10.19.10~dfsg-0ubuntu10.29.10~dfsg-0ubuntu10.39.10~dfsg-0ubuntu10.49.10~dfsg-0ubuntu10.59.10~dfsg-0ubuntu10.69.10~dfsg-0ubuntu10.7 |
9.10~dfsg-0ubuntu10.9 |
ghostscriptUbuntu:16.04:LTS |
before 9.18~dfsg~0-0ubuntu2.6, plus listed versions 9.16~dfsg~0-0ubuntu39.16~dfsg~0-0ubuntu49.18~dfsg~0-0ubuntu19.18~dfsg~0-0ubuntu29.18~dfsg~0-0ubuntu2.29.18~dfsg~0-0ubuntu2.39.18~dfsg~0-0ubuntu2.4 |
9.18~dfsg~0-0ubuntu2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-3272-2 is a vulnerability with no CVSS score yet in ghostscript, published May 16, 2017. No source lists public exploit code. Fixed in ghostscript 9.10~dfsg-0ubuntu10.9.