CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-11645 – ghostscript: status command permitted with -dSAFER in psi/zfile.c allowing attackers to identify the size and existence of files
https://notcve.org/view.php?id=CVE-2018-11645
01 Jun 2018 — psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977. psi/zfile.c en Artifex Ghostscript en versiones anteriores a la 9.21rc1 permite el comando status incluso si se emplea -dSAFER, lo que podría permitir que atacantes remotos determinen la existencia y tamaño de archivos arbitrarios. Este problema es similar a CVE-2016-7977. Ghostscript... • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=b60d50b7567369ad856cebe1efb6cd7dd2284219 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 0CVE-2018-10194 – ghostscript: Stack-based out-of-bounds write in pdf_set_text_matrix function in gdevpdts.c
https://notcve.org/view.php?id=CVE-2018-10194
18 Apr 2018 — The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document. La función set_text_distance en devices/vector/gdevpdts.c en el componente pdfwrite en Artifex Ghostscript, hasta la versión 9.22, no evita los desbordamientos en el cálculo de posi... • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=39b1e54b2968620723bf32e96764c88797714879 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 92%CPEs: 20EXPL: 2CVE-2017-8291 – Artifex Ghostscript Type Confusion Vulnerability
https://notcve.org/view.php?id=CVE-2017-8291
27 Apr 2017 — Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. Artifex Ghostscript permite sobrepasar -dSAFER y la ejecución de comandos remotos a través de una vulnerabilidad de type confusion en .rsdparams con una subcadena "/ OutputFile (% pipe%" en un documento .eps que se utilice como entrada al gs. It was ... • https://www.exploit-db.com/exploits/41955 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10317 – Ubuntu Security Notice USN-3636-1
https://notcve.org/view.php?id=CVE-2016-10317
03 Apr 2017 — The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document. La función fill_threshhold_buffer en base/gxht_thresh.c en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio (desbordamiento de búfer basado en memoria dinámica y caída de la a... • http://www.securityfocus.com/bid/97410 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10217 – Ubuntu Security Notice USN-3272-2
https://notcve.org/view.php?id=CVE-2016-10217
03 Apr 2017 — The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module. La función pdf14_open en base/gdevp14.c en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio (uso después de liberación de memoria y caída de la aplicación) a través de un archivo manipulado que no se maneja cor... • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=90fd0c7ca3efc1ddff64a86f4104b13b3ac969eb • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10219 – Debian Security Advisory 3838-1
https://notcve.org/view.php?id=CVE-2016-10219
03 Apr 2017 — The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file. La función intersect en base/gxfill.c en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio (error de división por cero y caída de la aplicación) a través de un archivo manipulado. USN-3272-1 fixed vulnerabilities in Ghostscript. • http://www.debian.org/security/2017/dsa-3838 • CWE-369: Divide By Zero •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10220 – Debian Security Advisory 3838-1
https://notcve.org/view.php?id=CVE-2016-10220
03 Apr 2017 — The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module. La función gs_makewordimagedevice en base/gsdevmem.c en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio (referencia al puntero NULL y caída de la aplicación) a través de un archivo manip... • http://www.debian.org/security/2017/dsa-3838 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-5951 – Debian Security Advisory 3838-1
https://notcve.org/view.php?id=CVE-2017-5951
03 Apr 2017 — The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. La función mem_get_bits_rectangle en base/gdevmem.c en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio (referencia al puntero NULL y caída de la aplicación) a través de un archivo manipulado. It was discovered that Ghostscript improperly... • http://www.debian.org/security/2017/dsa-3838 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2016-10218
https://notcve.org/view.php?id=CVE-2016-10218
03 Apr 2017 — The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. La función pdf14_pop_transparency_group en base/gdevp14.c en el modulo the PDF Transparency en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio (referencia al puntero NULL y caída de la aplicación) a t... • http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=d621292fb2c8157d9899dcd83fd04dd250e30fe4 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7207 – ghostscript: NULL pointer dereference in mem_get_bits_rectangle()
https://notcve.org/view.php?id=CVE-2017-7207
21 Mar 2017 — The mem_get_bits_rectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document. La función mem_get_bits_rectangle en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio ( referencia puntero NULL) a través de un documento PostScript manipulado. A NULL pointer dereference flaw was found in ghostscript's mem_get_bits_rectangle function. • http://www.debian.org/security/2017/dsa-3838 • CWE-476: NULL Pointer Dereference •