CVE-2016-10220

La función gs_makewordimagedevice en base/gsdevmem.c en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio (referencia al puntero NULL y caída de la aplicación) a través de un archivo manipulado que no es manejado correctamente en el modulo PDF Transparency.

An update that fixes 5 vulnerabilities is now available. This update for ghostscript fixes the following security vulnerabilities. A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. An integer overflow in the bundled jbig2dec library could have been misused to cause a Denial-of-Service. A NULL pointer dereference in the PDF Transparency module allowed remote attackers to cause a Denial-of-Service. A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document. A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document.