CVE-2017-7207

La función mem_get_bits_rectangle en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio ( referencia puntero NULL) a través de un documento PostScript manipulado.

A NULL pointer dereference flaw was found in ghostscript's mem_get_bits_rectangle function. A specially crafted postscript document could cause a crash in the context of the gs process.

An update that fixes 5 vulnerabilities is now available. This update for ghostscript fixes the following security vulnerabilities. A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. An integer overflow in the bundled jbig2dec library could have been misused to cause a Denial-of-Service. A NULL pointer dereference in the PDF Transparency module allowed remote attackers to cause a Denial-of-Service. A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document. A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document.