CVE-2017-7207
ghostscript: NULL pointer dereference in mem_get_bits_rectangle()
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The mem_get_bits_rectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document.
La función mem_get_bits_rectangle en Artifex Software, Inc. Ghostscript 9.20 permite a atacantes remotos provocar una denegación de servicio ( referencia puntero NULL) a través de un documento PostScript manipulado.
A NULL pointer dereference flaw was found in ghostscript's mem_get_bits_rectangle function. A specially crafted postscript document could cause a crash in the context of the gs process.
It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby allowing the execution of arbitrary code, or cause a denial of service. Kamil Frankowicz discovered a use-after-free vulnerability in the color management module of Ghostscript. An attacker could use this to cause a denial of service. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-03-21 CVE Reserved
- 2017-03-21 CVE Published
- 2024-08-05 CVE Updated
- 2025-03-28 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-476: NULL Pointer Dereference
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/96995 | Third Party Advisory | |
| http://www.securitytracker.com/id/1039071 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.ghostscript.com/cgi-bin/findgit.cgi?309eca4e0a31ea70dcc844812691439312dad091 | 2018-01-05 | |
| https://bugs.ghostscript.com/show_bug.cgi?id=697676 | 2018-01-05 |
| URL | Date | SRC |
|---|---|---|
| http://www.debian.org/security/2017/dsa-3838 | 2018-01-05 | |
| https://access.redhat.com/errata/RHSA-2017:2180 | 2018-01-05 | |
| https://security.gentoo.org/glsa/201708-06 | 2018-01-05 | |
| https://access.redhat.com/security/cve/CVE-2017-7207 | 2017-08-01 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1434353 | 2017-08-01 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Artifex Search vendor "Artifex" | Ghostscript Search vendor "Artifex" for product "Ghostscript" | 9.20 Search vendor "Artifex" for product "Ghostscript" and version "9.20" | - |
Affected
| ||||||