Security Fix(es) :

  - A NULL pointer dereference flaw was found in     ghostscript's mem_get_bits_rectangle function. A     specially crafted postscript document could cause a     crash in the context of the gs process. (CVE-2017-7207)

This update for ghostscript fixes the following security vulnerabilities :

  - CVE-2017-8291: A remote command execution and a -dSAFER     bypass via a crafted .eps document were exploited in the     wild. (bsc#1036453)

  - CVE-2016-9601: An integer overflow in the bundled     jbig2dec library could have been misused to cause a     Denial-of-Service. (bsc#1018128)

  - CVE-2016-10220: A NULL pointer dereference in the PDF     Transparency module allowed remote attackers to cause a     Denial-of-Service. (bsc#1032120)

  - CVE-2017-5951: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1032114)

  - CVE-2017-7207: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1030263) This is a reissue of     the previous update to also include SUSE Linux     Enterprise 12 GA LTSS packages.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ghostscript-library fixes several issues. These security issues were fixed :

  - CVE-2017-7207: The mem_get_bits_rectangle function     allowed remote attackers to cause a denial of service     (NULL pointer dereference) via a crafted PostScript     document (bsc#1030263).

  - CVE-2016-9601: Prevent heap-buffer overflow by checking     for an integer overflow in jbig2_image_new function     (bsc#1018128).

  - CVE-2017-9612: The Ins_IP function in base/ttinterp.c     allowed remote attackers to cause a denial of service     (use-after-free and application crash) or possibly have     unspecified other impact via a crafted document     (bsc#1050891)

  - CVE-2017-9726: The Ins_MDRP function in base/ttinterp.c     allowed remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) or     possibly have unspecified other impact via a crafted     document (bsc#1050889)

  - CVE-2017-9727: The gx_ttfReader__Read function in     base/gxttfb.c allowed remote attackers to cause a denial     of service (heap-based buffer over-read and application     crash) or possibly have unspecified other impact via a     crafted document (bsc#1050888)

  - CVE-2017-9739: The Ins_JMPR function in base/ttinterp.c     allowed remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) or     possibly have unspecified other impact via a crafted     document (bsc#1050887)

  - CVE-2017-11714: psi/ztoken.c mishandled references to     the scanner state structure, which allowed remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted PostScript document, related to an out-of-bounds     read in the igc_reloc_struct_ptr function in psi/igc.c     (bsc#1051184)

  - CVE-2017-9835: The gs_alloc_ref_array function allowed     remote attackers to cause a denial of service     (heap-based buffer overflow and application crash) or     possibly have unspecified other impact via a crafted     PostScript document (bsc#1050879)

  - CVE-2016-10219: The intersect function in base/gxfill.c     allowed remote attackers to cause a denial of service     (divide-by-zero error and application crash) via a     crafted file (bsc#1032138)

  - CVE-2017-9216: Prevent NULL pointer dereference in the     jbig2_huffman_get function in jbig2_huffman.c which     allowed for DoS (bsc#1040643)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ghostscript fixes the following security vulnerabilities :

CVE-2017-8291: A remote command execution and a -dSAFER bypass via a crafted .eps document were exploited in the wild. (bsc#1036453)

CVE-2016-9601: An integer overflow in the bundled jbig2dec library could have been misused to cause a Denial-of-Service. (bsc#1018128)

CVE-2016-10220: A NULL pointer dereference in the PDF Transparency module allowed remote attackers to cause a Denial-of-Service.
(bsc#1032120)

CVE-2017-5951: A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document.
(bsc#1032114)

CVE-2017-7207: A NULL pointer dereference allowed remote attackers to cause a denial of service via a crafted PostScript document.
(bsc#1030263)

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3272-1 advisory.

    It was discovered that Ghostscript improperly handled parameters to the rsdparams and eqproc commands. An     attacker could use these to craft a malicious document that could disable -dSAFER protections, thereby     allowing the execution of arbitrary code, or cause a denial of service (application crash).
    (CVE-2017-8291)

    Kamil Frankowicz discovered a use-after-free vulnerability in the color management module of Ghostscript.
    An attacker could use this to cause a denial of service (application crash). (CVE-2016-10217)

    Kamil Frankowicz discovered a divide-by-zero error in the scan conversion code in Ghostscript. An attacker     could use this to cause a denial of service (application crash). (CVE-2016-10219)

    Kamil Frankowicz discovered multiple NULL pointer dereference errors in Ghostscript. An attacker could use     these to cause a denial of service (application crash). (CVE-2016-10220, CVE-2017-5951, CVE-2017-7207)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The mem_get_bits_rectangle function in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (NULL pointer dereference)     via a crafted PostScript document.(CVE-2017-7207)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for ghostscript is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* A NULL pointer dereference flaw was found in ghostscript's mem_get_bits_rectangle function. A specially crafted postscript document could cause a crash in the context of the gs process.
(CVE-2017-7207)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Security fix for [CVE-2017-7207](https://bugzilla.redhat.com/show_bug.cgi?id=1434353).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2183:05 advisory.

    Ghostscript is a set of software that provides a PostScript     interpreter, a set of C procedures (the Ghostscript library, which     implements the graphics capabilities in the PostScript language) and     an interpreter for Portable Document Format (PDF) files. Ghostscript     translates PostScript code into many common, bitmapped formats, like     those understood by your printer or screen. Ghostscript is normally     used to display PostScript files and to print PostScript files to     non-PostScript printers.
    If you need to display PostScript files or print them to     non-PostScript printers, you should install ghostscript. If you     install ghostscript, you also need to install the ghostscript-fonts     package.
    CVE-2017-7207     The mem_get_bits_rectangle function in Artifex Software, Inc.
    Ghostscript 9.20 allows remote attackers to cause a denial of service     (NULL pointer dereference) via a crafted PostScript document.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201708-06 (GPL Ghostscript: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GPL Ghostscript. Please       review the CVE identifiers referenced below for additional information.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted PostScript file or PDF document using GPL Ghostscript possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for ghostscript fixes the following security vulnerabilities :

  - CVE-2017-8291: A remote command execution and a -dSAFER     bypass via a crafted .eps document were exploited in the     wild. (bsc#1036453)

  - CVE-2016-9601: An integer overflow in the bundled     jbig2dec library could have been misused to cause a     Denial-of-Service. (bsc#1018128)

  - CVE-2016-10220: A NULL pointer dereference in the PDF     Transparency module allowed remote attackers to cause a     Denial-of-Service. (bsc#1032120)

  - CVE-2017-5951: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1032114)

  - CVE-2017-7207: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1030263)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.06, has ghostscript packages installed that are affected by multiple vulnerabilities:

  - A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter     by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute     arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3781)

  - The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before     1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the     heap via malformed image files, as originally demonstrated using imagemagick convert. (CVE-2007-2721)

  - Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61 and earlier allows     remote attackers to execute arbitrary code via a postscript (.ps) file containing a long Range array in a     .seticcspace operator. (CVE-2008-0411)

  - Heap-based buffer overflow in the big2_decode_symbol_dict function (jbig2_symbol_dict.c) in the JBIG2     decoding library (jbig2dec) in Ghostscript 8.64, and probably earlier versions, allows remote attackers to     execute arbitrary code via a PDF file with a JBIG2 symbol dictionary segment with a large run length     value. (CVE-2009-0196)

  - Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka     icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and     earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and     application crash) or possibly execute arbitrary code by using a device file for a translation request     that operates on a crafted image file and targets a certain native color space, related to an ICC     profile in a (1) PostScript or (2) PDF file with embedded images. (CVE-2009-0583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102663	Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20170802)	Nessus	Scientific Linux Local Security Checks	2017/8/22	2025/11/26	medium
100410	SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2017:1404-1)	Nessus	SuSE Local Security Checks	2017/5/25	2025/12/17	high
109572	SUSE SLES11 Security Update : ghostscript-library (SUSE-SU-2018:1140-1)	Nessus	SuSE Local Security Checks	2018/5/4	2024/10/11	high
100041	openSUSE Security Update : ghostscript (openSUSE-2017-558)	Nessus	SuSE Local Security Checks	2017/5/9	2025/12/19	high
99726	Ubuntu 14.04 LTS / 16.04 LTS : Ghostscript vulnerabilities (USN-3272-1)	Nessus	Ubuntu Local Security Checks	2017/4/28	2025/12/23	high
102231	EulerOS 2.0 SP1 : ghostscript (EulerOS-SA-2017-1144)	Nessus	Huawei Local Security Checks	2017/8/8	2025/12/4	medium
102232	EulerOS 2.0 SP2 : ghostscript (EulerOS-SA-2017-1145)	Nessus	Huawei Local Security Checks	2017/8/8	2025/12/4	medium
102754	CentOS 7 : ghostscript (CESA-2017:2180)	Nessus	CentOS Local Security Checks	2017/8/25	2021/1/4	medium
99255	Fedora 25 : ghostscript (2017-047cffb598)	Nessus	Fedora Local Security Checks	2017/4/10	2025/12/26	medium
291582	MiracleLinux 7 : ghostscript-9.07-28.el7 (AXSA:2017-2183:05)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	medium
102618	GLSA-201708-06 : GPL Ghostscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/8/21	2025/11/26	high
99761	SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2017:1138-1)	Nessus	SuSE Local Security Checks	2017/5/1	2025/12/23	high
330512	NewStart CGSL MAIN 6.06 : ghostscript Multiple Vulnerabilities (NS-SA-2026-0055)	Nessus	NewStart CGSL Local Security Checks	2026/7/29	2026/7/30	critical

检测

插件搜索

medium

high

high

high

high

medium

medium

medium

medium

medium

high

high

critical