According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The mem_get_bits_rectangle function in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (NULL pointer dereference)     via a crafted PostScript document.(CVE-2017-7207)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for ghostscript is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* A NULL pointer dereference flaw was found in ghostscript's mem_get_bits_rectangle function. A specially crafted postscript document could cause a crash in the context of the gs process.
(CVE-2017-7207)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2183:05 advisory.

    Ghostscript is a set of software that provides a PostScript     interpreter, a set of C procedures (the Ghostscript library, which     implements the graphics capabilities in the PostScript language) and     an interpreter for Portable Document Format (PDF) files. Ghostscript     translates PostScript code into many common, bitmapped formats, like     those understood by your printer or screen. Ghostscript is normally     used to display PostScript files and to print PostScript files to     non-PostScript printers.
    If you need to display PostScript files or print them to     non-PostScript printers, you should install ghostscript. If you     install ghostscript, you also need to install the ghostscript-fonts     package.
    CVE-2017-7207     The mem_get_bits_rectangle function in Artifex Software, Inc.
    Ghostscript 9.20 allows remote attackers to cause a denial of service     (NULL pointer dereference) via a crafted PostScript document.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for [CVE-2017-7207](https://bugzilla.redhat.com/show_bug.cgi?id=1434353).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201708-06 (GPL Ghostscript: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GPL Ghostscript. Please       review the CVE identifiers referenced below for additional information.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted PostScript file or PDF document using GPL Ghostscript possibly       resulting in the execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for ghostscript fixes the following security vulnerabilities :

  - CVE-2017-8291: A remote command execution and a -dSAFER     bypass via a crafted .eps document were exploited in the     wild. (bsc#1036453)

  - CVE-2016-9601: An integer overflow in the bundled     jbig2dec library could have been misused to cause a     Denial-of-Service. (bsc#1018128)

  - CVE-2016-10220: A NULL pointer dereference in the PDF     Transparency module allowed remote attackers to cause a     Denial-of-Service. (bsc#1032120)

  - CVE-2017-5951: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1032114)

  - CVE-2017-7207: A NULL pointer dereference allowed remote     attackers to cause a denial of service via a crafted     PostScript document. (bsc#1030263)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102232	EulerOS 2.0 SP2 : ghostscript (EulerOS-SA-2017-1145)	Nessus	Huawei Local Security Checks	2017/8/8	2025/12/4	medium
102754	CentOS 7 : ghostscript (CESA-2017:2180)	Nessus	CentOS Local Security Checks	2017/8/25	2021/1/4	medium
291582	MiracleLinux 7 : ghostscript-9.07-28.el7 (AXSA:2017-2183:05)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	medium
99255	Fedora 25 : ghostscript (2017-047cffb598)	Nessus	Fedora Local Security Checks	2017/4/10	2025/12/26	medium
102618	GLSA-201708-06 : GPL Ghostscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/8/21	2025/11/26	high
99761	SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2017:1138-1)	Nessus	SuSE Local Security Checks	2017/5/1	2025/12/23	high

检测

插件搜索

medium

medium

medium

medium

high

high