Vulnerability Details : CVE-2016-7979
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.
Vulnerability category: Execute code
Products affected by CVE-2016-7979
- cpe:2.3:a:artifex:ghostscript:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-7979
10.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-7979
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2016-7979
-
The product does not correctly convert an object, resource, or structure from one type to a different type.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-7979
-
http://git.ghostscript.com/?p=ghostpdl.git;h=875a0095f37626a721c7ff57d606a0f95af03913
git.ghostscript.com Git - ghostpdl.git/commitPatch
-
http://www.openwall.com/lists/oss-security/2016/10/05/15
oss-security - Re: CVE Request - multiple ghostscript -dSAFER sandbox problemsMailing List;Patch
-
http://www.debian.org/security/2016/dsa-3691
Debian -- Security Information -- DSA-3691-1 ghostscript
-
https://security.gentoo.org/glsa/201702-31
GPL Ghostscript: Multiple vulnerabilities (GLSA 201702-31) — Gentoo security
-
http://rhn.redhat.com/errata/RHSA-2017-0014.html
RHSA-2017:0014 - Security Advisory - Red Hat Customer Portal
-
https://bugs.ghostscript.com/show_bug.cgi?id=697190
697190 – .initialize_dsc_parser doesn't validate the parameter is a dict type before using it.Issue Tracking;Patch
-
http://www.securityfocus.com/bid/95337
Ghostscript CVE-2016-7979 Remote Code Execution VulnerabilityThird Party Advisory;VDB Entry
-
http://rhn.redhat.com/errata/RHSA-2017-0013.html
RHSA-2017:0013 - Security Advisory - Red Hat Customer Portal
Jump to