Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and     consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
    (CVE-2016-7977)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update for ghostscript is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* It was found that the ghostscript functions getenv, filenameforall and .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable, list directory and retrieve file content respectively, from the target. (CVE-2013-5653, CVE-2016-7977)

* It was found that the ghostscript function .initialize_dsc_parser did not validate its parameter before using it, allowing a type confusion flaw. A specially crafted postscript document could cause a crash code execution in the context of the gs process. (CVE-2016-7979)

* It was found that ghostscript did not sufficiently check the validity of parameters given to the .sethalftone5 function. A specially crafted postscript document could cause a crash, or execute arbitrary code in the context of the gs process. (CVE-2016-8602)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for ghostscript is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* It was found that the ghostscript functions getenv, filenameforall and .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable, list directory and retrieve file content respectively, from the target. (CVE-2013-5653, CVE-2016-7977)

* It was found that the ghostscript function .setdevice suffered a use-after-free vulnerability due to an incorrect reference count. A specially crafted postscript document could trigger code execution in the context of the gs process. (CVE-2016-7978)

* It was found that the ghostscript function .initialize_dsc_parser did not validate its parameter before using it, allowing a type confusion flaw. A specially crafted postscript document could cause a crash code execution in the context of the gs process. (CVE-2016-7979)

* It was found that ghostscript did not sufficiently check the validity of parameters given to the .sethalftone5 function. A specially crafted postscript document could cause a crash, or execute arbitrary code in the context of the gs process. (CVE-2016-8602)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that the ghostscript functions getenv,     filenameforall and .libfile did not honor the -dSAFER     option, usually used when processing untrusted     documents, leading to information disclosure. A     specially crafted postscript document could read     environment variable, list directory and retrieve file     content respectively, from the target. (CVE-2013-5653,     CVE-2016-7977)

  - It was found that the ghostscript function .setdevice     suffered a use-after-free vulnerability due to an     incorrect reference count. A specially crafted     postscript document could trigger code execution in the     context of the gs process. (CVE-2016-7978)

  - It was found that the ghostscript function     .initialize_dsc_parser did not validate its parameter     before using it, allowing a type confusion flaw. A     specially crafted postscript document could cause a     crash code execution in the context of the gs process.
    (CVE-2016-7979)

  - It was found that ghostscript did not sufficiently     check the validity of parameters given to the     .sethalftone5 function. A specially crafted postscript     document could cause a crash, or execute arbitrary code     in the context of the gs process. (CVE-2016-8602)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201702-31 (GPL Ghostscript: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GPL Ghostscript and the       bundled OpenJPEG. Please review the CVE identifiers and GLSA-201612-26       (OpenJPEG) referenced below for additional information.
    Note: GPL Ghostscript in Gentoo since app-text/ghostscript-gpl-9.20-r1       no longer bundles OpenJPEG.
  Impact :

    A context-dependent attacker could entice a user to open a specially       crafted PostScript file or PDF using GPL Ghostscript possibly resulting       in the execution of arbitrary code with the privileges of the process or       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

It was found that the ghostscript functions getenv, filenameforall and .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable, list directory and retrieve file content respectively, from the target. (CVE-2013-5653 , CVE-2016-7977)

It was found that the ghostscript function .initialize_dsc_parser did not validate its parameter before using it, allowing a type confusion flaw. A specially crafted postscript document could cause a crash code execution in the context of the gs process. (CVE-2016-7979)

It was found that ghostscript did not sufficiently check the validity of parameters given to the .sethalftone5 function. A specially crafted postscript document could cause a crash, or execute arbitrary code in the context of the gs process. (CVE-2016-8602)

An update for ghostscript is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* It was found that the ghostscript functions getenv, filenameforall and .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable, list directory and retrieve file content respectively, from the target. (CVE-2013-5653, CVE-2016-7977)

* It was found that the ghostscript function .initialize_dsc_parser did not validate its parameter before using it, allowing a type confusion flaw. A specially crafted postscript document could cause a crash code execution in the context of the gs process. (CVE-2016-7979)

* It was found that ghostscript did not sufficiently check the validity of parameters given to the .sethalftone5 function. A specially crafted postscript document could cause a crash, or execute arbitrary code in the context of the gs process. (CVE-2016-8602)

An update for ghostscript is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* It was found that the ghostscript functions getenv, filenameforall and .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could read environment variable, list directory and retrieve file content respectively, from the target. (CVE-2013-5653, CVE-2016-7977)

* It was found that the ghostscript function .setdevice suffered a use-after-free vulnerability due to an incorrect reference count. A specially crafted postscript document could trigger code execution in the context of the gs process. (CVE-2016-7978)

* It was found that the ghostscript function .initialize_dsc_parser did not validate its parameter before using it, allowing a type confusion flaw. A specially crafted postscript document could cause a crash code execution in the context of the gs process. (CVE-2016-7979)

* It was found that ghostscript did not sufficiently check the validity of parameters given to the .sethalftone5 function. A specially crafted postscript document could cause a crash, or execute arbitrary code in the context of the gs process. (CVE-2016-8602)

Security Fix(es) :

  - It was found that the ghostscript functions getenv,     filenameforall and .libfile did not honor the -dSAFER     option, usually used when processing untrusted     documents, leading to information disclosure. A     specially crafted postscript document could read     environment variable, list directory and retrieve file     content respectively, from the target. (CVE-2013-5653,     CVE-2016-7977)

  - It was found that the ghostscript function .setdevice     suffered a use- after-free vulnerability due to an     incorrect reference count. A specially crafted     postscript document could trigger code execution in the     context of the gs process. (CVE-2016-7978)

  - It was found that the ghostscript function     .initialize_dsc_parser did not validate its parameter     before using it, allowing a type confusion flaw. A     specially crafted postscript document could cause a     crash code execution in the context of the gs process.
    (CVE-2016-7979)

  - It was found that ghostscript did not sufficiently check     the validity of parameters given to the .sethalftone5     function. A specially crafted postscript document could     cause a crash, or execute arbitrary code in the context     of the gs process. (CVE-2016-8602)

Security Fix(es) :

  - It was found that the ghostscript functions getenv,     filenameforall and .libfile did not honor the -dSAFER     option, usually used when processing untrusted     documents, leading to information disclosure. A     specially crafted postscript document could read     environment variable, list directory and retrieve file     content respectively, from the target. (CVE-2013-5653,     CVE-2016-7977)

  - It was found that the ghostscript function     .initialize_dsc_parser did not validate its parameter     before using it, allowing a type confusion flaw. A     specially crafted postscript document could cause a     crash code execution in the context of the gs process.
    (CVE-2016-7979)

  - It was found that ghostscript did not sufficiently check     the validity of parameters given to the .sethalftone5     function. A specially crafted postscript document could     cause a crash, or execute arbitrary code in the context     of the gs process. (CVE-2016-8602)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Added security fixes for :

  - CVE-2013-5653 (bug #1380327)

  - CVE-2016-7977 (bug #1380415)

  - CVE-2016-7979 (bug #1382305)

  - CVE-2016-8602 (bug #1383940)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0014 advisory.

    [8.70-21_1]
    - Added security fixes for:
      - CVE-2013-5653 (bug #1380327)
      - CVE-2016-7977 (bug #1380415)
      - CVE-2016-7979 (bug #1382305)
      - CVE-2016-8602 (bug #1383940)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0013 advisory.

    [9.07-20_1]
    - Added security fixes for:
      - CVE-2013-5653 (bug #1380327)
      - CVE-2016-7977 (bug #1380415)
      - CVE-2016-7978 (bug #1382300)
      - CVE-2016-7979 (bug #1382305)
      - CVE-2016-8602 (bug #1383940)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3148-1 advisory.

    Tavis Ormandy discovered multiple vulnerabilities in the way that Ghostscript processes certain Postscript     files. If a user or automated system were tricked into opening a specially crafted file, an attacker could     cause a denial of service or possibly execute arbitrary code. (CVE-2016-7976, CVE-2016-7978,     CVE-2016-7979, CVE-2016-8602)

    Multiple vulnerabilities were discovered in Ghostscript related to information disclosure. If a user or     automated system were tricked into opening a specially crafted file, an attacker could expose sensitive     data. (CVE-2013-5653, CVE-2016-7977)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes a rare ocasion where ghostscript would fail when displaying *.ps files. More info can be found [here](http://bugs.ghostscript.com/show_bug.cgi?id=697286).

----

This is a security update for these CVEs :

  -     [CVE-2016-8602](https://bugzilla.redhat.com/show_bug.cgi     ?id=1383940) - *check for sufficient params in     .sethalftone5*

  -     [CVE-2016-7977](https://bugzilla.redhat.com/show_bug.cgi     ?id=1380415) - *.libfile does not honor -dSAFER* [This     CVE is now correctly fixed, previous release was     accidentally missing the fix.]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is a security update for these CVEs :

  -     [CVE-2016-8602](https://bugzilla.redhat.com/show_bug.cgi     ?id=1383940) - *check for sufficient params in     .sethalftone5*

  -     [CVE-2016-7977](https://bugzilla.redhat.com/show_bug.cgi     ?id=1380415) - *.libfile does not honor -dSAFER* [This     CVE is now correctly fixed, previous release was     accidentally missing the fix.]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is a rebase of **ghostscript** package, to address several security issues :

  - [CVE-2016-7977     ](https://bugzilla.redhat.com/show_bug.cgi?id=1380415) -
    *.libfile does not honor -dSAFER*

  -     [CVE-2013-5653](https://bugzilla.redhat.com/show_bug.cgi     ?id=1380327) - *getenv and filenameforall ignore
    -dSAFER*

  -     [CVE-2016-7976](https://bugzilla.redhat.com/show_bug.cgi     ?id=1382294) - *various userparams allow %pipe% in     paths, allowing remote shell*

  -     [CVE-2016-7978](https://bugzilla.redhat.com/show_bug.cgi     ?id=1382300) - *reference leak in .setdevice allows     use-after-free and remote code*

  -     [CVE-2016-7979](https://bugzilla.redhat.com/show_bug.cgi     ?id=1382305) - *Type confusion in .initialize_dsc_parser     allows remote code execution*

----------- #### INFORMATION FOR FEDORA PACKAGERS & MAINTAINERS :

**ghostscript** has been rebased to latest upstream version (9.20).
Rebase notes :

  - **no API/ABI changes between versions 9.16 -> 9.20     according to upstream**

  - *OpenJPEG* support has been retained

  - *ijs-config* custom tool from upstream has been
    *removed* (by upstream) (*pkg-config* is used by default     now instead, see [commit     0c176a9](http://git.ghostscript.com/?p=ghostpdl.git;h=0c     176a91d53c85cda))

  - some patches were updated to 'git format-patch' format &     renamed

  - rest of the patches were deleted (irrelevant for current     version), mostly because upstream has fixed those issues     in some way

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may lead to the execution of arbitrary code or information disclosure if a specially crafted Postscript file is processed.

This update for ghostscript-library fixes the following issues :

  - Multiple security vulnerabilities have been discovered     where ghostscript's '-dsafer' flag did not provide     sufficient protection against unintended access to the     file system. Thus, a machine that would process a     specially crafted Postscript file would potentially leak     sensitive information to an attacker. (CVE-2013-5653,     CVE-2016-7977, bsc#1001951)

  - Insufficient validation of the type of input in     .initialize_dsc_parser used to allow remote code     execution. (CVE-2016-7979, bsc#1001951)

  - An integer overflow in the gs_heap_alloc_bytes function     used to allow remote attackers to cause a denial of     service (crash) via specially crafted Postscript files.
    (CVE-2015-3228, boo#939342)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
219940	Linux Distros Unpatched Vulnerability : CVE-2016-7977	Nessus	Misc.	medium
101400	Virtuozzo 6 : ghostscript / ghostscript-devel / ghostscript-doc / etc (VZLSA-2017-0014)	Nessus	Virtuozzo Local Security Checks	critical
101399	Virtuozzo 7 : ghostscript / ghostscript-cups / ghostscript-devel / etc (VZLSA-2017-0013)	Nessus	Virtuozzo Local Security Checks	critical
99813	EulerOS 2.0 SP1 : ghostscript (EulerOS-SA-2016-1050)	Nessus	Huawei Local Security Checks	critical
97343	GLSA-201702-31 : GPL Ghostscript: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
96395	Amazon Linux AMI : ghostscript (ALAS-2017-784)	Nessus	Amazon Linux Local Security Checks	critical
96309	RHEL 6 : ghostscript (RHSA-2017:0014)	Nessus	Red Hat Local Security Checks	critical
96308	RHEL 7 : ghostscript (RHSA-2017:0013)	Nessus	Red Hat Local Security Checks	critical
96302	Scientific Linux Security Update : ghostscript on SL7.x x86_64 (20170104)	Nessus	Scientific Linux Local Security Checks	critical
96301	Scientific Linux Security Update : ghostscript on SL6.x i386/x86_64 (20170104)	Nessus	Scientific Linux Local Security Checks	critical
96300	OracleVM 3.3 / 3.4 : ghostscript (OVMSA-2017-0002)	Nessus	OracleVM Local Security Checks	critical
96299	Oracle Linux 6 : ghostscript (ELSA-2017-0014)	Nessus	Oracle Linux Local Security Checks	critical
96298	Oracle Linux 7 : ghostscript (ELSA-2017-0013)	Nessus	Oracle Linux Local Security Checks	critical
96286	CentOS 6 : ghostscript (CESA-2017:0014)	Nessus	CentOS Local Security Checks	critical
96285	CentOS 7 : ghostscript (CESA-2017:0013)	Nessus	CentOS Local Security Checks	critical
95467	Ubuntu 14.04 LTS / 16.04 LTS : Ghostscript vulnerabilities (USN-3148-1)	Nessus	Ubuntu Local Security Checks	critical
95300	Fedora 23 : ghostscript (2016-15d4c05a19)	Nessus	Fedora Local Security Checks	high
95004	Fedora 25 : ghostscript (2016-62f2b66ed1)	Nessus	Fedora Local Security Checks	high
94786	Fedora 25 : ghostscript (2016-2df27a2224)	Nessus	Fedora Local Security Checks	critical
94615	Fedora 24 : ghostscript (2016-3dad5dfd03)	Nessus	Fedora Local Security Checks	high
94121	Fedora 24 : ghostscript (2016-53e8aa35f6)	Nessus	Fedora Local Security Checks	critical
94119	Fedora 23 : ghostscript (2016-1c13825502)	Nessus	Fedora Local Security Checks	critical
94023	Debian DSA-3691-1 : ghostscript - security update	Nessus	Debian Local Security Checks	critical
94007	SUSE SLES11 Security Update : ghostscript-library (SUSE-SU-2016:2493-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2016-7977

medium

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical

high

critical

critical

critical

critical