The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-97:01 advisory.

    Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the     Ghostscript library, which implements the graphics capabilities in the PostScript language) and an     interpreter for Portable Document Format (PDF) files. Ghostscript translates PostScript code into many     common, bitmapped formats, like those understood by your printer or screen. Ghostscript is normally used     to display PostScript files and to print PostScript files to non-PostScript printers.
    If you need to display PostScript files or print them to non-PostScript printers, you should install     ghostscript. If you install ghostscript, you also need to install the ghostscript-fonts package.
    Security issues fixed with this release:
    CVE-2009-3743     Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before     8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory     corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based     buffer overflow.
    CVE-2010-2055     Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows     local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support     for the -P- option to the gs program.
    CVE-2010-4054     The gs_type2_interpret function in Ghostscript allows remote attackers to cause a denial of service     (incorrect pointer dereference and application crash) via crafted font data in a compressed data stream,     aka bug 691043.
    CVE-2010-4820     No description available at the time of writing, use the CVE link.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated ghostscript packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.

An integer overflow flaw was found in Ghostscript's TrueType bytecode interpreter. An attacker could create a specially crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2009-3743)

It was found that Ghostscript always tried to read Ghostscript system initialization files from the current working directory before checking other directories, even if a search path that did not contain the current working directory was specified with the '-I' option, or the '-P-' option was used (to prevent the current working directory being searched first). If a user ran Ghostscript in an attacker-controlled directory containing a system initialization file, it could cause Ghostscript to execute arbitrary PostScript code.
(CVE-2010-2055)

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

Users of Ghostscript are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2012:0096 :

Updated ghostscript packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

Users of Ghostscript are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

Users of Ghostscript are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2012-100:01 advisory.

    Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the     Ghostscript library, which implements the graphics capabilities in the PostScript language) and an     interpreter for Portable Document Format (PDF) files. Ghostscript translates PostScript code into many     common, bitmapped formats, like those understood by your printer or screen. Ghostscript is normally used     to display PostScript files and to print PostScript files to non-PostScript printers.
    If you need to display PostScript files or print them to non-PostScript printers, you should install     ghostscript. If you install ghostscript, you also need to install the ghostscript-fonts package.
    Security issues fixed with this release:
    CVE-2009-3743     Off-by-one error in the Ins_MINDEX function in the TrueType bytecode interpreter in Ghostscript before     8.71 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory     corruption) via a malformed TrueType font in a document that trigger an integer overflow and a heap-based     buffer overflow.
    CVE-2010-2055     Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows     local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support     for the -P- option to the gs program.
    CVE-2010-4054     The gs_type2_interpret function in Ghostscript allows remote attackers to cause a denial of service     (incorrect pointer dereference and application crash) via crafted font data in a compressed data stream,     aka bug 691043.
    CVE-2010-4820     No description available at the time of writing, use the CVE link.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated ghostscript packages that fix two security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

Users of Ghostscript are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0095 advisory.

    - Applied upstream fix to last patch (CVE-2010-4054, bug #646086).
    - Applied patch to prevent null pointer dereference (CVE-2010-4054,       bug #646086).
    - Don't ship patch backup files for CVE-2010-2055.
    - Applied patch to prevent integer underflow in TrueType bytecode       interpreter (CVE-2009-3743, bug #627902).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0095 advisory.

    Ghostscript is a set of software that provides a PostScript interpreter, a     set of C procedures (the Ghostscript library, which implements the graphics     capabilities in the PostScript language) and an interpreter for Portable     Document Format (PDF) files.

    An integer overflow flaw was found in Ghostscript's TrueType bytecode     interpreter. An attacker could create a specially-crafted PostScript or PDF     file that, when interpreted, could cause Ghostscript to crash or,     potentially, execute arbitrary code. (CVE-2009-3743)

    It was found that Ghostscript always tried to read Ghostscript system     initialization files from the current working directory before checking     other directories, even if a search path that did not contain the current     working directory was specified with the -I option, or the -P- option     was used (to prevent the current working directory being searched first).
    If a user ran Ghostscript in an attacker-controlled directory containing a     system initialization file, it could cause Ghostscript to execute arbitrary     PostScript code. (CVE-2010-2055)

    Ghostscript included the current working directory in its library search     path by default. If a user ran Ghostscript without the -P- option in an     attacker-controlled directory containing a specially-crafted PostScript     library file, it could cause Ghostscript to execute arbitrary PostScript     code. With this update, Ghostscript no longer searches the current working     directory for library files by default. (CVE-2010-4820)

    Note: The fix for CVE-2010-4820 could possibly break existing     configurations. To use the previous, vulnerable behavior, run Ghostscript     with the -P option (to always search the current working directory     first).

    A flaw was found in the way Ghostscript interpreted PostScript Type 1 and     PostScript Type 2 font files. An attacker could create a specially-crafted     PostScript Type 1 or PostScript Type 2 font file that, when interpreted,     could cause Ghostscript to crash or, potentially, execute arbitrary code.
    (CVE-2010-4054)

    Users of Ghostscript are advised to upgrade to these updated packages,     which contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.

An integer overflow flaw was found in Ghostscript's TrueType bytecode interpreter. An attacker could create a specially crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2009-3743)

It was found that Ghostscript always tried to read Ghostscript system initialization files from the current working directory before checking other directories, even if a search path that did not contain the current working directory was specified with the '-I' option, or the '-P-' option was used (to prevent the current working directory being searched first). If a user ran Ghostscript in an attacker-controlled directory containing a system initialization file, it could cause Ghostscript to execute arbitrary PostScript code.
(CVE-2010-2055)

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

Users of Ghostscript are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

An integer overflow flaw was found in Ghostscript's TrueType bytecode interpreter. An attacker could create a specially crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2009-3743)

It was found that Ghostscript always tried to read Ghostscript system initialization files from the current working directory before checking other directories, even if a search path that did not contain the current working directory was specified with the '-I' option, or the '-P-' option was used (to prevent the current working directory being searched first). If a user ran Ghostscript in an attacker-controlled directory containing a system initialization file, it could cause Ghostscript to execute arbitrary PostScript code.
(CVE-2010-2055)

Ghostscript included the current working directory in its library search path by default. If a user ran Ghostscript without the '-P-' option in an attacker-controlled directory containing a specially crafted PostScript library file, it could cause Ghostscript to execute arbitrary PostScript code. With this update, Ghostscript no longer searches the current working directory for library files by default.
(CVE-2010-4820)

Note: The fix for CVE-2010-4820 could possibly break existing configurations. To use the previous, vulnerable behavior, run Ghostscript with the '-P' option (to always search the current working directory first).

A flaw was found in the way Ghostscript interpreted PostScript Type 1 and PostScript Type 2 font files. An attacker could create a specially crafted PostScript Type 1 or PostScript Type 2 font file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code. (CVE-2010-4054)

ID	Name	Product	Family	Published	Updated	Severity
291487	MiracleLinux 3 : ghostscript-8.70-6.6.0.1.AXS3 (AXSA:2012-97:01)	Nessus	Miracle Linux Local Security Checks	1/19/2026	1/19/2026	high
57809	CentOS 5 / 6 : ghostscript (CESA-2012:0095)	Nessus	CentOS Local Security Checks	2/3/2012	1/4/2021	high
68451	Oracle Linux 4 : ghostscript (ELSA-2012-0096)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
61235	Scientific Linux Security Update : ghostscript on SL4.x i386/x86_64 (20120202)	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
284365	MiracleLinux 4 : ghostscript-8.70-11.AXS4.6 (AXSA:2012-100:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	high
57823	RHEL 4 : ghostscript (RHSA-2012:0096)	Nessus	Red Hat Local Security Checks	2/3/2012	1/14/2021	medium
68450	Oracle Linux 5 / 6 : ghostscript (ELSA-2012-0095)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	high
57810	CentOS 4 : ghostscript (CESA-2012:0096)	Nessus	CentOS Local Security Checks	2/3/2012	1/4/2021	medium
57822	RHEL 6 : ghostscript (RHSA-2012:0095)	Nessus	Red Hat Local Security Checks	2/3/2012	4/14/2025	high
61236	Scientific Linux Security Update : ghostscript on SL5.x, SL6.x i386/x86_64 (20120202)	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
69649	Amazon Linux AMI : ghostscript (ALAS-2012-42)	Nessus	Amazon Linux Local Security Checks	9/4/2013	4/18/2018	high

Detections

Analytics

Plugins Search

high

high

medium

medium

high

medium

high

medium

high

high

high