The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5643-1 advisory.

  - A heap-based buffer over write vulnerability was found in GhostScript's lp8000_print_page() function in     gdevlp8k.c file. An attacker could trick a user to open a crafted PDF file, triggering the heap buffer     overflow that could lead to memory corruption or a denial of service. (CVE-2020-27792)

  - A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a     large number of bits in memory. When allocating a buffer device, it relies on an init_device_procs defined     for the device that uses it as a prototype that depends upon the number of bits per pixel. For bpp > 64,     mem_x_device is used and does not have an init_device_procs defined. This flaw allows an attacker to parse     a large number of bits (more than 64 bits per pixel), which triggers a NULL pointer dereference flaw,     causing an application to crash. (CVE-2022-2085)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ghostscript: Heap-buffer over-read in the gs_alloc_ref_array function (CVE-2017-9835)

  - ghostscript: buffer overflow in base/sbcp.c leading to data corruption (CVE-2023-28879)

  - The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote     attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is     mishandled in the color management module. (CVE-2016-10217)

  - The pdf14_pop_transparency_group function in base/gdevp14.c in the PDF Transparency module in Artifex     Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted file. (CVE-2016-10218)

  - The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers     to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
    (CVE-2016-10219)

  - The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a     crafted file that is mishandled in the PDF Transparency module. (CVE-2016-10220)

  - The fill_threshhold_buffer function in base/gxht_thresh.c in Artifex Software, Inc. Ghostscript 9.20     allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or     possibly have unspecified other impact via a crafted PostScript document. (CVE-2016-10317)

  - ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the     ghostscript jbig2_decode_gray_scale_image function which is used to decode halftone segments in a JBIG2     image. A document (PostScript or PDF) with an embedded, specially crafted, jbig2 image could trigger a     segmentation fault in ghostscript. (CVE-2016-9601)

  - psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which     allows remote attackers to cause a denial of service (application crash) or possibly have unspecified     other impact via a crafted PostScript document, related to an out-of-bounds read in the     igc_reloc_struct_ptr function in psi/igc.c. (CVE-2017-11714)

  - The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows     remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a     crafted file. (CVE-2017-5951)

  - The mark_line_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a     denial of service (out-of-bounds read) via a crafted PostScript document. (CVE-2017-8908)

  - The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote     attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly     have unspecified other impact via a crafted document. (CVE-2017-9610)

  - The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified     other impact via a crafted document. (CVE-2017-9611)

  - The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact     via a crafted document. (CVE-2017-9612)

  - The xps_load_sfnt_name function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote     attackers to cause a denial of service (buffer overflow and application crash) or possibly have     unspecified other impact via a crafted document. (CVE-2017-9618)

  - The xps_true_callback_glyph_name function in xps/xpsttf.c in Artifex Ghostscript GhostXPS 9.21 allows     remote attackers to cause a denial of service (Segmentation Violation and application crash) via a crafted     file. (CVE-2017-9619)

  - The xps_select_font_encoding function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote     attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly     have unspecified other impact via a crafted document, related to the xps_encode_font_char_imp function.
    (CVE-2017-9620)

  - The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified     other impact via a crafted document. (CVE-2017-9726)

  - The gx_ttfReader__Read function in base/gxttfb.c in Artifex Ghostscript GhostXPS 9.21 allows remote     attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly     have unspecified other impact via a crafted document. (CVE-2017-9727)

  - The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to     cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified     other impact via a crafted document. (CVE-2017-9739)

  - The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote     attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly     have unspecified other impact via a crafted document. (CVE-2017-9740)

  - In Artifex Ghostscript before 9.26, a carefully crafted PDF file can trigger an extremely long running     computation when parsing the file. (CVE-2018-19478)

  - A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16301)

  - A divide by zero issue discovered in eps_print_page in gdevepsn.c in Artifex Software GhostScript 9.50     allows remote attackers to cause a denial of service via opening of crafted PDF file. (CVE-2020-21710)

  - Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex Ghostscript 9.50     allows remote attackers to cause a denial of service or other unspecified impact(s) via opening of crafted     PDF document. (CVE-2020-21890)

  - A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the     gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering     the heap buffer overflow that could lead to memory corruption or a denial of service. (CVE-2020-27792)

  - Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from     sampled_data_continue and interp). (CVE-2021-45944)

  - Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called     from sampled_data_continue and interp). (CVE-2021-45949)

  - A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This     issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN     device with gs. (CVE-2023-38559)

  - An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may     allow a local attacker to cause a denial of service via transforming a crafted PCL file to PDF format.
    (CVE-2023-38560)

  - An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through     10.02.0 allows remote attackers to crash the application via a dangling pointer. (CVE-2023-46751)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3096 advisory.

  - A heap-based buffer over write vulnerability was found in GhostScript's lp8000_print_page() function in     gdevlp8k.c file. An attacker could trick a user to open a crafted PDF file, triggering the heap buffer     overflow that could lead to memory corruption or a denial of service. (CVE-2020-27792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the     gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering     the heap buffer overflow that could lead to memory corruption or a denial of service. (CVE-2020-27792)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5618-1 advisory.

  - A heap-based buffer over write vulnerability was found in GhostScript's lp8000_print_page() function in     gdevlp8k.c file. An attacker could trick a user to open a crafted PDF file, triggering the heap buffer     overflow that could lead to memory corruption or a denial of service. (CVE-2020-27792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1947 advisory.

  - A heap-based buffer over write vulnerability was found in GhostScript's lp8000_print_page() function in     gdevlp8k.c file. An attacker could trick a user to open a crafted PDF file, triggering the heap buffer     overflow that could lead to memory corruption or a denial of service. (CVE-2020-27792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ghostscript installed on the remote host is prior to 8.70-24.27. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1725 advisory.

  - A heap-based buffer over write vulnerability was found in GhostScript's lp8000_print_page() function in     gdevlp8k.c file. An attacker could trick a user to open a crafted PDF file, triggering the heap buffer     overflow that could lead to memory corruption or a denial of service. (CVE-2020-27792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ghostscript packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overwrite vulnerability was found in GhostScript's lp8000_print_page() function in the     gdevlp8k.c file. This flaw allows an attacker to trick a user into opening a crafted PDF file, triggering     the heap buffer overflow that could lead to memory corruption or a denial of service. (CVE-2020-27792)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
165504	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Ghostscript vulnerabilities (USN-5643-1)	Nessus	Ubuntu Local Security Checks	9/27/2022	7/10/2023	high
196587	RHEL 7 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
196514	RHEL 6 : ghostscript (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/13/2024	critical
164676	Debian DLA-3096-1 : ghostscript - LTS security update	Nessus	Debian Local Security Checks	9/4/2022	10/13/2023	high
177074	EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2023-2144)	Nessus	Huawei Local Security Checks	6/9/2023	1/16/2024	high
165278	Ubuntu 16.04 ESM : Ghostscript vulnerability (USN-5618-1)	Nessus	Ubuntu Local Security Checks	9/21/2022	7/12/2023	high
171813	Amazon Linux 2 : ghostscript (ALAS-2023-1947)	Nessus	Amazon Linux Local Security Checks	2/22/2023	9/1/2023	high
173933	Amazon Linux AMI : ghostscript (ALAS-2023-1725)	Nessus	Amazon Linux Local Security Checks	4/6/2023	4/19/2023	high
178874	EulerOS Virtualization 3.0.6.6 : ghostscript (EulerOS-SA-2023-2423)	Nessus	Huawei Local Security Checks	7/26/2023	1/16/2024	high

Detections

Analytics

Plugins Search

high

critical

critical

high

high

high

high

high

high