CVE-2016-7977
published 2017-05-23CVE-2016-7977: Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the…
PriorityP434medium5.5CVSS 3.0
AVLACLPRNUIRSUCHINAN
EPSS
4.57%
90.5th percentile
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | ghostscript | <= 9.20 | — |
| artifex | ghostscript | >= 0 < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.21~dfsg-1 | 9.21~dfsg-1 |
| artifex | ghostscript | >= 0 < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.21~dfsg-1 | 9.21~dfsg-1 |
| artifex | ghostscript | >= 0 < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.21~dfsg-1 | 9.21~dfsg-1 |
| artifex | ghostscript | >= 0 < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.21~dfsg-1 | 9.21~dfsg-1 |
| artifex | ghostscript | >= 0 < 9.10~dfsg-0ubuntu10.5 | 9.10~dfsg-0ubuntu10.5 |
| artifex | ghostscript | >= 0 < 9.18~dfsg~0-0ubuntu2.2 | 9.18~dfsg~0-0ubuntu2.2 |
| debian | ghostscript | < ghostscript 9.21~dfsg-1 (bookworm) | ghostscript 9.21~dfsg-1 (bookworm) |
| debian | ghostscript | < ghostscript 9.19~dfsg-3.1 (bookworm) | ghostscript 9.19~dfsg-3.1 (bookworm) |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5HIGH
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-95h7-9j6q-g8q9: psi/zfile
ghsa_unreviewed·2022-05-14·CVSS 5.5
CVE-2018-11645 [MEDIUM] CWE-200 GHSA-95h7-9j6q-g8q9: psi/zfile
psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.
GHSA
GHSA-cvc4-qjwp-hwhc: Ghostscript before 9
ghsa_unreviewed·2022-05-14
CVE-2016-7977 [MEDIUM] CWE-200 GHSA-cvc4-qjwp-hwhc: Ghostscript before 9
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
OSV
CVE-2018-11645: psi/zfile
osv·2018-06-01·CVSS 5.5
CVE-2018-11645 [MEDIUM] CVE-2018-11645: psi/zfile
psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.
OSV
CVE-2016-7977: Ghostscript before 9
osv·2017-05-23·CVSS 5.5
CVE-2016-7977 [MEDIUM] CVE-2016-7977: Ghostscript before 9
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
OSV
ghostscript vulnerabilities
osv·2016-12-02·CVSS 5.5
CVE-2016-7976 [MEDIUM] ghostscript vulnerabilities
ghostscript vulnerabilities
Tavis Ormandy discovered multiple vulnerabilities in the way that Ghostscript
processes certain Postscript files. If a user or automated system were tricked
into opening a specially crafted file, an attacker could cause a denial of
service or possibly execute arbitrary code. (CVE-2016-7976, CVE-2016-7978,
CVE-2016-7979, CVE-2016-8602)
Multiple vulnerabilities were discovered in Ghostscript related to information
disclosure. If a user or automated system were tricked into opening a specially
crafted file, an attacker could expose sensitive data. (CVE-2013-5653,
CVE-2016-7977)
Debian
CVE-2018-11645: ghostscript - psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command eve...
vendor_debian·2018·CVSS 5.5
CVE-2018-11645 [MEDIUM] CVE-2018-11645: ghostscript - psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command eve...
psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.
Scope: local
bookworm: resolved (fixed in 9.21~dfsg-1)
bullseye: resolved (fixed in 9.21~dfsg-1)
forky: resolved (fixed in 9.21~dfsg-1)
sid: resolved (fixed in 9.21~dfsg-1)
trixie: resolved (fixed in 9.21~dfsg-1)
Ubuntu
Ghostscript vulnerabilities
vendor_ubuntu·2016-12-02·CVSS 5.5
CVE-2013-5653 [MEDIUM] Ghostscript vulnerabilities
Title: Ghostscript vulnerabilities
Summary: Ghostscript could be made to crash, run programs, or disclose sensitive
information if it processed a specially crafted file.
Tavis Ormandy discovered multiple vulnerabilities in the way that Ghostscript
processes certain Postscript files. If a user or automated system were tricked
into opening a specially crafted file, an attacker could cause a denial of
service or possibly execute arbitrary code. (CVE-2016-7976, CVE-2016-7978,
CVE-2016-7979, CVE-2016-8602)
Multiple vulnerabilities were discovered in Ghostscript related to information
disclosure. If a user or automated system were tricked into opening a specially
crafted file, an attacker could expose sensitive data. (CVE-2013-5653,
CVE-2016-7977)
Instructions: In general, a standard system
Red Hat
ghostscript: status command permitted with -dSAFER in psi/zfile.c allowing attackers to identify the size and existence of files
vendor_redhat·2016-10-05·CVSS 5.5
CVE-2018-11645 [MEDIUM] CWE-200 ghostscript: status command permitted with -dSAFER in psi/zfile.c allowing attackers to identify the size and existence of files
ghostscript: status command permitted with -dSAFER in psi/zfile.c allowing attackers to identify the size and existence of files
psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the existence and size of arbitrary files, a similar issue to CVE-2016-7977.
Ghostscript did not honor the -dSAFER option when executing the "status" instruction, which can be used to retrieve information such as a file's existence and size. A specially crafted postscript document could use this flow to gain information on the targeted system's filesystem content.
Package: ghostscript (Red Hat Enterprise Linux 5) - Will not fix
Package: ghostscript (Red Hat Enterprise Linux 6) - Will not fix
Package: ghostscrip
Red Hat
ghostscript: .libfile does not honor -dSAFER
vendor_redhat·2016-09-28·CVSS 5.5
CVE-2016-7977 [MEDIUM] ghostscript: .libfile does not honor -dSAFER
ghostscript: .libfile does not honor -dSAFER
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
It was found that ghostscript function .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could, in the context of the gs process, retrieve file content on the target machine.
Package: ghostscript (Red Hat Enterprise Linux 5) - Will not fix
Package: ghostscript (Red Hat OpenShift Enterprise 2) - Will not fix
Debian
CVE-2016-7977: ghostscript - Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode pr...
vendor_debian·2016·CVSS 5.5
CVE-2016-7977 [MEDIUM] CVE-2016-7977: ghostscript - Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode pr...
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
Scope: local
bookworm: resolved (fixed in 9.19~dfsg-3.1)
bullseye: resolved (fixed in 9.19~dfsg-3.1)
forky: resolved (fixed in 9.19~dfsg-3.1)
sid: resolved (fixed in 9.19~dfsg-3.1)
trixie: resolved (fixed in 9.19~dfsg-3.1)
Cisco
Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: January 2016
vendor_cisco
CVE-2015-7977 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: January 2016
CVE-2015-7977: Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: January 2016
Multiple Cisco products incorporate a version of the Network Time Protocol daemon (ntpd) package. Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition or modify the time being advertised by a device acting as a Network Time Protocol (NTP) server. On January 19, 2016, NTP Consortium at Network Time Foundation released a security advisory detailing 12 issues regarding multiple DoS vulnerabilities, information disclosure vulnerabilities, and logic issues that may allow an attacker to shift a client's time. The vulnerabilities covered in this document are as follows: CVE-
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-7977 ghostscript: .libfile does not honor -dSAFER
bugzilla·2016-09-29·CVSS 5.5
CVE-2016-7977 [MEDIUM] CVE-2016-7977 ghostscript: .libfile does not honor -dSAFER
CVE-2016-7977 ghostscript: .libfile does not honor -dSAFER
It was found that .libfile can be used to access arbitrary files on the file system.
PoC:
http://www.openwall.com/lists/oss-security/2016/09/29/3
Upstream bug:
http://bugs.ghostscript.com/show_bug.cgi?id=697169
Upstream fix:
http://git.ghostscript.com/?p=user/chrisl/ghostpdl.git;a=commitdiff;h=cf046d2
Discussion:
Created ghostscript tracking bugs for this issue:
Affects: fedora-all [bug 1380416]
---
CVE assignment:
http://seclists.org/oss-sec/2016/q4/37
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2017:0014 https://rhn.redhat.com/errata/RHSA-2017-0014.html
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2017:0013
Bugzilla
CVE-2015-7977 ntp: restriction list NULL pointer dereference
bugzilla·2016-01-20·CVSS 5.9
CVE-2015-7977 [MEDIUM] CVE-2015-7977 ntp: restriction list NULL pointer dereference
CVE-2015-7977 ntp: restriction list NULL pointer dereference
A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash the ntpd process.
Upstream patch (which also addresses CVE-2015-7978):
https://github.com/ntp-project/ntp/commit/8a0c765f3c47633fa262356b0818788d1cf249b1
Discussion:
External References:
http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit
http://www.talosintel.com/reports/TALOS-2016-0074/
---
Created ntp tracking bugs for this issue:
Affects: fedora-all [bug 1300277]
---
To exploit this issue, the attacker has to rely on two factors:
* ntpd to be configured to receive mode 7 packets. By
http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=8abd22010eb4db0fb1b10e430d5f5d83e015ef70http://rhn.redhat.com/errata/RHSA-2017-0013.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0014.htmlhttp://www.debian.org/security/2016/dsa-3691http://www.openwall.com/lists/oss-security/2016/09/29/28http://www.openwall.com/lists/oss-security/2016/10/05/15http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.securityfocus.com/bid/95334https://bugs.ghostscript.com/show_bug.cgi?id=697169https://ghostscript.com/doc/9.21/History9.htmhttps://security.gentoo.org/glsa/201702-31http://git.ghostscript.com/?p=ghostpdl.git%3Ba=commitdiff%3Bh=8abd22010eb4db0fb1b10e430d5f5d83e015ef70http://rhn.redhat.com/errata/RHSA-2017-0013.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0014.htmlhttp://www.debian.org/security/2016/dsa-3691http://www.openwall.com/lists/oss-security/2016/09/29/28http://www.openwall.com/lists/oss-security/2016/10/05/15http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.securityfocus.com/bid/95334https://bugs.ghostscript.com/show_bug.cgi?id=697169https://ghostscript.com/doc/9.21/History9.htmhttps://security.gentoo.org/glsa/201702-31
2017-05-23
Published