CVE-2016-7978
published 2017-05-23CVE-2016-7978: Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
PriorityP354critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
5.53%
91.9th percentile
Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| artifex | ghostscript | — | — |
| artifex | ghostscript | >= 0 < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.19~dfsg-3.1 | 9.19~dfsg-3.1 |
| artifex | ghostscript | >= 0 < 9.10~dfsg-0ubuntu10.5 | 9.10~dfsg-0ubuntu10.5 |
| artifex | ghostscript | >= 0 < 9.18~dfsg~0-0ubuntu2.2 | 9.18~dfsg~0-0ubuntu2.2 |
| debian | ghostscript | < ghostscript 9.19~dfsg-3.1 (bookworm) | ghostscript 9.19~dfsg-3.1 (bookworm) |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Ghostscript vulnerabilities
vendor_ubuntu·2016-12-02·CVSS 5.5
CVE-2013-5653 [MEDIUM] Ghostscript vulnerabilities
Title: Ghostscript vulnerabilities
Summary: Ghostscript could be made to crash, run programs, or disclose sensitive
information if it processed a specially crafted file.
Tavis Ormandy discovered multiple vulnerabilities in the way that Ghostscript
processes certain Postscript files. If a user or automated system were tricked
into opening a specially crafted file, an attacker could cause a denial of
service or possibly execute arbitrary code. (CVE-2016-7976, CVE-2016-7978,
CVE-2016-7979, CVE-2016-8602)
Multiple vulnerabilities were discovered in Ghostscript related to information
disclosure. If a user or automated system were tricked into opening a specially
crafted file, an attacker could expose sensitive data. (CVE-2013-5653,
CVE-2016-7977)
Instructions: In general, a standard system
Red Hat
ghostscript: reference leak in .setdevice allows use-after-free and remote code execution
vendor_redhat·2016-09-30·CVSS 9.8
CVE-2016-7978 [CRITICAL] CWE-416 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution
ghostscript: reference leak in .setdevice allows use-after-free and remote code execution
Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
It was found that the ghostscript function .setdevice suffered a use-after-free vulnerability due to an incorrect reference count. A specially crafted postscript document could trigger code execution in the context of the gs process.
Package: ghostscript (Red Hat Enterprise Linux 5) - Not affected
Package: ghostscript (Red Hat Enterprise Linux 6) - Not affected
Package: ghostscript (Red Hat OpenShift Enterprise 2) - Not affected
Debian
CVE-2016-7978: ghostscript - Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to...
vendor_debian·2016·CVSS 9.8
CVE-2016-7978 [CRITICAL] CVE-2016-7978: ghostscript - Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to...
Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
Scope: local
bookworm: resolved (fixed in 9.19~dfsg-3.1)
bullseye: resolved (fixed in 9.19~dfsg-3.1)
forky: resolved (fixed in 9.19~dfsg-3.1)
sid: resolved (fixed in 9.19~dfsg-3.1)
trixie: resolved (fixed in 9.19~dfsg-3.1)
Cisco
Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: January 2016
vendor_cisco
CVE-2015-7978 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: January 2016
CVE-2015-7978: Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: January 2016
Multiple Cisco products incorporate a version of the Network Time Protocol daemon (ntpd) package. Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition or modify the time being advertised by a device acting as a Network Time Protocol (NTP) server. On January 19, 2016, NTP Consortium at Network Time Foundation released a security advisory detailing 12 issues regarding multiple DoS vulnerabilities, information disclosure vulnerabilities, and logic issues that may allow an attacker to shift a client's time. The vulnerabilities covered in this document are as follows: CVE-
GHSA
GHSA-jp8p-fj2v-5982: Use-after-free vulnerability in Ghostscript 9
ghsa_unreviewed·2022-05-14
CVE-2016-7978 [CRITICAL] CWE-416 GHSA-jp8p-fj2v-5982: Use-after-free vulnerability in Ghostscript 9
Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
OSV
CVE-2016-7978: Use-after-free vulnerability in Ghostscript 9
osv·2017-05-23·CVSS 9.8
CVE-2016-7978 [CRITICAL] CVE-2016-7978: Use-after-free vulnerability in Ghostscript 9
Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
OSV
ghostscript vulnerabilities
osv·2016-12-02·CVSS 5.5
CVE-2016-7976 [MEDIUM] ghostscript vulnerabilities
ghostscript vulnerabilities
Tavis Ormandy discovered multiple vulnerabilities in the way that Ghostscript
processes certain Postscript files. If a user or automated system were tricked
into opening a specially crafted file, an attacker could cause a denial of
service or possibly execute arbitrary code. (CVE-2016-7976, CVE-2016-7978,
CVE-2016-7979, CVE-2016-8602)
Multiple vulnerabilities were discovered in Ghostscript related to information
disclosure. If a user or automated system were tricked into opening a specially
crafted file, an attacker could expose sensitive data. (CVE-2013-5653,
CVE-2016-7977)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-7978 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution [fedora-all]
bugzilla·2016-11-01·CVSS 9.8
CVE-2016-7978 [CRITICAL] CVE-2016-7978 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution [fedora-all]
CVE-2016-7978 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2016-7978 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution
bugzilla·2016-10-06·CVSS 9.8
CVE-2016-7978 [CRITICAL] CVE-2016-7978 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution
CVE-2016-7978 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution
An incorrect reference count was found in .setdevice. This leads to a use-after-free, triggering a Denial of Service, or possibly, arbitrary code execution.
Upstream bug :
- Bug 697179 - double free with .setdevice
http://bugs.ghostscript.com/show_bug.cgi?id=697179
upstream fix :
- Bug 697179: Reference count device icc profile when copying a device
http://git.ghostscript.com/?p=user/chrisl/ghostpdl.git;a=commitdiff;h=d5ad1e02
Reference :
http://seclists.org/oss-sec/2016/q4/37
Discussion:
Ghostscript's ICC profile management is a feature that started with version 9.
Thus previous versions, in particular ghostscript 8.70, do not have capability to open ICC profile files for color ma
Bugzilla
CVE-2015-7977 ntp: restriction list NULL pointer dereference
bugzilla·2016-01-20·CVSS 5.9
CVE-2015-7977 [MEDIUM] CVE-2015-7977 ntp: restriction list NULL pointer dereference
CVE-2015-7977 ntp: restriction list NULL pointer dereference
A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash the ntpd process.
Upstream patch (which also addresses CVE-2015-7978):
https://github.com/ntp-project/ntp/commit/8a0c765f3c47633fa262356b0818788d1cf249b1
Discussion:
External References:
http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit
http://www.talosintel.com/reports/TALOS-2016-0074/
---
Created ntp tracking bugs for this issue:
Affects: fedora-all [bug 1300277]
---
To exploit this issue, the attacker has to rely on two factors:
* ntpd to be configured to receive mode 7 packets. By
http://rhn.redhat.com/errata/RHSA-2017-0013.htmlhttp://www.debian.org/security/2016/dsa-3691http://www.openwall.com/lists/oss-security/2016/10/05/15http://www.securityfocus.com/bid/95336https://bugs.ghostscript.com/show_bug.cgi?id=697179https://security.gentoo.org/glsa/201702-31http://rhn.redhat.com/errata/RHSA-2017-0013.htmlhttp://www.debian.org/security/2016/dsa-3691http://www.openwall.com/lists/oss-security/2016/10/05/15http://www.securityfocus.com/bid/95336https://bugs.ghostscript.com/show_bug.cgi?id=697179https://security.gentoo.org/glsa/201702-31
2017-05-23
Published