CVE-2016-7978 — Use After Free in Ghostscript

CWE-416 — Use After Free13 documents9 sources
Severity
9.8CRITICALNVD
OSV5.5
EPSS
3.0%
top 13.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Artifex Ghostscript
Timeline
PublishedMay 23
Latest updateMay 14

Description

Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Debianartifex/ghostscript< 9.19~dfsg-3.1+3
▶Ubuntuartifex/ghostscript< 9.10~dfsg-0ubuntu10.5+1

Patches

Patch: www.openwall.com ↗Patch: bugs.ghostscript.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-jp8p-fj2v-5982: Use-after-free vulnerability in Ghostscript 9↗2022-05-14
▶
CVEList
CVE-2016-7978: Use-after-free vulnerability in Ghostscript 9↗2017-05-23
▶
OSV
CVE-2016-7978: Use-after-free vulnerability in Ghostscript 9↗2017-05-23
▶
OSV
ghostscript vulnerabilities↗2016-12-02
▶

📋Vendor Advisories

3
Ubuntu
Ghostscript vulnerabilities↗2016-12-02
▶
Red Hat
ghostscript: reference leak in .setdevice allows use-after-free and remote code execution↗2016-09-30
▶
Debian
CVE-2016-7978: ghostscript - Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-7978 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution [fedora-all]↗2016-11-01
▶
Bugzilla
CVE-2016-7978 ghostscript: reference leak in .setdevice allows use-after-free and remote code execution↗2016-10-06
▶
Bugzilla
CVE-2015-7977 ntp: restriction list NULL pointer dereference↗2016-01-20
▶
CVE-2016-7978 — Use After Free in Artifex Ghostscript | cvebase