ghostscript command execution vulnerability alerts-a vulnerability alert-the black bar safety net

8 on the 21st, Tavis Ormandy disclosed by the mail list hxxps://bugs. chromium. org/p/project-zero/issues/detail? id=1640, and again that ghostscript security sandbox can be bypassed by constructing a malicious image content, can cause the command execution. ghostscript is widely used, ImageMagic...

Ghostscript Flaws Allow Remote Takeover of Systems

UPDATE Researchers have uncovered vulnerabilities in the widely deployed Ghostscript package that allows bad actors to remotely take control of vulnerable systems. As of August 24, 2018, all reported problems have been fixed and will be part of the next Ghostscript release in late September, a...

Critical Flaws in Ghostscript Could Leave Many Systems at Risk of Hacking

Google Project Zero's security researcher has discovered a critical remote code execution RCE vulnerability in Ghostscript—an open source interpreter for Adobe Systems' PostScript and PDF page description languages. Written entirely in C, Ghostscript is a package of software that runs on differen...

Critical Flaws in Ghostscript Could Leave Many Systems at Risk of Hacking

Google Project Zero's security researcher has discovered a critical remote code execution RCE vulnerability in Ghostscript—an open source interpreter for Adobe Systems' PostScript and PDF page description languages. Written entirely in C, Ghostscript is a package of software that runs on differen...

Ghostscript - Multiple Vulnerabilities

Ghostscript - Multiple Vulnerabilities http://seclists.org/oss-sec/2018/q3/142 These are critical and trivial remote code execution bugs in things like ImageMagick, Evince, GIMP, and most other PDF/PS tools. ---- Hello, this was discussed on the distros list, but it was suggested to move discussi...

Ghostscript - Multiple Vulnerabilities

http://seclists.org/oss-sec/2018/q3/142 These are critical and trivial remote code execution bugs in things like ImageMagick, Evince, GIMP, and most other PDF/PS tools. ---- Hello, this was discussed on the distros list, but it was suggested to move discussion to oss-security. You might recall I...

PT-2018-3467

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 9.23 Description: The issue is related to insufficient access control in the .tempfile component of the Ghostscript software suite for document processing, conversion, and generation. Exploitation of this...

PT-2018-2554

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 9.24 Description The issue is related to a type confusion in ztype that could be exploited by remote attackers who can supply crafted PostScript, potentially allowing them to crash the interpreter or have...

Ghostscript Failed Restore Command Execution

This module exploits a -dSAFER bypass in Ghostscript to execute arbitrary commands by handling a failed restore grestore in PostScript to disable LockSafetyParams and avoid invalidaccess. This vulnerability is reachable via libraries such as ImageMagick. Module Options msf use...

PT-2018-2295

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 9.24 Description An issue in Artifex Ghostscript allows attackers to execute code using the "pipe" instruction by supplying crafted PostScript, due to incorrect "restoration of privilege" checking during...

PT-2018-2555

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 9.24 Description The issue is related to a type confusion in the setcolor function, which can be exploited by supplying crafted PostScript files. This could potentially allow attackers to crash the...

Ghostscript Vulnerability

NCCIC is aware of a Ghostscript vulnerability affecting various vendors. An attacker could exploit this vulnerability to take control of an affected system. NCCIC encourages users and administrators to review the Vulnerability Note VU332928, apply the necessary workarounds, and refer to vendors f...

Ghostscript contains multiple -dSAFER sandbox bypass vulnerabilities

Overview Ghostscript contains multiple -dSAFER sandbox bypass vulnerabilities, which may allow a remote, unauthenticated attacker to execute arbitrary commands on a vulnerable system. Description Ghostscript contains an optional -dSAFER option, which is supposed to prevent unsafe PostScript...

Ghostscript -- arbitrary code execution

CERT reports: Ghostscript contains an optional -dSAFER option, which is supposed to prevent unsafe PostScript operations. Multiple PostScript operations bypass the protections provided by -dSAFER, which can allow an attacker to execute arbitrary commands with arbitrary arguments. This vulnerabili...

openSUSE Security Update : ghostscript (openSUSE-2018-706)

This update for ghostscript fixes the following issues : - CVE-2018-10194: The settextdistance function did not prevent overflows in text-positioning calculation, which allowed remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted...

Security update for ghostscript (moderate)

This update for ghostscript fixes the following issues: - CVE-2018-10194: The settextdistance function did not prevent overflows in text-positioning calculation, which allowed remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted P...

SUSE-SU-2018:1884-1 Security update for ghostscript

This update for ghostscript fixes the following issues: - CVE-2018-10194: The settextdistance function did not prevent overflows in text-positioning calculation, which allowed remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted P...

Security Bulletin: A vulnerability in Ghostscript affects PowerKVM

Summary PowerKVM is affected by a vulnerability in Ghostscript. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-7207 DESCRIPTION: Artifex Software Ghostscript is vulnerable to a denial of service, caused by a NULL pointer dereference in the memgetbitsrectangle...

Security Bulletin: A vulnerability in ghostscript affects PowerKVM

Summary PowerKVM is affected by a vulnerability in ghostscript. IBM has now addressed this vulnerability. Vulnerability Details CVEID: CVE-2017-8291 DESCRIPTION: Artifex Ghostscript could allow a remote attacker to execute arbitrary commands on the system. By using .rsdparams type confusion with ...

Security Bulletin: Vulnerabilities in Ghostscript affect PowerKVM

Summary PowerKVM is affected by vulnerabilities in ghostscript. IBM has now addressed these vulnerabilities. Vulnerability Details CVEID: CVE-2013-5653 DESCRIPTION: Ghostscript could allow a remote attacker to obtain sensitive information, caused by the failure to honor the -dSAFER option by the...