Arbitrary Code Execution

2020-04-1001:09:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

JSON

ghostscript is vulnerable to arbitrary code execution. The vulnerability exists as an integer overflow flaw was found in Ghostscript’s TrueType bytecode interpreter. An attacker could create a specially-crafted PostScript or PDF file that, when interpreted, could cause Ghostscript to crash or, potentially, execute arbitrary code.

CPENameOperatorVersion
ghostscripteq8.15.2__9.1.el5
ghostscripteq8.15.2__9.11.el5
ghostscripteq8.15.2__9.4.el5
ghostscripteq8.15.2__9.12.el5_5
ghostscripteq8.15.2__9.4.el5_3.4
ghostscripteq8.15.2__9.3.el5
ghostscripteq8.70__6.el6
ghostscripteq8.15.2__9.1.el5_1.1
ghostscripteq8.15.2__9.4.el5_3.7
ghostscripteq8.15.2__9.1.el5

Name	Operator	Version
ghostscript	eq	8.15.2__9.1.el5
ghostscript	eq	8.15.2__9.11.el5
ghostscript	eq	8.15.2__9.4.el5
ghostscript	eq	8.15.2__9.12.el5_5
ghostscript	eq	8.15.2__9.4.el5_3.4
ghostscript	eq	8.15.2__9.3.el5
ghostscript	eq	8.70__6.el6
ghostscript	eq	8.15.2__9.1.el5_1.1
ghostscript	eq	8.15.2__9.4.el5_3.7
ghostscript	eq	8.15.2__9.1.el5