CVE-2016-7976

The .sethalftone5 function in Ghostscript before version 9.21 allows remote attackers to cause application crashes or potentially execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.

The fill_threshhold_buffer function in base/gxht_thresh.c in Ghostscript 9.20 by Artifex Software, Inc. allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document.

Multiple use-after-free vulnerabilities in the gx_image_enum_begin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document.

Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.

A use-after-free vulnerability in Ghostscript 9.20 may allow remote attackers to execute arbitrary code via reference leaks in the .setdevice function.

A flaw was found in ghostscript for Red Hat Enterprise Linux 8, where the fix for CVE-2020-16305 was not included as previously claimed. This issue affects the ghostscript package specifically.

An integer overflow flaw was found in pl_glyph_name in Ghostscript, which may allow a local attacker to cause a denial of service by transforming a crafted PCL file to PDF format.

A buffer overflow flaw was found in the devn_pcx_write_rle() function in Ghostscript, which may allow a local attacker to cause a denial of service by outputting a crafted PDF file for a DEVN device.

Artifex Ghostscript before 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix).

The ghostscript command with the -dSAFER option allows remote attackers to execute commands.