CVE-2017-11714
HighSummary
The psi/ztoken.c file in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, allowing remote attackers to cause application crashes or potentially other unspecified impacts via a crafted PostScript document.
Risk Assessment
Attackers may exploit this vulnerability to remotely trigger application crashes, potentially leading to service availability interruptions.
Recommendation
It is recommended to update to the latest version of Ghostscript to mitigate this vulnerability and to monitor systems for suspicious activity related to PostScript document processing.
Other vulnerabilities in Artifex Ghostscript 9.21
See all- CVE-2017-9835High
The gs_alloc_ref_array function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.
- CVE-2017-7948High
Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document.
Original NVD description (English source)
psi/ztoken.c in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document, related to an out-of-bounds read in the igc_reloc_struct_ptr function in psi/igc.c.