CVE-2017-9740
HighSummary
The xps_decode_font_char_imp function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read, leading to application crash. The attack can be executed via a crafted document.
Risk Assessment
The organization may experience service interruptions and potential losses due to application crashes. There is also a risk of unspecified impact on the system.
Recommendation
It is recommended to update to the latest version of Ghostscript to mitigate the risks associated with this vulnerability. Additionally, monitoring documents sent to the system for potential attacks is advised.
Other vulnerabilities in Artifex Ghostscript GhostXPS 9.21
See all- CVE-2017-9739High
The Ins_JMPR function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
- CVE-2017-9727High
The gx_ttfReader__Read function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read, leading to application crash.
- CVE-2017-9726High
The Ins_MDRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
- CVE-2017-9620High
The xps_select_font_encoding function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read and application crash via a crafted document.
- CVE-2017-9619High
The xps_true_callback_glyph_name function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause an application crash via a crafted file.
- CVE-2017-9618High
The xps_load_sfnt_name function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause an application crash via a crafted document due to a buffer overflow.
- CVE-2017-9612High
The Ins_IP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via a crafted document.
- CVE-2017-9611High
The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.
- CVE-2017-9610High
The xps_load_sfnt_name function in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service through heap-based buffer over-read, leading to application crash. Other unspecified impacts may also be possible.
Original NVD description (English source)
The xps_decode_font_char_imp function in xps/xpsfont.c in Artifex Ghostscript GhostXPS 9.21 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly have unspecified other impact via a crafted document.