CVE-2017-9835
HighSummary
The gs_alloc_ref_array function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.
Risk Assessment
Attackers may exploit this vulnerability to remotely crash the application, leading to service downtime. It may also result in other unspecified impacts on the system.
Recommendation
It is recommended to update to the latest version of Ghostscript to mitigate this vulnerability. Additionally, monitor and analyze PostScript documents before processing them.
Other vulnerabilities in Artifex Ghostscript 9.21
See all- CVE-2017-11714High
The psi/ztoken.c file in Artifex Ghostscript 9.21 mishandles references to the scanner state structure, allowing remote attackers to cause application crashes or potentially other unspecified impacts via a crafted PostScript document.
- CVE-2017-7948High
Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document.
Original NVD description (English source)
The gs_alloc_ref_array function in psi/ialloc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted PostScript document. This is related to a lack of an integer overflow check in base/gsalloc.c.