CVE-2013-5653

Опубликовано: 07 мар. 2017

Источник: nvd

CVSS3: 5.5

CVSS2: 4.3

EPSS Низкий

Описание

The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.

Ссылки

http://rhn.redhat.com/errata/RHSA-2017-0013.html
http://rhn.redhat.com/errata/RHSA-2017-0014.html
http://www.debian.org/security/2016/dsa-3691
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/29/28
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/29/5
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/96497
https://bugs.ghostscript.com/show_bug.cgi?id=694724
Issue Tracking
Patch
https://bugs.ghostscript.com/show_bug.cgi?id=697169
Issue Tracking
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1380327
Issue Tracking
Patch
http://rhn.redhat.com/errata/RHSA-2017-0013.html
http://rhn.redhat.com/errata/RHSA-2017-0014.html
http://www.debian.org/security/2016/dsa-3691
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/29/28
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/29/5
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/96497
https://bugs.ghostscript.com/show_bug.cgi?id=694724
Issue Tracking
Patch
https://bugs.ghostscript.com/show_bug.cgi?id=697169
Issue Tracking
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1380327
Issue Tracking
Patch

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:artifex:afpl_ghostscript:9.10:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00253

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2013-5653

CVSS3: 5.5

ubuntu

почти 9 лет назад

The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.

CVE-2013-5653

CVSS3: 4

redhat

больше 12 лет назад

The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.

CVE-2013-5653

CVSS3: 5.5

debian

почти 9 лет назад

The getenv and filenameforall functions in Ghostscript 9.10 ignore the ...

openSUSE-SU-2016:2855-1

suse-cvrf

около 9 лет назад

Security update for ghostscript

SUSE-SU-2016:2817-1

suse-cvrf

около 9 лет назад

Security update for ghostscript

EPSS

Процентиль: 48%

0.00253

Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200