CVE-2016-7976

high-risk

Published 2017-08-07

The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.

Do I need to act?

46.8% chance of exploitation in next 30 days

EPSS score — higher than 53% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Ghostscript

Artifex

http://www.debian.org/security/2016/dsa-3691

Mailing List http://www.openwall.com/lists/oss-security/2016/10/19/6

Third Party Advisory http://www.securityfocus.com/bid/95332

Issue Tracking https://bugs.ghostscript.com/show_bug.cgi?id=697178

Third Party Advisory https://security.gentoo.org/glsa/201702-31

http://www.debian.org/security/2016/dsa-3691

Mailing List http://www.openwall.com/lists/oss-security/2016/10/19/6

Third Party Advisory http://www.securityfocus.com/bid/95332

Issue Tracking https://bugs.ghostscript.com/show_bug.cgi?id=697178

Third Party Advisory https://security.gentoo.org/glsa/201702-31

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 17/34 · Moderate

Exposure 7/34 · Low