CVE-2016-7977: Infoleak
Published May 23, 2017
·Updated
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
Affected Software
1 affected component
Artifex ghostscript<=9.20
Remediation
Patch Available
Patch Available
Patch Available
Event History
May 23, 2017
CVE Published
via MITRE·03:56 AM
Data Sourced
via MITRE·03:56 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-7977?
CVE-2016-7977 has been classified as a high severity vulnerability due to its ability to bypass protection mechanisms.
2
How do I fix CVE-2016-7977?
To fix CVE-2016-7977, you should update Ghostscript to version 9.21 or later.
3
What types of attacks are possible due to CVE-2016-7977?
Due to CVE-2016-7977, attackers can potentially read arbitrary files on the server by exploiting crafted postscript documents.
4
Which versions of Ghostscript are affected by CVE-2016-7977?
CVE-2016-7977 affects all versions of Ghostscript prior to 9.21.
5
Is there a workaround for CVE-2016-7977 until a fix is applied?
There is no documented effective workaround for CVE-2016-7977; updating to a safe version is the recommended approach.