Multiple use-after-free vulnerabilities in the gximageenumbegin function in base/gxipixel.c in Ghostscript before ecceafe3abba2714ef9b432035fe0739d9b1a283 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PostScript document.

It was found that getenv and filenameforall ignore -dSAFER possibly allowing filesystem enumeration.

Upstream bug:

http://bugs.ghostscript.com/showbug.cgi?id=694724

Upstream patch:

http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=ab109aaeb3ddba59518b036fb288402a65cf7ce8

Reference: http://seclists.org/oss-sec/2016/q3/651

Reproducer:

%!PS (HOME) getenv { print (\n) print } { (variable not found\n) print } ifelse

The gstype2interpret function in Ghostscript allows remote attackers to cause a denial of service (incorrect pointer dereference and application crash) via crafted font data in a compressed data stream, aka bug 691043.