Artifex Ghostscript CVE-2017-15652 Information Disclosure Vulnerability

Bugtraq ID:	108463
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-15652
Remote:	Yes
Local:	No
Published:	May 23 2019 12:00AM
Updated:	May 23 2019 12:00AM
Credit:	Jasper Yu
Vulnerable:	ImageMagick ImageMagick 0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 7.0 Artifex Ghostscript 9.22
Not Vulnerable:

Artifex Ghostscript CVE-2017-15652 Information Disclosure Vulnerability

Artifex Ghostscript is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

Artifex Ghostscript 9.22 is vulnerable; other versions may also be affected.

Artifex Ghostscript CVE-2017-15652 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Artifex Ghostscript CVE-2017-15652 Information Disclosure Vulnerability

References:

• Bug 698676: have filenameforall permission check use "reduced" path (Artifex)
  
• Ghostscript Homepage (Ghostscript)
  
• ImageMagick Homepage (ImageMagick)
  
• Bug 698676 - Bypass -dSAFER in filenameforall command (Artifex)