Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2016-10220: Ghostscript 9.20 can crash on crafted PDF files
CVE-2016-10220 · published 9 years ago
Summary
The Ghostscript 9.20 program may stop working if it opens a specially crafted PDF that tricks its transparency handling code. This causes the program to crash, denying service to anyone relying on it. Update Ghostscript to a newer version or apply the vendor's patch to prevent the problem.
What to do
- Update debian ghostscript to version 9.20~dfsg-3.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | ghostscript |
< 9.20~dfsg-3.1 Fix: upgrade to 9.20~dfsg-3.1
|
| Debian:13 | debian | ghostscript |
< 9.20~dfsg-3.1 Fix: upgrade to 9.20~dfsg-3.1
|
| Debian:14 | debian | ghostscript |
< 9.20~dfsg-3.1 Fix: upgrade to 9.20~dfsg-3.1
|
| – | artifex | ghostscript |
9.20 cpe:2.3:a:artifex:ghostscript:9.20:*:*:*:*:*:*:* |
Original advisory text
The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application cras...
The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module.
References
- https://security-tracker.debian.org/tracker/CVE-2016-10220 Vendor Advisory
- http://www.debian.org/security/2017/dsa-3838
- http://www.ghostscript.com/cgi-bin/findgit.cgi?daf85701dab05f17e924a48a81edc9195... Issue Tracking Vendor Advisory
- https://bugs.ghostscript.com/show_bug.cgi?id=697450 Exploit Issue Tracking Patch
- https://security.gentoo.org/glsa/201708-06
Severity
5.5
Medium
Type
CWE-476NULL Pointer Dereference
Timeline
Published3 Apr 2017
Updated3 Nov 2026
First seen22 Sep 2026
Track software like this
Free during beta