[Secure-testing-team] Bug#859696: ghostscript: CVE-2017-5951

[Salvatore Bonaccorso]

Source: ghostscript
Version: 9.20~dfsg-3
Severity: important
Tags: upstream security
Forwarded: https://bugs.ghostscript.com/show_bug.cgi?id=697548

Hi,

the following vulnerability was published for ghostscript.

CVE-2017-5951[0]:
| The mem_get_bits_rectangle function in base/gdevmem.c in Artifex
| Software, Inc. Ghostscript 9.20 allows remote attackers to cause a
| denial of service (NULL pointer dereference and application crash) via
| a crafted file.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

As per 2017-04-06 there is no upstrream fix yet for this issue.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-5951
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5951

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore