Cloudanix VulnDB

CVE-2016-10217

Medium · 5.5

CVSS

5.5

EPSS

1.5%

Published

Apr 3, 2017

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in older PDF processing software can make it crash when handling certain specially made files, potentially disrupting any service that converts or prints documents.

Exploit Available
Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in pdf14_open within the color management module allows a crafted PDF to trigger memory corruption and application crash.

Why it matters to the business

Processing untrusted PDF files can crash document conversion, printing, or rendering services, causing workflow interruptions and potential data loss in document-heavy environments.

How an attack unfolds

An attacker supplies a specially crafted PDF that is mishandled during color management initialization; the pdf14_open function frees an object that is later referenced, resulting in a crash. Public exploit code exists and the vulnerability has been referenced in threat actor discussions around Ghostscript type confusion issues.

How to fix it

Upgrade Ghostscript to a version later than 9.20 that resolves the pdf14_open use-after-free; if upgrade is not feasible, isolate PDF processing workloads and apply strict input validation or sandboxing.

How to confirm the fix worked

Confirm Ghostscript version is newer than 9.20; test with known proof-of-concept PDFs to verify absence of crash; review build logs or package manifests for the fixed gdevp14.c changes.

Typical attack path

  1. Craft malicious PDF targeting pdf14_open color handling
  2. Deliver file to target via email, web, or file share
  3. Victim or service opens the file with Ghostscript 9.20
  4. Color management module triggers use-after-free and crashes

How to detect it

Search application and system logs for Ghostscript segmentation faults or use-after-free errors immediately following PDF file opens; correlate crash dumps with recent PDF file access timestamps.

What your security team should do

  • Immediately inventory all Ghostscript 9.20 deployments and schedule upgrades
  • Block or sandbox untrusted PDF processing until patched
  • Monitor for Ghostscript crashes correlated with PDF ingestion
  • Review downstream dependents for embedded Ghostscript usage

The record

The pdf14_open function in base/gdevp14.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted file that is mishandled in the color management module.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 ghostscript 0 9.20~dfsg-3.1
Debian:12 ghostscript 0 9.20~dfsg-3.1
Debian:13 ghostscript 0 9.20~dfsg-3.1
Mageia:5 ghostscript 0 9.20-1.mga5
Mageia:5 gutenprint 0 5.2.10-5.1.mga5
Mageia:5 libspectre 0 0.2.7-5.1.mga5
Ubuntu:14.04:LTS ghostscript 0 9.10~dfsg-0ubuntu10.7
Ubuntu:16.04:LTS ghostscript 0 9.18~dfsg~0-0ubuntu2.4
openSUSE:Tumbleweed ghostscript 0 9.54.0-2.2

Related vulnerabilities