CVE-2017-6196 Artifex CVE debrief

Who should care

Administrators and vendors that ship or embed Ghostscript, especially systems that process untrusted PostScript or related print/PDF conversion inputs. Security teams should also care if Ghostscript is exposed in server-side document pipelines, viewer/conversion services, or packaged desktop tooling.

Technical summary

The NVD record identifies CWE-416 (use-after-free) in base/gxipixel.c, specifically in gx_image_enum_begin(). The vulnerable range is tied to Ghostscript builds before the referenced upstream fix commit ecceafe3abba2714ef9b432035fe0739d9b1a283. The CVE description says the issue can be triggered by a crafted PostScript document. NVD’s CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which indicates user interaction is required and the exploitability context is constrained differently than the prose description’s “remote attackers” wording; both are present in the official record.

Defensive priority

High for any environment that processes untrusted PostScript or ships Ghostscript. The combination of memory corruption, user interaction, and file-processing exposure makes this worth prioritizing for patching and package updates, especially in internet-facing or shared document workflows.

Recommended defensive actions

• Update Ghostscript to a version that includes the upstream fix referenced by commit ecceafe3abba2714ef9b432035fe0739d9b1a283.
• Inventory where Ghostscript is used directly or indirectly, including printers, converters, previewers, and document-processing services.
• Restrict or sandbox Ghostscript processing of untrusted documents until patched.
• Treat crafted PostScript as untrusted input and block or quarantine suspicious inbound files.
• Verify downstream vendor packages and advisories for backported fixes, especially if using distro-provided Ghostscript builds.

Evidence notes

Primary evidence comes from the NVD CVE record and its cited references. The record names multiple use-after-free vulnerabilities in gx_image_enum_begin() in base/gxipixel.c and points to the upstream Ghostscript commit ecceafe3abba2714ef9b432035fe0739d9b1a283, the Ghostscript bug tracker entry 697596 marked as issue tracking/patch, and the Gentoo GLSA advisory. The official NVD metadata also classifies the weakness as CWE-416 and assigns CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Official resources