CVE-2016-8602: artifex ghostscript Incorrect Type Conversion or Cast
Vulnerability summary
CVE-2016-8602 is a high (CVSS 7.8) Incorrect Type Conversion or Cast vulnerability in artifex ghostscript. EPSS estimates a 3.21% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 2Timeline
- 14-04-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
3.21%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.21% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Suse7 products
- ghostscript-library&distro=SUSE Linux Enterprise Server 11 SP4< 8.62-32.41.1
- ghostscript-library&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 8.62-32.41.1
- ghostscript-library&distro=SUSE Linux Enterprise Software Development Kit 11 SP4< 8.62-32.41.1
- ghostscript&distro=SUSE Linux Enterprise Desktop 12 SP1< 9.15-14.1
- ghostscript&distro=SUSE Linux Enterprise Server 12 SP1< 9.15-14.1
Artifex1 product
- ghostscript≤ 9.20
Debian1 product
- ghostscript< 9.19~dfsg-3.1
Ubuntu1 product
- ghostscript< 9.10~dfsg-0ubuntu10.5 | < 9.18~dfsg~0-0ubuntu2.2
4 vendors · 10 products
References
20 links
- www.openwall.com/lists/oss-security/2016/10/11/7Mailing ListX Refsource MLISTPatchThird Party Advisory
- git.ghostscript.com?p=ghostpdl.git%3Ba=commitdiff%3Bh=f5c7555c303X Refsource CONFIRM
Show all 20 references
- www.openwall.com/lists/oss-security/2016/10/11/5Mailing ListX Refsource MLISTPatchThird Party Advisory